Fix ci after location patch

[wesleytodd]

CI started failing with the previous push due to old supertest versions installed only in ci not correctly url encoding before making the request. By encoding it ourselves in the test supertest works as expected in both versions.

New habits are hard to break. I used template literal strings which obviously didn't work in old versions. Should be fixed now.

I know you tested locally, but I have no idea why this works, I guess we are converting the encoded @ (%40) back to a @ before location setting? A percent encoded @ should not trigger this vuln Im pretty sure.

encodeURIComponent('\\@apple.com')// => "%5C%40apple.com"

This comment is specifically about being unsure how the input ends up matching the expected Location in the test. Who converts that %40 back into the @ we assert against? maybe it's supertest when doing the string compare? Is it Node.js itself doing that before express receives the request.query property? I don't know

No idea, do we need to know? It fixes it afaict in all supported versions.

I shouldn't say no idea. I mean that I looked and it appears old supertest does not encode correctly (not at all IIRC). Encoding ourselves does it and new super test doesnt double escape or anything. This is not something I can spend more time so if you think we need to debug supertest to figure out why then go for it and approve when you are done.

There is a bug report because we did not have test coverage of accepting URL instances. You requested changes on this. Can you approve it instead? I would like to merge this so we can also put out #5554

I do want to understand why this still passes the test, but I wont block on it bc it is test only changes.

I am not sure why appveyor and coveralls did not trigger here but I am going to merge anyway.

[wesleytodd]

CI started failing with the previous push due to old supertest versions installed only in ci not correctly url encoding before making the request. By encoding it ourselves in the test supertest works as expected in both versions.

New habits are hard to break. I used template literal strings which obviously didn't work in old versions. Should be fixed now.

I know you tested locally, but I have no idea why this works, I guess we are converting the encoded @ (%40) back to a @ before location setting? A percent encoded @ should not trigger this vuln Im pretty sure.

encodeURIComponent('\\@apple.com')// => "%5C%40apple.com"

This comment is specifically about being unsure how the input ends up matching the expected Location in the test. Who converts that %40 back into the @ we assert against? maybe it's supertest when doing the string compare? Is it Node.js itself doing that before express receives the request.query property? I don't know

No idea, do we need to know? It fixes it afaict in all supported versions.

I shouldn't say no idea. I mean that I looked and it appears old supertest does not encode correctly (not at all IIRC). Encoding ourselves does it and new super test doesnt double escape or anything. This is not something I can spend more time so if you think we need to debug supertest to figure out why then go for it and approve when you are done.

There is a bug report because we did not have test coverage of accepting URL instances. You requested changes on this. Can you approve it instead? I would like to merge this so we can also put out #5554

I do want to understand why this still passes the test, but I wont block on it bc it is test only changes.

I am not sure why appveyor and coveralls did not trigger here but I am going to merge anyway.

[wesleytodd]

CI started failing with the previous push due to old supertest versions installed only in ci not correctly url encoding before making the request. By encoding it ourselves in the test supertest works as expected in both versions.

New habits are hard to break. I used template literal strings which obviously didn't work in old versions. Should be fixed now.

I know you tested locally, but I have no idea why this works, I guess we are converting the encoded @ (%40) back to a @ before location setting? A percent encoded @ should not trigger this vuln Im pretty sure.

encodeURIComponent('\\@apple.com')// => "%5C%40apple.com"

This comment is specifically about being unsure how the input ends up matching the expected Location in the test. Who converts that %40 back into the @ we assert against? maybe it's supertest when doing the string compare? Is it Node.js itself doing that before express receives the request.query property? I don't know

No idea, do we need to know? It fixes it afaict in all supported versions.

I shouldn't say no idea. I mean that I looked and it appears old supertest does not encode correctly (not at all IIRC). Encoding ourselves does it and new super test doesnt double escape or anything. This is not something I can spend more time so if you think we need to debug supertest to figure out why then go for it and approve when you are done.

There is a bug report because we did not have test coverage of accepting URL instances. You requested changes on this. Can you approve it instead? I would like to merge this so we can also put out #5554

I do want to understand why this still passes the test, but I wont block on it bc it is test only changes.

I am not sure why appveyor and coveralls did not trigger here but I am going to merge anyway.

[wesleytodd]

CI started failing with the previous push due to old supertest versions installed only in ci not correctly url encoding before making the request. By encoding it ourselves in the test supertest works as expected in both versions.

New habits are hard to break. I used template literal strings which obviously didn't work in old versions. Should be fixed now.

I know you tested locally, but I have no idea why this works, I guess we are converting the encoded @ (%40) back to a @ before location setting? A percent encoded @ should not trigger this vuln Im pretty sure.

encodeURIComponent('\\@apple.com')// => "%5C%40apple.com"

This comment is specifically about being unsure how the input ends up matching the expected Location in the test. Who converts that %40 back into the @ we assert against? maybe it's supertest when doing the string compare? Is it Node.js itself doing that before express receives the request.query property? I don't know

No idea, do we need to know? It fixes it afaict in all supported versions.

I shouldn't say no idea. I mean that I looked and it appears old supertest does not encode correctly (not at all IIRC). Encoding ourselves does it and new super test doesnt double escape or anything. This is not something I can spend more time so if you think we need to debug supertest to figure out why then go for it and approve when you are done.

There is a bug report because we did not have test coverage of accepting URL instances. You requested changes on this. Can you approve it instead? I would like to merge this so we can also put out #5554

I do want to understand why this still passes the test, but I wont block on it bc it is test only changes.

I am not sure why appveyor and coveralls did not trigger here but I am going to merge anyway.

