Disallowed URI chars used in my token - codeigniter

Take a look at this url:
http://localhost/foo/reset_password/bar#foobar.com/74ffb86822ca0a75e378e1eaa3a4a000fbf5eb1f6bc98d2ec789c59b2cc9cfc7e27e7489bfe59cfff04220c3e29f3869b8abc6f0a65ef170b9b9148d3619b2f9
This is the config:
$config['permitted_uri_chars'] = 'a-z 0-9~%.:_\-';
The url gives me this error -> The URI you submitted has disallowed characters.
The longest ugly string in the url is timestamp + salt sha512 encoded, but I don't see any disallowed chars in there, any idea what's wrong? Thanks!

There's nothing wrong with your sha hash... the problem is with the at "#" symbol. You cannot have an "#" symbol within the path portion of your URL.
You can escape it to %40
http://localhost/foo/reset_password/bar%40foobar.com/74ffb86822ca0a75e378e1eaa3a4a000fbf5eb1f6bc98d2ec789c59b2cc9cfc7e27e7489bfe59cfff04220c3e29f3869b8abc6f0a65ef170b9b9148d3619b2f9
should work... just unescape the email address on your end

bar#foobar.com, specifically the #, in the URL is the reason for the error.

Related

Disallowed Key Characters CodeIgniter Error

I'm having this error "Disallowed Key Characters." I have try to resolve this, by debugging input.php file. I have this output as
Disallowed Key Characters.2548_don't
can anyone tell me, how to escape single quote
Thanks
Try This
Go to application -> config -> config.php
And try to find
$config['permitted_uri_chars']
change it to
$config['permitted_uri_chars'] = '\#';
this # will allow all the characters.
if ( ! preg_match("/^[a-z0-9':_\/-]+$/i", $str))
{
exit('Disallowed Key Characters.'.$str);
}
added single quote in preg match and it is working now
Thanks

URI with variable

I've got a file with uids on separate lines, and I'm trying to include them in a URI.
File.open("File Path").readlines.each do |line|
puts line
uid = line
uri = URI("http://example:port/path/variable=#{uid}&fragment")
res = Net::HTTP.get_response(uri)
puts res.body
But I get an error saying "bad URI(is not URI?)".
Could anyone help?
Thanks
Can you try a
uid = line.strip
The strip removes leading and trailing spaces and newlines.
With
p uid
or
puts uid.inspect
you may see the real content of the string.
It depends a lot on what are you actually feeding it, but I recommend trying these 2 things so you troubleshoot your code well.
Use puts "[#{uid}]" to see what does the line variable contain exactly. This will surely help you notice if it has a newline in it, for example. The right square bracket will be on the next line and you will know your input is malformed.
Try constructing the URL like this: uri = URI("http://example:port/path/variable=#{URI.encode(uid)}&fragment"). This will help you escape characters which are normally not allowed in an URI / URL.
Hope this helps.
do you means
uri = URI("http://example:port/path/?variable=#{uid}&fragment")

Escaping "#" sign

I am trying to use wget with a url that includes a "#" sign. No matter what I do to escape the character, it doesn't work. I've used \, ', and ". But none of them work. Does any one have any suggestions?
Thank you!
Send it as %23 if you really mean for it to have a hash. If you're trying to send a fragment, don't bother since the server won't care about it regardless.
maybe put uri around'' ? I believe it works
Are you quoting the url? It shouldn't be a problem if you are.
My guess is you're doing something like:
wget http://foo.com/#!/blah
Instead of:
wget "http://foo.com/#!/blah"
# is the shell script comment character.

