Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Parsing of destination URL breaks destinations with URL encoding, such as Microsoft Teams links from Google redirect #365

Open
7 of 9 tasks
wesinator opened this issue Aug 1, 2024 · 0 comments

Comments

@wesinator
Copy link

New Issue Checklist (tick off like this: [x])

  • I checked existing issues (open and closed) for possible duplicates
  • I can reproduce the problem on the latest stable version (not nightly!)
  • If you have a problem with a specific website: adding the domain to your no-skip-urls-list does not solve the problem
  • The issue is not about adding entries to the default no-skip-urls-list

What is your browser?

  • Firefox
  • Chrome

What is your operating system?

  • Linux
  • Mac
  • Windows

Description (please include examples/screenshots where applicable)

Clicking a Microsoft Teams link in a Google Calendar event, skip redirect correctly redirects the request from https://www.google.com/url?q=, but it also automatically runs the equivalent of decodeURIComponent on the destination link, which breaks the Teams landing url, which uses mixed URL encoding in the URL.
image

To reproduce:

  • add Teams meeting invite link to Google Calendar event. (in this case, the link was opened from a mailchimp link on a separate client session, copied from the address bar and pasted into the calendar event description).
  • Click the link from the Google Calendar. Observe the redirect to the Teams 500 page (meeting not found page is a 500)
  • Manually copy the direct link from the calendar event, and observe that link works properly.

no-skip list does not mitigate this as the bug happens on the parsing of the destination URL.

Example expected meeting link vs redirected target destination URL:

expected/raw link: (this would be the correct link. this specific link will still show error because it is a made up meeting id)
https://teams.microsoft.com/dl/launcher/launcher.html?url=%2F_%23%2Fl%2Fmeetup-join%2F19%3Ameeting_Zxbfkjdkjfdjfkjjkfjfdjguruuutuggtjgkkjtkjtkjtkj%40thread.v2%2F0%3Fcontext%3D%257b%2522Tid%2522%253a%2522988924aeff9-e2f8-413f-ac53-01ac1ce99323%2522%252c%2522Oid%2522%253a%25924aeff9-e2f8-413f-ac53-01ac1ce99323%2522%257d%26mc_cid%3Df74e31d565&mc_eid%3Ddf103b679e%26anon%3Dtrue&type=meetup-join&deeplinkId=924aeff9-e2f8-413f-ac53-01ac1ce99323&directDl=true&msLaunch=true&enableMobilePage=true&suppressPrompt=true

redirect destination (decodeURIComponent() on above URL):
https://teams.microsoft.com/dl/launcher/launcher.html?url=/_#/l/meetup-join/19:meeting_Zxbfkjdkjfdjfkjjkfjfdjguruuutuggtjgkkjtkjtkjtkj@thread.v2/0?context=%7b%22Tid%22%3a%22924aeff9-e2f8-413f-ac53-01ac1ce99323%22%2c%22Oid%22%3a%22924aeff9-e2f8-413f-ac53-01ac1ce99323%22%7d&mc_cid=f74e31d565&mc_eid=df103b679e&anon=true&type=meetup-join&deeplinkId=924aeff9-e2f8-413f-ac53-01ac1ce99323&directDl=true&msLaunch=true&enableMobilePage=true&suppressPrompt=true

The dest URL is passed through something equivalent to decodeURIComponent (the output of this on the example matches what decodeURIComponent does).

it seems like this might be an issue in maybeDecode?

let me know if there are any questions or if there's something I am missing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant