client/general: improve URL escaping

Specifically, cater for /, + and % in URL components.

13 files changed, 34 insertions, 22 deletions

diff --git a/client/js/api.js b/client/js/api.js
index 016d82b..ab93b9a 100644
--- a/client/js/api.js
+++ b/client/js/api.js
@@ -63,12 +63,15 @@ class Api extends events.EventTarget {
 
     _process(url, requestFactory, data, files, options) {
         options = options || {};
-        const fullUrl = this._getFullUrl(url);
+        const [fullUrl, query] = this._getFullUrl(url);
         return new Promise((resolve, reject) => {
             if (!options.noProgress) {
                 nprogress.start();
             }
             let req = requestFactory(fullUrl);
+            if (query) {
+                req.query(query);
+            }
             if (data) {
                 req.attach('metadata', new Blob([JSON.stringify(data)]));
             }
@@ -176,8 +179,12 @@ class Api extends events.EventTarget {
     }
 
     _getFullUrl(url) {
-        return (config.apiUrl + '/' + encodeURI(url))
-            .replace(/([^:])\/+/g, '$1/');
+        const fullUrl =
+            (config.apiUrl + '/' + url).replace(/([^:])\/+/g, '$1/');
+        const matches = fullUrl.match(/^([^?]*)\??(.*)$/);
+        const baseUrl = matches[1];
+        const request = matches[2];
+        return [baseUrl, request];
     }
 }
 
diff --git a/client/js/controllers/comments_controller.js b/client/js/controllers/comments_controller.js
index da76009..ea88a9c 100644
--- a/client/js/controllers/comments_controller.js
+++ b/client/js/controllers/comments_controller.js
@@ -32,7 +32,7 @@ class CommentsController {
             },
             requestPage: page => {
                 return PostList.search(
-                    'sort:comment-date+comment-count-min:1', page, 10, fields);
+                    'sort:comment-date comment-count-min:1', page, 10, fields);
             },
             pageRenderer: pageCtx => {
                 Object.assign(pageCtx, {
diff --git a/client/js/controllers/post_controller.js b/client/js/controllers/post_controller.js
index ec84744..7644e26 100644
--- a/client/js/controllers/post_controller.js
+++ b/client/js/controllers/post_controller.js
@@ -255,7 +255,7 @@ class PostController {
 }
 
 module.exports = router => {
-    router.enter('/post/:id/edit/:parameters?',
+    router.enter('/post/:id/edit/:parameters(.*)?',
         (ctx, next) => { misc.parseUrlParametersRoute(ctx, next); },
         (ctx, next) => {
             // restore parameters from history state
@@ -265,7 +265,7 @@ module.exports = router => {
             ctx.controller = new PostController(ctx.parameters.id, true, ctx);
         });
     router.enter(
-        '/post/:id/:parameters?',
+        '/post/:id/:parameters(.*)?',
         (ctx, next) => { misc.parseUrlParametersRoute(ctx, next); },
         (ctx, next) => {
             // restore parameters from history state
diff --git a/client/js/controllers/post_list_controller.js b/client/js/controllers/post_list_controller.js
index c1dfd06..a3eab90 100644
--- a/client/js/controllers/post_list_controller.js
+++ b/client/js/controllers/post_list_controller.js
@@ -120,7 +120,7 @@ class PostListController {
 
 module.exports = router => {
     router.enter(
-        '/posts/:parameters?',
+        '/posts/:parameters(.*)?',
         (ctx, next) => { misc.parseUrlParametersRoute(ctx, next); },
         (ctx, next) => { ctx.controller = new PostListController(ctx); });
 };
diff --git a/client/js/controllers/tag_controller.js b/client/js/controllers/tag_controller.js
index 74a6e4a..3a824d4 100644
--- a/client/js/controllers/tag_controller.js
+++ b/client/js/controllers/tag_controller.js
@@ -121,16 +121,16 @@ class TagController {
 }
 
 module.exports = router => {
-    router.enter('/tag/:name', (ctx, next) => {
-        ctx.controller = new TagController(ctx, 'summary');
-    });
-    router.enter('/tag/:name/edit', (ctx, next) => {
+    router.enter('/tag/:name(.+?)/edit', (ctx, next) => {
         ctx.controller = new TagController(ctx, 'edit');
     });
-    router.enter('/tag/:name/merge', (ctx, next) => {
+    router.enter('/tag/:name(.+?)/merge', (ctx, next) => {
         ctx.controller = new TagController(ctx, 'merge');
     });
-    router.enter('/tag/:name/delete', (ctx, next) => {
+    router.enter('/tag/:name(.+?)/delete', (ctx, next) => {
         ctx.controller = new TagController(ctx, 'delete');
     });
+    router.enter('/tag/:name(.+)', (ctx, next) => {
+        ctx.controller = new TagController(ctx, 'summary');
+    });
 };
diff --git a/client/js/controllers/tag_list_controller.js b/client/js/controllers/tag_list_controller.js
index 0f1f00e..d61d8f7 100644
--- a/client/js/controllers/tag_list_controller.js
+++ b/client/js/controllers/tag_list_controller.js
@@ -75,7 +75,7 @@ class TagListController {
 
