Escaping URL encoding for external links - coldfusion

In my application, I have an editor which allow users to compose formatted emails. Everything works except when they have some urls having special characters being used as hyperlinks. For example
this is a link. Click Here
As you can see the token contains characters which are utf-8 encoded elements like +,/ and + sign.
How I can avoid them getting decoded while rendering.
The rendered url becomes
http://www.somesiteurl.com?token=xO53C3hjLhMyL+DF42Dft8I8W/7dqTnPCHnqhgQyz6+cqzAMmv40mQa1BSqUa8Z4HM6E8tgrBxz1Yfiox188BJZQvmZgN18tb/INpP0XQydHCy27UQDp0u+vcZBYkQoDoQ72LxWU/WD3FM49vSV/8yciYjMpaWiVxlg2bX7TzYg=
Hence the link does not work correctly. I do not have any control how users create this url.

I think that you are confusing UTF-8 with URL encoding/decoding. It looks like you are doing a urldecode when you should just be passing through the URL unchanged. Take a look at the following snippet which plays around with your token just a bit:
<cfset token="xO53C3hjLhMyL%2BDF42Dft8I8W%2F7dqTnPCHnqhgQyz6%2BcqzAMmv40mQa1BSqUa8Z4HM6E8tgrBxz1Yfiox188BJZQvmZgN18tb%2FINpP0XQydHCy27UQDp0u%2BvcZBYkQoDoQ72LxWU%2FWD3FM49vSV%2F8yciYjMpaWiVxlg2bX7TzYg%3D">
<cfset tokendecoded=urldecode(token)>
<cfoutput>
token unchanged gives: token = #token#<br />
tokendecoded gives: token = #tokendecoded#<br />
</cfoutput>
For me, this gives the following output:
token unchanged gives: token = xO53C3hjLhMyL%2BDF42Dft8I8W%2F7dqTnPCHnqhgQyz6%2BcqzAMmv40mQa1BSqUa8Z4HM6E8tgrBxz1Yfiox188BJZQvmZgN18tb%2FINpP0XQydHCy27UQDp0u%2BvcZBYkQoDoQ72LxWU%2FWD3FM49vSV%2F8yciYjMpaWiVxlg2bX7TzYg%3D
tokendecoded gives: token = xO53C3hjLhMyL+DF42Dft8I8W/7dqTnPCHnqhgQyz6+cqzAMmv40mQa1BSqUa8Z4HM6E8tgrBxz1Yfiox188BJZQvmZgN18tb/INpP0XQydHCy27UQDp0u+vcZBYkQoDoQ72LxWU/WD3FM49vSV/8yciYjMpaWiVxlg2bX7TzYg=
So you may want to URL encode the token before you send it. Then decoding it would work fine. If you want to take the token as it is being passed, then don't decode it. Your choice.

Related

Django url having %20 issues

One of my urls in url.py goes like this is like this
path('<str:subject>/<str:agglevel>/<str:cust_cd>/',views.Customer.as_view())
cust_cd takes value from UI. cust_cd is basically customer name which is a string value.
Url works fine for single words for cust_cd. Ex:Google,Gmail etc. But when I give words with spaces like Ex:You tube I get 404 error. It says you%20tube not found. Am not able to figure out how to configure url so that it accepts space characters.
in your urls.py file
instead of
<str:cust_cd>
try this
<slug:cust_cd>
for more information check out this link: https://docs.djangoproject.com/en/3.0/topics/http/urls/#path-converters

How to use Regular Expression Extractor to get authenticity token with / = + signs?

I need to correctly parse authenticity token in JMeter which has +, / and spaces in it and looks like below…
<meta content="authenticity_token" name="csrf-param" />
<meta content="kJ+AzaV/saCxK+F4Ibh6LeEqH8rpiGZfyRKn3RGX960=" name="csrf-token" />
I have a “Regular Expression Extractor” and Regular Expression looks like..
meta content="([^"]+)" name="csrf-token" />
The problem is that the / gets replaced with %2F and = at the end gets replace with %3D and
kJ+AzaV%2FsaCxK+F4Ibh6LeEqH8rpiGZfyRKn3RGX960%3D
How can I parse the authenticity token correctly?
It looks like your attribute has been URI encoded, so you'll need to decode it before attempting to do more
window.decodeURIComponent('kJ+AzaV%2FsaCxK+F4Ibh6LeEqH8rpiGZfyRKn3RGX960%3D');
// "kJ+AzaV/saCxK+F4Ibh6LeEqH8rpiGZfyRKn3RGX960="
Further, using a RegExp to extract data from HTML or XML is not always the best idea, perhaps you could try parsing it and accessing the Nodes and Attributes you want via a DOM Tree.
If you're passing it as a parameter just untick "Encode?" box for it.
If you need to decode this via JavaScript as Paul S. suggests, consider using __javaScript function as follows:
${__javaScript(decodeURIComponent("${YOUR_VARIABLE_NAME_HERE}"),)}
See How to Use JMeter Functions post series for more details.

Check if a URL is still active or Permanently Moved

Is there a way to check if a URL still active or it returns a 301 Redirect code using chhttp?
You've answered your own question - use CFHTTP.
<cfhttp method="head" url="http://www.google.com" result="myResult">
<cfdump var="#myResult#">
You'll see that myResult struct contains "Responseheader" struct with "Status_Code" field in it. It will contain the numeric status code.
If you don't need numeric you can just use myResult.Statuscode - returns something like "200 OK".
If the url will be incorrect or there will be some issues with reaching the target, the "Responseheader" will be empty.
Addendum after the comment:
If you want to know the redirect location after 301 use CFHTTP with trace or options as method.
<cfhttp method="trace" url="http://www.google.com" result="myResult">
The result should contain the "Status_Code" as above as well as "Location" - the url to redirect to.
You have to use the redirect attribute (e.g. redirect="false") in cfhttp tag. Then you get the original response and can figure out what http code was sent back to your request.

