Daniel Stenberg wrote:

> On Fri, 6 Jun 2003, Ralph Mitchell wrote:
>
> > I decided to have a go at patching it up myself. The attached diff patches
> > lib/transfer.c to replace spaces with plus-signs in the redirect url.
> > This is against curl-7.10.5.
> >
> > BTW, it works just great - I can now get past the login and pull subsequent
> > pages.
>
> Just a little remark on the patch. It only works for a subset of possible
> location headers with spaces, while others will be a bit surprising. See:
>
> A) Location: /script.cgi?name=daniel stenberg&age=ooold
>
> This is the case your patch solves.
>
> B) Location: http://www.host with spaces.com/
>
> This is one truly bad location in the first place, as host names can't have
> spaces but your patch may convert it into a legal(?) host name. At least
> different.
>
> C) Location: directory with spaces/file/index.html
>
> This is perhaps more interesting, as directories sometimes contain spaces.
> However, the correct URL code for the spaces here is "%20". The '+' for
> spaces is only valid on the right side of the '?' letter (AFAIR).
>
> What does the browsers do on these kinds of headers?

I didn't realize there was a difference between the '+' and '%20'... As for
case B, I suppose the loop at transfer.c:721 could look for a '?' and only
substitute spaces after seeing one, and break out of the copy if a space is
encountered before a '?'.

When I go to the URL in Netscape 4.79, I get back "The parameter is incorrect",
and the location bar contains the url with spaces. If I replace the spaces, I
get to the next redirect, which also contains spaces, etc. Internet Explorer,
on the other hand, works just fine, but then it is an IIS server at the other
end, and I've long suspected that Microsoft 'tweaks' the protocol... Well,
never mind, that's a whole other can of worms... :)

As for my script, either I go with my patch (or something similar), or I have to
turn off redirect-following and convert spaces to plusses myself. I'll also try
to convince the developers that their web pages suck, but that might take
awhile.

I don't want to introduce something that could bite us further down the line, so
I won't fight too hard for the patch :)

Ralph

-------------------------------------------------------
This SF.net email is sponsored by: Etnus, makers of TotalView, The best
thread debugger on the planet. Designed with thread debugging features
you've never dreamed of, try TotalView 6 free at www.etnus.com.
Received on 2003-06-06