[wesleytodd]

CI started failing with the previous push due to old supertest versions installed only in ci not correctly url encoding before making the request. By encoding it ourselves in the test supertest works as expected in both versions.

New habits are hard to break. I used template literal strings which obviously didn't work in old versions. Should be fixed now.

I know you tested locally, but I have no idea why this works, I guess we are converting the encoded @ (%40) back to a @ before location setting? A percent encoded @ should not trigger this vuln Im pretty sure.

encodeURIComponent('\\@apple.com')// => "%5C%40apple.com"

This comment is specifically about being unsure how the input ends up matching the expected Location in the test. Who converts that %40 back into the @ we assert against? maybe it's supertest when doing the string compare? Is it Node.js itself doing that before express receives the request.query property? I don't know

No idea, do we need to know? It fixes it afaict in all supported versions.

I shouldn't say no idea. I mean that I looked and it appears old supertest does not encode correctly (not at all IIRC). Encoding ourselves does it and new super test doesnt double escape or anything. This is not something I can spend more time so if you think we need to debug supertest to figure out why then go for it and approve when you are done.

There is a bug report because we did not have test coverage of accepting URL instances. You requested changes on this. Can you approve it instead? I would like to merge this so we can also put out #5554

I do want to understand why this still passes the test, but I wont block on it bc it is test only changes.

I am not sure why appveyor and coveralls did not trigger here but I am going to merge anyway.

[wesleytodd]

CI started failing with the previous push due to old supertest versions installed only in ci not correctly url encoding before making the request. By encoding it ourselves in the test supertest works as expected in both versions.

New habits are hard to break. I used template literal strings which obviously didn't work in old versions. Should be fixed now.

I know you tested locally, but I have no idea why this works, I guess we are converting the encoded @ (%40) back to a @ before location setting? A percent encoded @ should not trigger this vuln Im pretty sure.

encodeURIComponent('\\@apple.com')// => "%5C%40apple.com"

This comment is specifically about being unsure how the input ends up matching the expected Location in the test. Who converts that %40 back into the @ we assert against? maybe it's supertest when doing the string compare? Is it Node.js itself doing that before express receives the request.query property? I don't know

No idea, do we need to know? It fixes it afaict in all supported versions.

I shouldn't say no idea. I mean that I looked and it appears old supertest does not encode correctly (not at all IIRC). Encoding ourselves does it and new super test doesnt double escape or anything. This is not something I can spend more time so if you think we need to debug supertest to figure out why then go for it and approve when you are done.

There is a bug report because we did not have test coverage of accepting URL instances. You requested changes on this. Can you approve it instead? I would like to merge this so we can also put out #5554

I do want to understand why this still passes the test, but I wont block on it bc it is test only changes.

I am not sure why appveyor and coveralls did not trigger here but I am going to merge anyway.

[wesleytodd]

CI started failing with the previous push due to old supertest versions installed only in ci not correctly url encoding before making the request. By encoding it ourselves in the test supertest works as expected in both versions.

New habits are hard to break. I used template literal strings which obviously didn't work in old versions. Should be fixed now.

I know you tested locally, but I have no idea why this works, I guess we are converting the encoded @ (%40) back to a @ before location setting? A percent encoded @ should not trigger this vuln Im pretty sure.

encodeURIComponent('\\@apple.com')// => "%5C%40apple.com"

This comment is specifically about being unsure how the input ends up matching the expected Location in the test. Who converts that %40 back into the @ we assert against? maybe it's supertest when doing the string compare? Is it Node.js itself doing that before express receives the request.query property? I don't know

No idea, do we need to know? It fixes it afaict in all supported versions.

I shouldn't say no idea. I mean that I looked and it appears old supertest does not encode correctly (not at all IIRC). Encoding ourselves does it and new super test doesnt double escape or anything. This is not something I can spend more time so if you think we need to debug supertest to figure out why then go for it and approve when you are done.

There is a bug report because we did not have test coverage of accepting URL instances. You requested changes on this. Can you approve it instead? I would like to merge this so we can also put out #5554

I do want to understand why this still passes the test, but I wont block on it bc it is test only changes.

I am not sure why appveyor and coveralls did not trigger here but I am going to merge anyway.

[wesleytodd]

CI started failing with the previous push due to old supertest versions installed only in ci not correctly url encoding before making the request. By encoding it ourselves in the test supertest works as expected in both versions.

New habits are hard to break. I used template literal strings which obviously didn't work in old versions. Should be fixed now.

I know you tested locally, but I have no idea why this works, I guess we are converting the encoded @ (%40) back to a @ before location setting? A percent encoded @ should not trigger this vuln Im pretty sure.

encodeURIComponent('\\@apple.com')// => "%5C%40apple.com"

This comment is specifically about being unsure how the input ends up matching the expected Location in the test. Who converts that %40 back into the @ we assert against? maybe it's supertest when doing the string compare? Is it Node.js itself doing that before express receives the request.query property? I don't know

No idea, do we need to know? It fixes it afaict in all supported versions.

I shouldn't say no idea. I mean that I looked and it appears old supertest does not encode correctly (not at all IIRC). Encoding ourselves does it and new super test doesnt double escape or anything. This is not something I can spend more time so if you think we need to debug supertest to figure out why then go for it and approve when you are done.

There is a bug report because we did not have test coverage of accepting URL instances. You requested changes on this. Can you approve it instead? I would like to merge this so we can also put out #5554

I do want to understand why this still passes the test, but I wont block on it bc it is test only changes.

I am not sure why appveyor and coveralls did not trigger here but I am going to merge anyway.