This regex does not work in Chrome

Hi i just put up a validation function in jScript to validate filename in fileupload control[input type file]. The function seems to work fine in FF and sometimes in ie but never in Chrome. Basically the function tests if File name is atleast 1 char upto 25 characters long.Contains only valid characters,numbers [no spaces] and are of file types in the list. Could you throw some light on this
function validate(Uploadelem) {
var objRgx = new RegExp(/^[\w]{1,25}\.*\.(jpg|gif|png|jpeg|doc|docx|pdf|txt|rtf)$/);
objRgx.ignoreCase = true;
if (objRgx.test(Uploadelem.value)) {
document.getElementById('moreUploadsLink').style.display = 'block';
} else {
document.getElementById('moreUploadsLink').style.display = 'none';
}
}
EDIT:
Nope still does not seem to work , i am using IE 8(tried all the compatibility modes), Chrome v8.0, FF v 3.6.
Here is a html snippet in which i wired up the validate function,
<div>
<input type="file" name="attachment" id="attachment" onchange="validate(this)" />
<span class="none">Filename should be within (1-25) letters long. Can Contain only letters
& numbers</span>
<div id="moreUploads">
</div>
<div id="moreUploadsLink" style="display: none;">
Attach another File</div>
</div>
It works perfectly for me. How do you call the validate function ? – M42
You tried this on Google Chrome and IE 8 ? i added HTML Snippet in where in i used all of the recommended regX. No Clues as to why doesn't work!!
Mike, i am unable to comment your post here So this is for you.
The Validation Fails for which ever file i choose in the html input. I Also wired the validation in onblur event but proves same. The validate function will mimic the asp.net regular expression validator which displays validation error message when regular expression is not met.
Try simplifying your code.
function validate(Uploadelem) {
var objRgx = /^[\w]{1,25}\.+(jpg|gif|png|jpeg|doc|docx|pdf|txt|rtf)$/i;
if (objRgx.test(Uploadelem.value)) {
document.getElementById('moreUploadsLink').style.display = 'block';
} else {
document.getElementById('moreUploadsLink').style.display = 'none';
}
}
Your specification is hazy, but it appears that you want to allow dots within filenames (in addition to the dot that separates filename and extension).
In that case, try
var objRbx = /^[\w.]{1,25}\.(jpg|gif|png|jpeg|doc|docx|pdf|txt|rtf)$/i;
This allows filenames that consist only of the characters a-z, A-Z, 0-9, _ and ., followed by a required dot and one of the specified extensions.
As far as I know, Chrome adds a path in front of the filename entered, so you have just to change your regex from:
/^[\w]{1,25}\.*\.(jpg|gif|png|jpeg|doc|docx|pdf|txt|rtf)$/
to:
/\b[\w]{1,25}\.+(jpg|gif|png|jpeg|doc|docx|pdf|txt|rtf)$/
SOLVED
Primary reason that all [CORRECT regx pattern] did not work is Different browsers returned different values for HTML File Input control.
Firefox: Returns the File Upload controls FileName {As Expected}
Internet Explorer: Returns the Full Path to the File from Drive to File [Pain in the Ass]
Chrome: Returns a fake path as [C:\FakePath\Filename.extension]
I got a solution to the thing for chrome and FF but not IE.
Chrome and Firefox:
use FileUploadControlID.files[0].fileName or FileUploadControlID.files[0].name
IE
Again biggest pain in the ass [someone suggest a solution]
Valid Regex to Validate both fileName and Extension would be:
/\b([a-zA-Z0-9._/s]{3,50})(?=(\.((jpg)|(gif)|(jpeg)|(png))$))/i
1.File Nameshould be between 3 and 50 characters
2. Only jpg,gif,jpeg,png files are allowed

For HTML Emails, How to embed images so users don't get a download prompt

I'm working to create an HTML email which includes 2 images. Currently, I'm using tags to place the image in the email. Problem is when users get the email, it's asking the user to "click to download" for security reasons.
Is there a way to embed the image in the email, to avoid this issue?
I'm using Coldfusion to send the email.
Thanks
I haven't tested if this works in e-mail clients, but if you encode the image as Base64 you can include it in the HTML, which avoids the issue of connecting to a remote server.
Here's how you can do this with CFML:
<cfset ImageFile = "/path/to/image.png" />
<cfset ImageInfo = "image/png;charset=utf-8;base64" />
<cfset ImageData = ToBase64( FileReadBinary( ImageFile ) , 'utf-8' ) />
<cfoutput>
<img src="data:#ImageInfo#,#ImageData#" alt="my picture" />
</cfoutput>
You can embed the image as an attachment using cfmailparam and link to the attachement instead of an external file.
http://www.bennadel.com/blog/61-CFMail-CFMAILPARAM-Used-to-Embed-Images-in-Email.htm
I am fairly certain that is an email client issue and not the email/HTML you are putting together. I am unaware (and a quick Google didn't show) of any ways to get around this with HTML.
One possible solution may be to create a rich text email instead and embed the image in the RTF, not sure if that will get you around your issue or not.
Other thought is do you have to have the images in the email? You might be better of crafting the email format to not rely on the images for formatting/aesthetics but allow them to be included if the client displays them. Not sure who your target audience is but in my job we have to deal with users that are restricted to plain text email quite often.