Ruby Typhoeus Request: url with quotes

I'm having a problem doing a request using Typhoeus as my query needs to have quotation marks into it.
If the URl is
url = "http://app.com/method.json?'my_query'"
everything works fine. However, the method I'm trying to run only returns the results I want if the query is the following (i've tested it in browser):
url2 = "http://app.com/method.json?"my_query""
When running
Typhoeus::Request.get(url2)
I get (URI::InvalidURIError)
Escaping quotes with "\" does not work. How can I do this?
Thanks
You should be properly encoding your URI with URI.encode or CGI.escape, doing so will get you proper URLs like this:
http://app.com/method.json?%27my_query%27 # Single quotes
http://app.com/method.json?%22my_query%22 # Double quotes
Try:
require 'uri'
URI.encode('"foo"')
=> "%22foo%22"
Passing json, quotes etc in GET request is tricky. In Ruby 2+ we can use Ruby's URI module's 'escape' method.
> URI.escape('http://app.com/method.json?agent={"account":
{"homePage":"http://demo.my.com","name":"Senior Leadership"}}')
But I suggest use it as POST request and pass it as a message body.

How can I match a URL but exclude terminators from the match?

I want to match urls in text and replace them with anchor tags, but I want to exclude some terminators just like how Twitter matches urls in tweets.
So far I've got this, but it's obviously not working too well.
(http[s]?\:\/\/[a-zA-Z0-9\-\.]+\.[a-zA-Z]{2,3}(\/\S*)?)
EDIT: Some example urls. In all cases below I only want to match "http://www.example.com"
http://www.example.com.
http://www.example.com:
"http://www.example.com"
http://www.example.com;
http://www.example.com!
[http://www.example.com]
{http://www.example.com}
http://www.example.com*
I looked into this very issue last year and developed a solution that you may want to look at - See: URL Linkification (HTTP/FTP) This link is a test page for the Javascript solution with many examples of difficult-to-linkify URLs.
My regex solution, written for both PHP and Javascript - (but could easily be translated to Ruby) is not simple (but neither is the problem as it turns out.) For more information I would recommend also reading:
The Problem With URLs by Jeff Atwood, and
An Improved Liberal, Accurate Regex Pattern for Matching URLs by John Gruber
The comments following Jeff's blog post are a must read if you want to do this right...
Ruby's URI module has a extract method that is used to parse out URLs from text. Parsing the returned values lets you piggyback on the heuristics in the module to extract the scheme and host information from a URL, avoiding reinventing the wheel.
text = '
http://www.example.com.
http://www.example.com:
"http://www.example.com"
http://www.example.com;
http://www.example.com!
[http://www.example.com]
{http://www.example.com}
http://www.example.com*
http://www.example.com/foo/bar?q=foobar
http://www.example.com:81
'
require 'uri'
puts URI::extract(text).map{ |u| uri = URI.parse(u); "#{ uri.scheme }://#{ uri.host[/(^.+?)\.?$/, 1] }" }
# >> http://www.example.com
# >> http://www.example.com
# >> http://www.example.com
# >> http://www.example.com
# >> http://www.example.com
# >> http://www.example.com
# >> http://www.example.com
# >> http://www.example.com
# >> http://www.example.com
# >> http://www.example.com
The only gotcha, is that a period '.' is a legitimate character in a host name, so URI#host won't strip it. Those get caught in the map statement where the URL is rebuilt. Note that URI is stripping off the path and query information.
A pragmatic and easy understandable solution is:
regex = %r!"(https?://[-.\w]+\.\w{2,6})"!
Some notes:
With %r we can choose the start and end delimiter. In this case I used exclamation mark, since I want to use slash unescaped in the regex.
The optional quantifier (i.e. '?') binds only to the preceding expression, in this case 's'. There's no need to put the 's' in a character class [s]?. It's the same as s?.
Inside the character class [-.\w] we don't need to escape dash and dot in order to make them match dot and dash literally. Dash should be first, however, to not mean range.
\w matches [A-Za-z0-9_] in Ruby. It's not exactly the full definition of URL characters, but combined with dash and dot it may be enough for our needs.
Top domains are between 2 and 6 characters long, e.g. '.se' and '.travel'
I'm not sure what you mean by I want to exclude some terminators but this regex matches only the wanted one in your example.
We want to use the first capture group, e.g. like this:
if input =~ %r!"(https?://[-.\w]+.\w{2,6})"!
match = $~[1]
else
match = ""
end
What about this?
%r|https?://[-\w.]*\w|

Resources