taigrr/go-selfupdate
1
0
Fork 0
mirror of https://github.com/taigrr/go-selfupdate synced 2025-01-18 04:33:12 -08:00
Code Issues Projects Releases Wiki Activity

Add query escaping to the URLs built for updates

Browse Source 
In semver, a + is a valid character, but in a URL that means 'space'.

The URL's path should have all of its components properly URL escaped to
resolve this issue.
This commit is contained in:
Robert Roland 2016-09-15 12:18:13 -07:00
parent 83c3c7d653
commit ed3d1b7d65
2 changed files with 32 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
selfupdate/selfupdate.go
View File

@ -36,6 +36,7 @@ import (
"io/ioutil" "io/ioutil"
"log" "log"
"math/rand" "math/rand"
"net/url"
"os" "os"
"path/filepath" "path/filepath"
"runtime" "runtime"
@ -179,7 +180,7 @@ func (u *Updater) update() error {
} }
func (u *Updater) fetchInfo() error { func (u *Updater) fetchInfo() error {
r, err := u.fetch(u.ApiURL + u.CmdName + "/" + plat + ".json") r, err := u.fetch(u.ApiURL + url.QueryEscape(u.CmdName) + "/" + url.QueryEscape(plat) + ".json")
if err != nil { if err != nil {
return err return err
} }
@ -206,7 +207,7 @@ func (u *Updater) fetchAndVerifyPatch(old io.Reader) ([]byte, error) {
} }
func (u *Updater) fetchAndApplyPatch(old io.Reader) ([]byte, error) { func (u *Updater) fetchAndApplyPatch(old io.Reader) ([]byte, error) {
r, err := u.fetch(u.DiffURL + u.CmdName + "/" + u.CurrentVersion + "/" + u.Info.Version + "/" + plat) r, err := u.fetch(u.DiffURL + url.QueryEscape(u.CmdName) + "/" + url.QueryEscape(u.CurrentVersion) + "/" + url.QueryEscape(u.Info.Version) + "/" + url.QueryEscape(plat))
if err != nil { if err != nil {
return nil, err return nil, err
} }
@ -229,7 +230,7 @@ func (u *Updater) fetchAndVerifyFullBin() ([]byte, error) {
} }
func (u *Updater) fetchBin() ([]byte, error) { func (u *Updater) fetchBin() ([]byte, error) {
r, err := u.fetch(u.BinURL + u.CmdName + "/" + u.Info.Version + "/" + plat + ".gz") r, err := u.fetch(u.BinURL + url.QueryEscape(u.CmdName) + "/" + url.QueryEscape(u.Info.Version) + "/" + url.QueryEscape(plat) + ".gz")
if err != nil { if err != nil {
return nil, err return nil, err
} }

31
selfupdate/selfupdate_test.go
View File

@ -24,10 +24,9 @@ func TestUpdaterFetchMustReturnNonNilReaderCloser(t *testing.T) {
t.Log("Expected an error") t.Log("Expected an error")
t.Fail() t.Fail()
} }
} }
func TestUpdaterWithEmptyPaloadNoErrorNoUpdate(t *testing.T) { func TestUpdaterWithEmptyPayloadNoErrorNoUpdate(t *testing.T) {
mr := &mockRequester{} mr := &mockRequester{}
mr.handleRequest( mr.handleRequest(
func(url string) (io.ReadCloser, error) { func(url string) (io.ReadCloser, error) {
@ -38,9 +37,23 @@ func TestUpdaterWithEmptyPaloadNoErrorNoUpdate(t *testing.T) {
err := updater.BackgroundRun() err := updater.BackgroundRun()
if err != nil { if err != nil {
t.Errorf("Error occured: %#v", err) t.Errorf("Error occurred: %#v", err)
} }
}
func TestUpdaterWithEmptyPayloadNoErrorNoUpdateEscapedPath(t *testing.T) {
mr := &mockRequester{}
mr.handleRequest(
func(url string) (io.ReadCloser, error) {
equals(t, "http://updates.yourdomain.com/myapp%2Bfoo/darwin-amd64.json", url)
return newTestReaderCloser("{}"), nil
})
updater := createUpdaterWithEscapedCharacters(mr)
err := updater.BackgroundRun()
if err != nil {
t.Errorf("Error occurred: %#v", err)
}
} }
func createUpdater(mr *mockRequester) *Updater { func createUpdater(mr *mockRequester) *Updater {
@ -55,6 +68,18 @@ func createUpdater(mr *mockRequester) *Updater {
} }
} }
func createUpdaterWithEscapedCharacters(mr *mockRequester) *Updater {
return &Updater{
CurrentVersion: "1.2+foobar",
ApiURL: "http://updates.yourdomain.com/",
BinURL: "http://updates.yourdownmain.com/",
DiffURL: "http://updates.yourdomain.com/",
Dir: "update/",
CmdName: "myapp+foo", // app name
Requester: mr,
}
}
func equals(t *testing.T, expected, actual interface{}) { func equals(t *testing.T, expected, actual interface{}) {
if expected != actual { if expected != actual {
t.Log(fmt.Sprintf("Expected: %#v %#v\n", expected, actual)) t.Log(fmt.Sprintf("Expected: %#v %#v\n", expected, actual))