UrlGenerator improperly escapes a colon in the path

Created on 14 August 2020, about 4 years ago
Updated 9 March 2023, over 1 year ago

Problem/Motivation

It is completely fine to use a colon : in a URL path.

However, if you create a route in Drupal to something like /wiki/Template:Welcome Drupal will improperly escape the URL.

Steps to reproduce

  1. Create a new route to something like /wiki/Template:Welcome
  2. Generate a URL to that route

Proposed resolution

Ensure that the : character is not escaped from the path.

Remaining tasks

  1. Write Patch

User interface changes

None.

API changes

Colons in paths will no longer be escapaed when generated.

Data model changes

None.

Release notes snippet

N/A

πŸ› Bug report
Status

Needs work

Version

10.1 ✨

Component
RoutingΒ  β†’

Last updated 8 days ago

Created by

πŸ‡ΊπŸ‡ΈUnited States davidwbarratt

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

  • πŸ‡¬πŸ‡§United Kingdom catch
    +++ b/core/lib/Drupal/Core/Routing/UrlGenerator.php
    @@ -303,7 +301,14 @@ public function generateFromRoute($name, $parameters = [], $options = [], $colle
         // The contexts base URL is already encoded
         // (see Symfony\Component\HttpFoundation\Request).
    -    $path = str_replace($this->decodedChars[0], $this->decodedChars[1], rawurlencode($path));
    +    // %3A is invalid for Private folder type so unsetting it.
    +    // %3A is invalid for Private folder type so unsetting it.
    +    if ($name == 'system.private_file_download') {
    +      $path = strtr(rawurlencode($path), array_diff($this->decodedChars, [':']));
    +    }
    +    else {
    +      $path = strtr(rawurlencode($path), $this->decodedChars);
    +    }
     
    

    We shouldn't need to special-case the private files route here. Having said that I don't have an idea of how to do that generically. Is it really a problem with private file downloads or is it just that this happens to be the URL used in the test?

Production build 0.71.5 2024