Bug #31942 Save function for searches doesn't catch invalid characters
Submitted: 30 Oct 2007 11:14 Modified: 16 Nov 2007 22:46
Reporter: Hartmut Holzgraefe Email Updates:
Status: Closed Impact on me:
None 
Category:MySQL Websites: bugs.mysql.com Severity:S3 (Non-critical)
Version: OS:Any
Assigned to: CPU Architecture:Any

[30 Oct 2007 11:14] Hartmut Holzgraefe
Description:
I just tried to save a search with a comma "," in the search name,
this seemed to succeed but the presented link didn't work

Search title: "Cluster active bugs, newest first"

URL: http://bugs.mysql.com/saved/Cluster%20active%20bugs,%20newest%20first

Error: The file you have requested (saved/Cluster active bugs, newest first) does not exist

The same serach title without the comma worked fine

How to repeat:
Try to save a bugs search with a "," in the search title 

Suggested fix:
Either escape all invalid characters or do not accept them in search titles in the first place
[30 Oct 2007 12:00] Sveta Smirnova
Thank you for the report.

I just tried from "Saved Searches" page, all works fine. Seems you use wrong link:

http://bugs.mysql.com/saved/Cluster%20active%20bugs,%20newest%20first

instead of

http://bugs.mysql.com/saved/Cluster%20active%20bugs%2C%20newest%20firs
[30 Oct 2007 13:02] Hartmut Holzgraefe
The actual problem was not the comma character
but the overall length of the search label, i
seem to have exceeded that by exactly one character
so removing the comma made it work again.

The search label names are limited to 32 characters
and the label given is silently truncated to 32 
characters if a longer label is put into the input 
field. The truncated label shows up in the "saved
searches" list just fine and works, but the URL
given in the save function feedback still has the
full label as parameter in it, not the truncated
version, and so the lookup for this search fails.

Suggested fixes:

- at least add a maxlength attribute to the label input field
- reject any input > 32 characters?
- or truncate the URL in the success form?
- or truncate search label input to 32 chars, too, make both the truncated and the full version work, just with only 32 significant characters?
[16 Nov 2007 22:46] Jim Winstead
maxlength is set on the field, and extra characters in the url will also be ignored.