1

My gitweb installation works so far, but all generated links that include a querystring, e.g. 

host/gitweb?p=somepath&a=summary

are somehow malformed. First, the ampersand is replaced by a semicolon. When inspecting the html, the link looks like

host/gitweb?p=somepath;a=summary

When klicking the link, the browser escapes the ';' to '%3b', so the url sent to the server looks like

host/gitweb?p=somepath%3ba=summary

The gitweb.cgi does not parse this and displays a 404 error page. When I replace the '%3b' with a ';' or a '&', everything works fine.

How can this be fixed on the server-side?

So far, I have tried to find the line producing the ';' in the urls, which is line 1457

$href .= "?" . join(';', @result) if scalar @result;

replacing the ';' by '&' gives me a malformed xhtml in the browser. Replacing it by '&' forces the browser again to escape the ';' which produces broken urls again.

The issue is kind of hidden (I can view the repositories), if I set the option 

$feature{'pathinfo'}{'default'} = [1];

in the gitweb.conf file, but unfortunately, folders containing multiple repositories cannot be displayed, since the respective link uses some query-parameters.

quantenquatsch
  • 11
  • 2
  • Re "*the browser escapes the ';' to '%3b'*", No way. That would not be legal. – ikegami Aug 29 '16 at 16:40
  • Re "*replacing the ';' by '&' gives me a malformed xhtml in the browser.*", You have an XHTML injection error. You forgot to escape text (the URL) you embedded in the XHTML. `&` needs to be replaced with `&` – ikegami Aug 29 '16 at 16:49
  • Replacing the ';' by '&' does not work either, since again the ';' is being escaped when I click on the link. – quantenquatsch Aug 30 '16 at 07:24
  • Is there a way to tell perl to replace the %3b with an ';' before parsing the query-string? – quantenquatsch Aug 30 '16 at 07:26
  • Again, that's not true. if you replaced `;` with `&` and then encoded it to `&` when you placed it in the XHTML, there is no `;` in the link. – ikegami Aug 30 '16 at 16:14
  • That would be bad. That would corrupt your data. – ikegami Aug 30 '16 at 16:15
  • Maybe I am misunderstood here. I know the behavior is not right, but I did not cause it. The XHTML is generated by gitweb.cgi and seems to be valid in the DOM. But when I klick on the link, the Browser (Firefox, Edge) does this weird escaping. So there must be something in the webpage causing this. However, I did not find anything. – quantenquatsch Aug 30 '16 at 16:41
  • No, they don't. That would break half the web. See for yourself [`http://www.adaelis.com/misc/show_url?foo=1;bar=1`](http://www.adaelis.com/misc/show_url?foo=1;bar=1). Your diagnosis of the problem is incorrect. – ikegami Aug 30 '16 at 17:10
  • See for yourself here: https://eats3.et.tu-dresden.de/gitweb-public/gitweb.cgi/projects/js-boilerplate/code-assembly.git Just klick on the link at the top of the page that says 'js-boilerplate'. The Problem is not that the browser does not send the request that is entered to the location bar, the problem is that something happens on the page when the link is being klicked. If you mean that it is incorrect, how would you explain the behaviour? – quantenquatsch Aug 31 '16 at 07:27
  • It's not the browser. The browser correctly requests `http://eats3.et.tu-dresden.de/gitweb-public/gitweb.cgi?a=project_list;pf=projects/js-boilerplate`. But when you request that, the server redirects you (using a 302 response) to `https://eats3.et.tu-dresden.de/gitweb-public/gitweb.cgi?a=project_list%3bpf=projects/js-boilerplate`. It means to switch you from HTTP to HTTPS, but corrupts the URL in the process. – ikegami Aug 31 '16 at 14:26
  • Layer 8 problem detected! Thank you very much, that was the error. – quantenquatsch Aug 31 '16 at 15:57

2 Answers2

0

You do not encoded or decoded the query string as a hole. The param name and value must be encoded and decoded individually and the delimiters of the query string i.e..

= ; &

never get URL encoded or decoded.

You can check the server environment variable $ENV{REQUEST_URI} to see if the server did receive the information encoded like you said. If the browser is sending it then that is the problem and there is nothing you can do in your Perl code to fix that. Because it will just cause more problems down the road in your Perl code.

Shaka Flex
  • 111
  • 7
  • I added the command 'die $ENV{'REQUEST_URI'}' to my gitweb.conf which got me the following line in the apache error log: '[Tue Aug 30 18:37:08.416866 2016] [cgi:error] [pid 32381] [client 141.30.155.71:54651] AH01215: [Tue Aug 30 18:37:08 2016] gitweb.cgi: FATAL: [Tue Aug 30 18:37:08 2016] gitweb.cgi: FATAL: /gitweb/gitweb.cgi?a=project_list%3bpf=projects/foo at /home/git/gitweb.conf line 61.' -- So it seems the browser sends the request as printed in the location bar. Maybe I can rewrite the request through Apache in order to replace '%3b' with ';' ... – quantenquatsch Aug 30 '16 at 16:35
0

I somehow solved the problem using a rewrite rule in apache:

RewriteEngine on
RewriteCond %{QUERY_STRING} ^a=project_list%3bpf=(.*)$
RewriteRule (.*) $1?a=project_list;pf=%1 [QSA]

It only works for the project list with a specified path with the pathinfo feature enabled. A holistic approach would be to search for all possible query parameters and to replace them all.

However, this solution is not satisfying, since it does not fix the actual problem of the weird url escaping of gitweb.

quantenquatsch
  • 11
  • 2
  • For what it's worth, I had this same issue, and fixed it by adding the NE flag to my existing RewriteRule directives in my Apache configuration. See also http://stackoverflow.com/questions/18323782/semi-colons-in-url-changes-to-3b-via-htaccess – ctrueden May 09 '17 at 15:38