Comment by userbinator | Hacker News Reader

Comment by userbinator | Hacker News Reader

Parent Full thread

You know you've been working with ASCII for a long time when you can automatically unescape the title... and then pause, considering whether to unescape again.

I think reading the comments on that bug is also rather enlightening; points of note include a 62-level-deep stack trace, comments to the effect of "we don't know what the bug is/how this is supposed to work", and discussions about whether escaping multiple times is the solution (absolutely not!)

https://tools.ietf.org/html/rfc3986#section-2.4

Implementations must not percent-encode or decode the same string more than once, as decoding an already decoded string might lead to misinterpreting a percent data octet as the beginning of a percent-encoding, or vice versa in the case of percent-encoding an already percent-encoded string.

Seriously, I'm quite surprised that basic URL handling is still a problem. Making a game to bring this to the attention of a wider audience is certainly a good idea.

Reading the bug report: https://code.google.com/p/chromium/issues/detail?id=533361 makes me sad. Recursing is definitely not the answer, yet it gets brought up a lot.

Also, %00 shouldn't cause the browser to crash, and the fixes suggested so far are just work-arounds :/

> Recursing is definitely not the answer, yet it gets brought up a lot.

Speaking as someone with an apostrophe in his name, I'm not sure whether this makes me want to chuckle and reach for the popcorn, or bang my head against the desk. The answer to multiple (un-)escaping bugs is never recursion.

> Seriously, I'm quite surprised that basic URL handling is still a problem. Making a game to bring this to the attention of a wider audience is certainly a good idea.

I think the problem is that a spec exists, but existing browser incorrectly implemented it (hello Netscape), and given their prevalence browsers are stuck with weird hacks so that existing websites continue to work.

In particular around percent escapes there's lots of trouble. Nothing really specs the encoding to be used for those percent escapes (the RFC only has some odd notes on encodings), and there's a whole bunch of odd behaviours, e.g. how characters are handled when pasting a URL into an address bar vs having it as an href on a web page.

It's surprising that this issue was brought up multiple times as a bug, but wasn't taken seriously until it got special attention. This bug is definitely notorious, I wonder setting a similar URL as the homepage of Chrome will cause Chrome to continuously crash and make it useless.

The crash was definitely not there in the beginning, since I happened to have Chromium 22 (from 2012 - when I first tried it), and although it doesn't crash with %%30%30, it also refuses to visit such a URL. Someone with suitable tools should be able to do some bisection to narrow down exactly when it was introduced.

Reply on news.ycombinator.com