Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Certain valid characters in refs aren't being escaped properly #1250

Closed
mistydemeo opened this issue May 1, 2020 · 2 comments · Fixed by #1529
Closed

Certain valid characters in refs aren't being escaped properly #1250

mistydemeo opened this issue May 1, 2020 · 2 comments · Fixed by #1529
Labels
Type: Bug Something isn't working as documented

Comments

@mistydemeo
Copy link

Certain valid characters in git branch names aren't being escaped properly, leading to a failure to fetch them. A good example is #, which will obviously break API calls if passed through without escaping.

This was broken by #1006. URI::Parser handles this correctly, escaping # to %23, while Addressable::URI leaves it as #. Versions of Octokit from 4.9.0 to current git HEAD are affected.

Steps to reproduce:

  1. Create and push up a branch named foo#bar
  2. Using Octokit, run client.branch("myrepo", "foo#bar")

Expected results:

Octokit fetches the branch and returns metadata.

Actual results:

Octokit returns a 404.

@tarebyte tarebyte added the bug label May 1, 2020
@indigok
Copy link

indigok commented May 4, 2020

I double checked this using curl and got the same results, so it looks like it might be a problem with the API itself.

For example, trying

curl -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/repos/octopup/api-sandbox/branches/test#this

returns:

{
  "message": "Branch not found",
  "documentation_url": "https://developer.github.com/v3/repos/branches/#get-branch"
}

Although I can see the branch test#this under curl -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/repos/octopup/api-sandbox/branches and the other branches like master work as expected.

Additionally, escaping it directly works as expected:

curl -H "Authorization: token $GITHUB_TOKEN" https://api.github.com/repos/octopup/api-sandbox/branches/test%23this

@mistydemeo
Copy link
Author

@hmharvey I believe that's expected. Because of how URL routing works, anything past a literal # doesn't make its way into the server to the app. # always needs to be encoded in order to be used in URLs like this.

@nickfloyd nickfloyd added Type: Bug Something isn't working as documented and removed bug labels Oct 28, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Type: Bug Something isn't working as documented
Projects
None yet
Development

Successfully merging a pull request may close this issue.

4 participants