4

I have a simple problem: users can post urls through specific input in a form in my website. I would like to encode the posted url, because sometimes users send urls with strange and/or non ascii characters (like é à ç...). For instance: https://www.example.com/url-déjà-vu

So I tried to use URI.escape('https://www.example.com/url-déjà-vu') which does work, but then if you have the following url: URI.escape('https://somesite.com/page?stuff=stuff&%20') you get: => "https://somesite.com/page?stuff=stuff&%2520"

The % character is encoded and should not be as %20 is already an encoded character. Then I thought I could do this:

URI.escape(URI.decode('https://somesite.com/page?stuff=stuff&%20'))
=> "https://somesite.com/page?stuff=stuff&%20"

But there is a problem if you have a "/" encoded in your url, for instance:

URI.escape(URI.decode('http://example.com/a%2fb'))
=> "http://example.com/a/b"

The "/" should stay encoded.

So... putting it all together: I want to encode urls posted by users but leaving already encoded characters unchanged in ruby. Any idea how I may do that without getting an headache?

Thanks :)

7
  • Woah! You are letting your users post urls through a form? What's that for? Simple curiosity Commented Jun 2, 2016 at 12:55
  • I don't see why you are surprised, let's say it is the exact same thing as when you edit your profile in stack overflow and go to "Web presence". You have 3 fields there where you can add absolute url to your website, twitter profile or github profile. For instance, here is a random linked in profile url which contains an accented character and that actually works and should properly be encoded: fr.linkedin.com/in/aurélien-benjamin-a4196b27.
    – Kulgar
    Commented Jun 2, 2016 at 13:03
  • @RubenBarbosa This is a form where you can edit your StackOverflow profile. You can post a URL under the field titled "Website link". What is surprising about posting a URL? stackoverflow.com/users/edit/5030878
    – Hoa
    Commented Jun 2, 2016 at 13:05
  • I understand it as something else ,really. In this case , he could validate the input to not let them write any other characters than the ones he wants right? Commented Jun 2, 2016 at 13:06
  • Plus this is really a common use case. There are lot and lot of websites where you can post the absolute url of your own website...
    – Kulgar
    Commented Jun 2, 2016 at 13:06

1 Answer 1

6

I can't think of a way to do this that isn't a little bit of a kludge. So I propose a little bit of a kludge.

URI.escape appears to work the way you want in all cases except when characters are already encoded. With that in mind we can take the result of URI.encode and use String#gsub to "un-encode" only those characters.

The below regular expression looks for %25 (an encoded %) followed by two hex digits, turning e.g. %252f back into %2f:

require "uri"

DOUBLE_ESCAPED_EXPR = /%25([0-9a-f]{2})/i

def escape_uri(uri)
  URI.encode(uri).gsub(DOUBLE_ESCAPED_EXPR, '%\1')
end

puts escape_uri("https://www.example.com/url-déjà-vu")
# => https://www.example.com/url-d%C3%A9j%C3%A0-vu

puts escape_uri("https://somesite.com/page?stuff=stuff&%20")
# => https://somesite.com/page?stuff=stuff&%20

puts escape_uri("http://example.com/a%2fb")
# => http://example.com/a%2fb

I don't promise that this is foolproof, but hopefully it helps.

2
  • That is actually a clever solution. I'll see with other members of my fellow developers if they could think of any drawbacks... personnally, I don't :) Thanks a lot!
    – Kulgar
    Commented Jun 2, 2016 at 20:47
  • 1
    Ok, I accepted the answer as it seems to do what I want :) But as you said we can't know if it will be always foolproof. So one should be careful using this solution and have good tests to prevent it from adding unexpected bugs.
    – Kulgar
    Commented Jun 3, 2016 at 8:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.