urlencoding issue with file upload

[LoicGRENON]

I'm developping a sort of plugin to upload gcodes files directly to DWC after slicing and I noticed DWC is replacing some special characters by a space instead of just escaping them.
For example, a filename Raspberry_Pi_B+_Sleeve.gcode would become Raspberry_Pi_B _Sleeve.gcode
Even if I ulrencoding the filename, the "+" gets replaced by a space char.

So while trying to deal with that, I noticed if I double urlencode, the filename stays Raspberry_Pi_B+_Sleeve.gcode (which is fine because it's a valid filename).
So it means I can get rid of the escaping done on DWC => Maybe it could be a security issue ?

BTW, the file is listed at Jobs but I can't remove it (which is a bit hilarious). It says the file is not found.
The only way to remove the file is from the shell using SSH.
I can also start printing but it fails to read the file info.

I'm trying to find what cause this behavior in your code but for now I just found some encodeURIComponent() but still not found which function is escaping the filenames.

[chrishamm]

I suspect DuetWebServer tries decode a URI component twice, which is why the + sign is replaced with a space. The code in DuetWebControl looks correct though; encodeURIComponent does everything right AFAICT.

I'll have a look at it.

Edit: It's definitely something in DWS/Kestrel but I haven't tracked it down yet. DWC sends the correct request, e.g. when I upload foo+bar.g. DWC starts the query http://192.168.1.150/machine/file/0%3A%2Fsys%2Ffoo%2Bbar.g which is correct.

[LoicGRENON]

Just some update on this matter.
This link might be useful to understand what is going on: http://www.denalimultimedia.com/2005/07/base-64-querystring-error/

Removing UrlDecode at line 183 of UploadFile MachineController Task seems to be a solution.

Unfortunately, I never used .NET code and I don't really have an idea for now about how to build the app from sources to try to solve this bug and to do some tests on my own ...

[chrishamm]

Thanks for pointing it out, I'll have a look again at this in v3.4-b6!

[chrishamm]

This proposed fix does not work. In fact I get file paths like 0:%2Fsys%2Fdwc2-defaults.json in filename so it isn't viable. I'll check if I can use another URI decoder function to fix the current limitation.

[chrishamm]

It's still a limitation from ASP.NET so nothing I can easily solve. Firefox sends this when trying to upload file foo+bar:

http://ender3pro/machine/file/0%3A%2Fsys%2Ffoo%2Bbar

whereas filename as passed to that method becomes

http://ender3pro/machine/file/0:%2Fsys%2Ffoo+bar

That is then decoded. Since + is a valid replacement for a space character, it is replaced with a space leading to the original problem.