After an evaluation, GNOME has moved from Bugzilla to GitLab. Learn more about GitLab.
No new issues can be reported in GNOME Bugzilla anymore.
To report an issue in a GNOME project, go to GNOME GitLab.
Do not go to GNOME Gitlab for: Bluefish, Doxygen, GnuCash, GStreamer, java-gnome, LDTP, NetworkManager, Tomboy.
Bug 337486 - xsltDocumentElem don't unescape filename before operations with file
xsltDocumentElem don't unescape filename before operations with file
Status: RESOLVED FIXED
Product: libxslt
Classification: Platform
Component: general
1.1.15
Other All
: Normal normal
: ---
Assigned To: Daniel Veillard
libxml QA maintainers
Depends on: 344588
Blocks:
 
 
Reported: 2006-04-06 12:09 UTC by vyt
Modified: 2006-10-11 09:16 UTC
See Also:
GNOME target: ---
GNOME version: ---

Attachments
Code cleanup patch for 1.1.17 (2.71 KB, patch)
2006-06-11 17:29 UTC, Mikhail Zabaluev 		none Details | Review

Description vyt 2006-04-06 12:09:01 UTC 
Please describe the problem:
I know that @href in exsl:document is an URI.

But security check and xsltSaveResultToFilename works with files on filesystem
so filename should be escaped:
filename = (xmlChar *) xmlURIUnescapeString((const char *)filename,0,NULL);

Otherwise libxslt restrict created filenames to ASCII subset :(

Steps to reproduce:


Actual results:


Expected results:


Does this happen every time?


Other information:
Comment 1 vyt 2006-04-06 12:10:12 UTC 
Typo, sorry. Read as:
so filename should be UNescaped:
filename = (xmlChar *) xmlURIUnescapeString((const char *)filename,0,NULL);
Comment 2 Mikhail Zabaluev 2006-06-11 17:29:52 UTC 
Created attachment 67142 [details] [review]
Code cleanup patch for 1.1.17

The real cause is described in the bug #344588, but I've got a patch that streamlines write security checks by elimination of recursive parsing, and potentially buggy repeated unescaping, for directory URIs, and simplifies the code.
Comment 3 Daniel Veillard 2006-10-11 09:16:40 UTC 
Okay bug #344588 should be fixed now, and the patch in #2 looks fine to me, 
so applied and commited too,

  thanks !

Daniel