Handling % in url in angular application

Question

0.00/5 (No votes)

See more:

Dear all,

I am working on angular 9v application.

Not able to handle when '%' being passed in url like
Examples: http://localhost:4200/%
http://localhost:4200/abc%xyz

I have used

DefaultUrlSerializer

to overcome the issue but when ever '%' found in url control is not coming to

DefaultUrlSerializer

class.

I badly need the solution for this.

Appreciate your early response eon this.

Regards,
Ashok

What I have tried:

I tried with

DefaultUrlSerializer

but no luck

Posted 11-Mar-21 0:36am

Attuluri_Ashok

Updated 11-Mar-21 0:53am

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

Richard Deeming · Answer 1 · 2021-03-11T00:53:00

Solution 1

A raw % character is not valid in a URL. It needs to be encoded properly as %25:
Percent-encoding - Wikipedia[^]

Posted 11-Mar-21 0:53am

Richard Deeming

Comments

Attuluri_Ashok 11-Mar-21 7:20am

Thank you Richard for your quick response.

Seems this is a kind of security (vulnerability) checks with tool. below is the sample url.

http://localhost:4200/dxojdzmik2%c1%81lod1xp5bdz/js/main.js

when you hit with above url, it explores the machine internal source code paths.

Need to control showing internal paths or fix the issue.

Regards,
Ashok

Richard Deeming 11-Mar-21 7:25am

That's not a raw % character; that's two encoded characters: %c1 and %81. How they are interpreted will depend on the encoding used by your server.

Attuluri_Ashok 15-Mar-21 4:33am

yes, but the problem is, when I have these (%c1 and %81) encoded characters in url control is not coming to application to call a function.

main issue with "%", if control comes to the application I will replace "%" with "%25" so that my application will not break.

Appreciate if you cold guide me on this.
In which file I need to write the function to invoke when url has "%" in it.

Regards,
Ashok

Richard Deeming 15-Mar-21 4:42am

As I said, it depends on the web server you're using.

If those characters allow you to read content from your server's file system, then it's a security vulnerability in the web server software, and you need to report it to the vendor.

If they simply return an error indicating that the URL was not found, it's because that URL isn't mapped to your application. Unless you actually want to map that URL to your application, a 404 "not found" response is the correct response.

You cannot use code on the server to change the URL that was requested by the client. You can redirect them to a different URL, but you cannot alter what they have already sent.

Attuluri_Ashok 16-Mar-21 2:00am

Thanks Richard.

Let me check.

Regards,
Ashok