Server: Duplicate slashes are removed from path parameters.

[Treora]

When processing the requested path, Nextcloud cleans up subsequent slashes paths, such that e.g. /apps//test will become /apps/test. While usually not an issue, it becomes problematic when you want to keep those double slashes, most commonly when expecting a url as a parameter in apps for redirection, proxying, or archiving.

Reproduce

For example, an app could try to use the following URL syntax:

/apps/redirectme/to/https://example.org

And therefore define a route like this:

[
  'name' => 'page#redirect',
  'url' => '/to/{target}',
  'requirements' => array('target' => '.+')
]

Expected behaviour

Parameter $target will be https://example.org.

Actual behaviour

Parameter $target is https:/example.org (note the single slash).

Even when using a function such as IRequest->getRawPathInfo(), you will obtain the 'cleaned'/corrupted value.

Cause

This one line seems to be the culprit:

$requestUri = preg_replace('%/{2,}%', '/', $requestUri);

Workaround

You can work around this by reading the parameter manually; somewhat hacky, but something like this seems to work: (cleaner solutions welcome!)

$path = $_SERVER['REQUEST_URI'];
$routePath = 'apps/redirectme/to/'; // (presumably nobody has this string in their web root)
$target = substr($path, strpos($path, $routePath) + strlen($routePath));

Prior discussion

This issue has been traced by and discussed with @nickvergessen and @LukasReschke. The thought thus far was that there was no particularly strong reason for the implemented behaviour, but that changing this behaviour might be problematic due to existing apps that may rely on it.

Reporting the issue nevertheless to have it documented, and perhaps the thoughts on this may change, or it may be worth providing an extra method somewhere to get the parameters without the slash-cleaning step.

[nextcloud-bot]

GitMate.io thinks possibly related issues are https://github.com/nextcloud/server/pull/10958 (remove LogicException, because it's also triggered with legitimate parameters), https://github.com/nextcloud/server/issues/2536 (file_exists() expects parameter 1 to be a valid path), https://github.com/nextcloud/server/issues/55 (Remove some branches), https://github.com/nextcloud/server/issues/6491 (Duplicate Shared folders), and https://github.com/nextcloud/server/pull/10079 (fix double slash in search result path when the result is in a submount).

[patschi]

Just my two cents on this: Shouldn't be URL-like parameters in the actual URL encoded by using urlencode anyway? For example W3C recommends that slashes always represent a "hierachical structure", which external parameters like external URLs don't do - to be exact.

Sure, it doesn't fix the actual issue here, but probably the app which is using this kind of URLs should do the encoding first?

[rullzer]

Yes. Why not do something like /apps/redirectme?to=https://example.org

Then encode the url still ofcourse :wink: