Merge pull request ipfs/kubo#2435 from noffle/use-net-url-escaping

use net/url to escape paths in web-ui

This commit was moved from ipfs/kubo@c3204a6

gateway/core/corehttp/gateway_indexPage.go

@@ -2,6 +2,7 @@ package corehttp
 
 import (
 	"html/template"
+	"net/url"
 	"path"
 	"strings"
 
@@ -45,6 +46,12 @@ func init() {
 		return "ipfs-" + ext[1:] // slice of the first dot
 	}
 
+	// custom template-escaping function to escape a full path, including '#' and '?'
+	urlEscape := func(rawUrl string) string {
+		pathUrl := url.URL{Path: rawUrl}
+		return pathUrl.String()
+	}
+
 	// Directory listing template
 	dirIndexBytes, err := assets.Asset(assetPath + "dir-index.html")
 	if err != nil {
@@ -53,5 +60,6 @@ func init() {
 
 	listingTemplate = template.Must(template.New("dir").Funcs(template.FuncMap{
 		"iconFromExt": iconFromExt,
+		"urlEscape":   urlEscape,
 	}).Parse(string(dirIndexBytes)))
 }

gateway/core/corehttp/gateway_test.go

@@ -261,7 +261,7 @@ func TestIPNSHostnameBacklinks(t *testing.T) {
 		t.Fatal(err)
 	}
 	dagn2.AddNodeLink("bar", dagn3)
-	dagn1.AddNodeLink("foo", dagn2)
+	dagn1.AddNodeLink("foo? #<'", dagn2)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -279,7 +279,7 @@ func TestIPNSHostnameBacklinks(t *testing.T) {
 	ns["/ipns/example.net"] = path.FromString("/ipfs/" + k.String())
 
 	// make request to directory listing
-	req, err := http.NewRequest("GET", ts.URL+"/foo/", nil)
+	req, err := http.NewRequest("GET", ts.URL+"/foo%3F%20%23%3C%27/", nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -298,13 +298,13 @@ func TestIPNSHostnameBacklinks(t *testing.T) {
 	s := string(body)
 	t.Logf("body: %s\n", string(body))
 
-	if !strings.Contains(s, "Index of /foo/") {
+	if !strings.Contains(s, "Index of /foo? #&lt;&#39;/") {
 		t.Fatalf("expected a path in directory listing")
 	}
 	if !strings.Contains(s, "<a href=\"/\">") {
 		t.Fatalf("expected backlink in directory listing")
 	}
-	if !strings.Contains(s, "<a href=\"/foo/file.txt\">") {
+	if !strings.Contains(s, "<a href=\"/foo%3F%20%23%3C%27/file.txt\">") {
 		t.Fatalf("expected file in directory listing")
 	}
 
@@ -339,7 +339,7 @@ func TestIPNSHostnameBacklinks(t *testing.T) {
 	}
 
 	// make request to directory listing
-	req, err = http.NewRequest("GET", ts.URL+"/foo/bar/", nil)
+	req, err = http.NewRequest("GET", ts.URL+"/foo%3F%20%23%3C%27/bar/", nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -358,13 +358,13 @@ func TestIPNSHostnameBacklinks(t *testing.T) {
 	s = string(body)
 	t.Logf("body: %s\n", string(body))
 
-	if !strings.Contains(s, "Index of /foo/bar/") {
+	if !strings.Contains(s, "Index of /foo? #&lt;&#39;/bar/") {
 		t.Fatalf("expected a path in directory listing")
 	}
-	if !strings.Contains(s, "<a href=\"/foo/\">") {
+	if !strings.Contains(s, "<a href=\"/foo%3F%20%23%3C%27/\">") {
 		t.Fatalf("expected backlink in directory listing")
 	}
-	if !strings.Contains(s, "<a href=\"/foo/bar/file.txt\">") {
+	if !strings.Contains(s, "<a href=\"/foo%3F%20%23%3C%27/bar/file.txt\">") {
 		t.Fatalf("expected file in directory listing")
 	}