fix(router): strip null characters from serialized URLs#68175
fix(router): strip null characters from serialized URLs#68175arturovt wants to merge 1 commit intoangular:mainfrom
Conversation
Null characters (\u0000) in route path params, matrix params, or query params were encoded to `%00` by `encodeURIComponent`. Browsers reject URLs containing `%00` with a SecurityError when passed to `history.pushState`/`replaceState`, causing an unhandled promise rejection and crashing navigation. The fix strips `%00` from the output of `encodeUriString`, which is the shared base used by `encodeUriSegment` and `encodeUriQuery`, covering path segments, matrix params, and query params in a single change. Closes angular#47264
|
Woah, looks like you've opened a lot of issues/PRs recently. While we appreciate contributions from the community, triaging and reviewing a large influx of content in a short time period takes time away from other ongoing projects. As a result, we're closing these issues/PRs to maintain the team's focus. Note that this is not necessarily a rejection of the goals or direction of any of these contributions in particular, so much as a reflection of the team's current capacity and priorities. You are welcome to open a smaller subset of issues/PRs in accordance with our policy focused on the most important and impactful contributions and we will do our best to prioritize a response as soon as possible. |
atscott
left a comment
There was a problem hiding this comment.
Don’t this break null characters used with hash location strategy or a strategy that falls back to location.assign it push or replace fails?
|
From the report, this would change the navigation from a failure to go to the user page to a successful navigation to the home page, which in my opinion is wrong |
|
@atscott nice catch. Right now the fix strips It probably makes more sense to move the On the behavior change — yeah, this turns what used to be a hard failure into a silent success with a slightly corrupted URL. But compared to navigation completely breaking due to an unhandled Curious what direction you think makes the most sense here. |
|
Does it not already convert to |
Null characters (\u0000) in route path params, matrix params, or query params were encoded to
%00byencodeURIComponent. Browsers reject URLs containing%00with a SecurityError when passed tohistory.pushState/replaceState, causing an unhandled promise rejection and crashing navigation.The fix strips
%00from the output ofencodeUriString, which is the shared base used byencodeUriSegmentandencodeUriQuery, covering path segments, matrix params, and query params in a single change.Closes #47264
Google Internal ref: b/239974353