php remote client url encoding issue

[dan2342]

i was just trying to put the webservice.php to use and found that it didn't work correctly without adding a urldecode to line 78:

require_once('./TeraWurflWebservice.php');
$userAgent = urldecode($_REQUEST['ua']);
$searchPhrase = $_REQUEST['search'];

It was only matching generic devices in recovery matches instead of matching exact as it does when not using the web service or when adding the urldecode().

It works correctly without when entering the webservice uri directly in the browser, but when using the TeraWurflRemoteClient.php it doesn't work. I noticed this line which urlencodes the userAgent:

$uri = $this->webserviceUrl . (strpos($this->webserviceUrl,'?')===false?'?':'&')
. 'ua=' . urlencode($this->userAgent)
. '&search=' . implode('|',$capabilities);

Adding this would likely effect the functionality of the other remote clients, but I didn't check.

[kamermans]

According to PHP.net's documentation on urldecode():

The superglobals $_GET and $_REQUEST are already decoded. Using urldecode() on an element in $_GET or $_REQUEST could have unexpected and dangerous results.

That having been said, if you still need to urldecode() it, it is probably being urlencode()ed / escaped twice. What client are you using (i.e. PHP, Javascript, Python, Perl)?

[kamermans]

Sorry, I just realized that you are using the PHP Remote Client. I am looking at the code now.

[kamermans]

It looks like the problem is with LibXML. According to the documentation for simplexml_load_file:

Libxml 2 unescapes the URI, so if you want to pass e.g. b&c as the URI parameter a, you have to call simplexml_load_file(rawurlencode('http://example.com/?a=' . urlencode('b&c'))). Since PHP 5.1.0 you don't need to do this because PHP will do it for you.

This will lead to different behaviour between versions of PHP.

I am using PHP 5.3 on my development machine, are you using PHP < 5.1.0?

I believe the problem can be fixed on line 108 of TeraWurflRemoteClient.php. According to the documentation, the following would be the correct way to encode the URL:

Code: Select all

$this->xml = simplexml_load_file($uri);


to this:

Code: Select all

$uri = version_compare(PHP_VERSION, '5.1.0', '<')? rawurlencode($uri): $uri;
$this->xml = simplexml_load_file($uri);


But it seems like this would only encode it one more time which doesn't seem like it would help! I will look into this and test different options once I get back to my computer.

[kamermans]

On the remote client side, how are you getting the User Agent, by passing a user agent to the getDeviceCapabilitiesFromAgent(), or are you letting the remote client determine the best User Agent by not passing anything to that function (highly recommended)?

If you are passing the UA into that function, are you sure it's not already urlencoded somehow? Can you put the following code after line 65 before "callTeraWurfl()" so we can see what the user agent looks like before it finds it's way to the server side (both with and without the urlencode)?

Code: Select all

die(htmlspecialchars($uri));