You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[BUG] File uploads fail or land at the wrong path when a file name contains "#", "?" or "%" because the upload path is not URL-encoded #76
Both upload helpers in src/core/runtime.ts, uploadFile (line ~1007) and agencyHosting_uploadFile (line ~531), build the TUS upload URL by plain concatenation. The only change made to the path is converting \ to /:
constnormalizedPath=this.normalizePath(relativePath);// only replaces \ with /constuploadUrlWithFile=`${cleanUploadUrl}/${normalizedPath}?override=true`;
relativePath comes from the user's files. Examples are every file found by hosting_deployWordpressPlugin_scanDirectory for wordpress_plugins_deploy / wordpress_themes_deploy, and the archive basename for static-site and JS deployments. Reserved URL characters in a name are not encoded:
# starts a fragment. The rest of the path and the ?override=true flag are never sent.
? starts the query string, so the file name is cut short.
A bare % is sent as an invalid percent-escape.
Steps to Reproduce
Create a plugin directory containing assets/icon #2.png or readme?.txt.
Deploy it with wordpress_plugins_deploy.
Inspect the URL that is actually requested. With Node's URL parser, which axios uses:
Each file is uploaded under its exact relative path, with override=true applied.
Actual Behavior
The file is uploaded as icon or readme, so it overwrites or collides with other files, or the upload fails. In the # case the override flag is also dropped.
Screenshots
No screenshots.
Error Messages / Stack Trace
None.
Additional Context
Both normalizePath and agencyHosting_normalizePath are affected. Package version is 2.13.0.
Percent-encode each path segment in both normalize helpers, keeping the / separators.
Add a test with #, ?, % and a space in a file name.
Activity