fix(vulnerable-code): Fixup another case of wrong URL escaping

Signed-off-by: Sebastian Schuberth <sebastian@doubleopen.org>
oss-review-toolkit · Dec 15, 2023 · 96d87c0 · 96d87c0
1 parent e1803f0
commit 96d87c0
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 1 deletion.
diff --git a/plugins/advisors/vulnerable-code/src/main/kotlin/VulnerableCode.kt b/plugins/advisors/vulnerable-code/src/main/kotlin/VulnerableCode.kt
@@ -170,6 +170,6 @@ class VulnerableCode(name: String, config: VulnerableCodeConfiguration) : Advice
 private val BACKSLASH_ESCAPE_REGEX = Regex("\\\\\\\\(.)")
 
 internal fun String.fixupUrlEscaping(): String =
-    replace(BACKSLASH_ESCAPE_REGEX) {
+    replace("\\/", "/").replace(BACKSLASH_ESCAPE_REGEX) {
         it.groupValues[1].percentEncode()
     }
diff --git a/plugins/advisors/vulnerable-code/src/test/kotlin/VulnerableCodeTest.kt b/plugins/advisors/vulnerable-code/src/test/kotlin/VulnerableCodeTest.kt
@@ -289,6 +289,16 @@ class VulnerableCodeTest : WordSpec({
                     "%26_optimization:16.0.3:*:*:*:*:*:*:*"
             )
         }
+
+        "fixup a wrongly escaped slash" {
+            val brokenUrl = "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true" +
+                "&query=cpe:2.3:a:apple:swiftnio_http\\/2:*:*:*:*:*:swift:*:*"
+
+            URI.create(brokenUrl.fixupUrlEscaping()) shouldBe URI(
+                "https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&" +
+                    "query=cpe:2.3:a:apple:swiftnio_http/2:*:*:*:*:*:swift:*:*"
+            )
+        }
     }
 })