Navigation Query parameters are decoded twice, decoding already decoded value [210711399]

Fixed

Bug

Status Update

No update yet.

Description

al...@mercari.com

created issue #1

Dec 15, 2021 07:21AM

Component used: Navigation Version used: 2.4.0-beta02

Query parameters are being decoded twice,

The first one via Uri.getQueryParameter call in: https://cs.android.com/androidx/platform/frameworks/support/+/androidx-main:navigation/navigation-common/src/main/java/androidx/navigation/NavDeepLink.kt;l=181

and for the second time in : https://cs.android.com/androidx/platform/frameworks/support/+/androidx-main:navigation/navigation-common/src/main/java/androidx/navigation/NavDeepLink.kt;l=193

This results to wrong incorrect final decoded value provided to the SavedStateHandle.

This leads to encoded special characters such as % to be decoded incorrectly. For example, the raw value being %555 gets encoded correctly to %25555, Then on the first decode it gets correctly decoded back into %555, but due to decoding an already decoded string, the final decoded argument value becomes U5.

It is easily replicable with common use case. For example, for routes with search query like search?query=%555, the argument transforms into U5 and is searched instead.

Comments

il...@google.com <il...@google.com> #2Dec 15, 2021 06:20PM

since these are in public API (:/) we need to do this in 1.2

al...@mercari.com <al...@mercari.com> #3Dec 15, 2021 07:11PM

since it is already marked as deprecated, we can probably do it by now.

ComposeSandbox 3.zip

49 MB

Download

al...@mercari.com <al...@mercari.com> #4Dec 15, 2021 07:12PM

Opening diff shortly

jb...@google.com <jb...@google.com> Jan 7, 2022 12:02AM

Assigned to jb...@google.com.

ap...@google.com <ap...@google.com> #5Jan 19, 2022 03:02AM

Project: platform/frameworks/support
Branch: androidx-master-dev

commit d576cbdc911cba16638a44fd8223391a90a07ef7
Author: Mike Nakhimovich <digitalbuddha@users.noreply.github.com>
Date: Tue Aug 11 09:30:34 2020

[GH] Hide deprecated internal API.

## Proposed Changes

* `RoomDatabase.java` has protected `mCallbacks` field which is leaking in the API docs, we should @Hide it.

## Testing

Test: Ran unit tests locally

## Issues Fixed

Fixes: 76109329

This is an imported pull request from

https://github.com/androidx/androidx/pull/61.

Resolves #61
Github-Pr-Head-Sha: 6440daa3a63752c7f9d5ba2a390248cd85bc634f
GitOrigin-RevId: fe92d8466a59b44b218b6ca3cbd57dcda17992f7

Change-Id: Id599cdf5b02b32bdae0166266fb7da967598fe92

A room/runtime/api/current.ignore
M room/runtime/api/current.txt
M room/runtime/api/public_plus_experimental_current.txt
M room/runtime/api/restricted_current.txt
M room/runtime/src/main/java/androidx/room/RoomDatabase.java

https://android-review.googlesource.com/1396827

jb...@google.com <jb...@google.com> #6Jan 19, 2022 06:12AM

Marked as fixed.

This has been fixed internally and will be available in both the Navigation 2.5.0-alpha01 and 2.4.1 releases.

Issue 210711399