Sitelet https://github.com/hostinger/api-mcp-server/issues/76
Skip to content

[BUG] File uploads fail or land at the wrong path when a file name contains "#", "?" or "%" because the upload path is not URL-encoded #76

Open

Description

@notlakshitha

Bug Description

Both upload helpers in src/core/runtime.ts, uploadFile (line ~1007) and agencyHosting_uploadFile (line ~531), build the TUS upload URL by plain concatenation. The only change made to the path is converting \ to /:

const normalizedPath = this.normalizePath(relativePath);   // only replaces \ with /
const uploadUrlWithFile = `${cleanUploadUrl}/${normalizedPath}?override=true`;

relativePath comes from the user's files. Examples are every file found by hosting_deployWordpressPlugin_scanDirectory for wordpress_plugins_deploy / wordpress_themes_deploy, and the archive basename for static-site and JS deployments. Reserved URL characters in a name are not encoded:

  • # starts a fragment. The rest of the path and the ?override=true flag are never sent.
  • ? starts the query string, so the file name is cut short.
  • A bare % is sent as an invalid percent-escape.

Steps to Reproduce

  1. Create a plugin directory containing assets/icon #2.png or readme?.txt.
  2. Deploy it with wordpress_plugins_deploy.
  3. Inspect the URL that is actually requested. With Node's URL parser, which axios uses:
"my-plugin/assets/icon #2.png" -> path /files/my-plugin/assets/icon%20   hash #2.png?override=true
"my-plugin/readme?.txt"        -> path /files/my-plugin/readme           search ?.txt?override=true
"my-plugin/css/100%.css"       -> path /files/my-plugin/css/100%.css     (invalid escape)

Expected Behavior

Each file is uploaded under its exact relative path, with override=true applied.

Actual Behavior

The file is uploaded as icon or readme, so it overwrites or collides with other files, or the upload fails. In the # case the override flag is also dropped.

Screenshots

No screenshots.

Error Messages / Stack Trace

None.

Additional Context

Both normalizePath and agencyHosting_normalizePath are affected. Package version is 2.13.0.

  1. Percent-encode each path segment in both normalize helpers, keeping the / separators.
  2. Add a test with #, ?, % and a space in a file name.
private normalizePath(pathString: string): string {
  return pathString.replace(/\\/g, '/').split('/').map(encodeURIComponent).join('/');
}

I'm happy to send a PR.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions