Navigation Query parameters are decoded twice, decoding already decoded value [210711399]

Fixed

Bug

Status Update

No update yet.

Description

al...@mercari.com

created issue #1

Dec 15, 2021 07:21AM

Component used: Navigation Version used: 2.4.0-beta02

Query parameters are being decoded twice,

The first one via Uri.getQueryParameter call in: https://cs.android.com/androidx/platform/frameworks/support/+/androidx-main:navigation/navigation-common/src/main/java/androidx/navigation/NavDeepLink.kt;l=181

and for the second time in : https://cs.android.com/androidx/platform/frameworks/support/+/androidx-main:navigation/navigation-common/src/main/java/androidx/navigation/NavDeepLink.kt;l=193

This results to wrong incorrect final decoded value provided to the SavedStateHandle.

This leads to encoded special characters such as % to be decoded incorrectly. For example, the raw value being %555 gets encoded correctly to %25555, Then on the first decode it gets correctly decoded back into %555, but due to decoding an already decoded string, the final decoded argument value becomes U5.

It is easily replicable with common use case. For example, for routes with search query like search?query=%555, the argument transforms into U5 and is searched instead.

Comments

il...@google.com <il...@google.com> #2Dec 15, 2021 06:20PM

A couple of questions:

1. Have you saw crash in real device or only in simulators?
2. Do you use dynamic feature for language ID?

al...@mercari.com <al...@mercari.com> #3Dec 15, 2021 07:11PM

Tested on Android 12 Emulator with custom executor, but cannot repro this issue.

ComposeSandbox 3.zip

49 MB

Download

al...@mercari.com <al...@mercari.com> #4Dec 15, 2021 07:12PM

Second crash in the description is from a real device. Experienced it myself on two different Xiaomi phones, plus lots of crashes from users in the Google Play console.
Dynamic features are not used in the application.

As a wild guess, I have downgraded build tools from 31.0.0 to 30.0.3, compileSdk from 31 to 30, and moved all work with Language ID to the service in a separate process (just to be sure that crash can kill secondary process instead of main). This combination is in beta for 2 days by now and I don't see any SIGSEGV crashes.

jb...@google.com <jb...@google.com> Jan 7, 2022 12:02AM

Assigned to jb...@google.com.

ap...@google.com <ap...@google.com> #5Jan 19, 2022 03:02AM

Hmm, I feel the crash might be something related to separate/secondary process.

I also changed compileSdk and targetSDK to 31 but still cannot repro this issue.

jb...@google.com <jb...@google.com> #6Jan 19, 2022 06:12AM

Marked as fixed.

On the contrary, there was no separate process before, when crashes started.

In the new build (with the aforementioned changes) I can see SIGSEGV crash, but only one instead of dozens and it has a bit different backtrace:

signal 11 (SIGSEGV), code 1 (SEGV_MAPERR)
liblanguage_id_jni.so (offset 0x11e000)

backtrace:
  #00  pc 000000000003c7c0  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 000000000003b960  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 000000000003bb48  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 000000000003bafc  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 0000000000036c98  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 0000000000032714  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 0000000000031cac  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/split_config.arm64_v8a.apk!lib/arm64-v8a/liblanguage_id_jni.so (offset 0x11e000)
  #00  pc 0000000000057438  /data/app/azagroup.reedy-mF7zTu2bv_ELlbFArwNgqA==/oat/arm64/base.odex (offset 0x57000)

Issue 210711399