 module.exports = router => {
     router.enter(
-        '/tags/:parameters?',
+        '/tags/:parameters(.*)?',
         (ctx, next) => { misc.parseUrlParametersRoute(ctx, next); },
         (ctx, next) => { ctx.controller = new TagListController(ctx); });
 };
diff --git a/client/js/controllers/user_list_controller.js b/client/js/controllers/user_list_controller.js
index 6e44ce8..98e7003 100644
--- a/client/js/controllers/user_list_controller.js
+++ b/client/js/controllers/user_list_controller.js
@@ -69,7 +69,7 @@ class UserListController {
 
 module.exports = router => {
     router.enter(
-        '/users/:parameters?',
+        '/users/:parameters(.*)?',
         (ctx, next) => { misc.parseUrlParametersRoute(ctx, next); },
         (ctx, next) => { ctx.controller = new UserListController(ctx); });
 };
diff --git a/client/js/models/post_list.js b/client/js/models/post_list.js
index 451ce28..b03dd8e 100644
--- a/client/js/models/post_list.js
+++ b/client/js/models/post_list.js
@@ -6,7 +6,10 @@ const Post = require('./post.js');
 
 class PostList extends AbstractList {
     static getAround(id, searchQuery) {
-        return api.get(`/post/${id}/around?fields=id&query=${searchQuery}`)
+        const url =
+            `/post/${id}/around?fields=id` +
+            `&query=${encodeURIComponent(searchQuery)}`;
+        return api.get(url)
             .then(response => {
                 return Promise.resolve(response);
             }).catch(response => {
@@ -16,7 +19,7 @@ class PostList extends AbstractList {
 
     static search(text, page, pageSize, fields) {
         const url =
-            `/posts/?query=${text}` +
+            `/posts/?query=${encodeURIComponent(text)}` +
             `&page=${page}` +
             `&pageSize=${pageSize}` +
             `&fields=${fields.join(',')}`;
diff --git a/client/js/models/snapshot_list.js b/client/js/models/snapshot_list.js
index 628ee29..22348f4 100644
--- a/client/js/models/snapshot_list.js
+++ b/client/js/models/snapshot_list.js
@@ -7,7 +7,7 @@ const Snapshot = require('./snapshot.js');
 class SnapshotList extends AbstractList {
     static search(text, page, pageSize) {
         const url =
-            `/snapshots/?query=${text}` +
+            `/snapshots/?query=${encodeURIComponent(text)}` +
             `&page=${page}` +
             `&pageSize=${pageSize}`;
         return api.get(url).then(response => {
diff --git a/client/js/models/tag_list.js b/client/js/models/tag_list.js
index ec578bb..268bcd8 100644
--- a/client/js/models/tag_list.js
+++ b/client/js/models/tag_list.js
@@ -7,7 +7,7 @@ const Tag = require('./tag.js');
 class TagList extends AbstractList {
     static search(text, page, pageSize, fields) {
         const url =
-            `/tags/?query=${text}` +
+            `/tags/?query=${encodeURIComponent(text)}` +
             `&page=${page}` +
             `&pageSize=${pageSize}` +
             `&fields=${fields.join(',')}`;
diff --git a/client/js/models/user_list.js b/client/js/models/user_list.js
index c829afd..4ca430d 100644
--- a/client/js/models/user_list.js
+++ b/client/js/models/user_list.js
@@ -6,7 +6,9 @@ const User = require('./user.js');
 
 class UserList extends AbstractList {
     static search(text, page) {
-        const url = `/users/?query=${text}&page=${page}&pageSize=30`;
+        const url =
+            `/users/?query=${encodeURIComponent(text)}` +
+            `&page=${page}&pageSize=30`;
         return api.get(url).then(response => {
             return Promise.resolve(Object.assign(
                 {},
diff --git a/client/js/router.js b/client/js/router.js
index f757e07..570fb3e 100644
--- a/client/js/router.js
+++ b/client/js/router.js
@@ -75,7 +75,7 @@ class Route {
         const keys = this.keys;
         const qsIndex = path.indexOf('?');
         const pathname = ~qsIndex ? path.slice(0, qsIndex) : path;
-        const m = this.regexp.exec(decodeURIComponent(pathname));
+        const m = this.regexp.exec(pathname);
 
         if (!m) {
             return false;
diff --git a/client/js/util/misc.js b/client/js/util/misc.js
index c46f979..83e286d 100644
--- a/client/js/util/misc.js
+++ b/client/js/util/misc.js
@@ -165,7 +165,7 @@ function formatUrlParameters(dict) {
             continue;
         }
         if (value) {
-            result.push(`${key}=${value}`);
+            result.push(`${key}=${encodeURIComponent(value)}`);
         }
     }
     return result.join(';');