[MC-8862] URL Encoding Created: 31/Jan/13  Updated: 29/Jul/13  Resolved: 29/Jul/13

Status: Resolved
Project: Minecraft: Java Edition
Component/s: None
Affects Version/s: Minecraft 1.4.6, Minecraft 1.4.7, Snapshot 13w04a, Snapshot 13w05a
Fix Version/s: None

Type: Bug
Reporter: Jade Harley Assignee: Unassigned
Resolution: Invalid Votes: 0
Labels: None
Environment:

OS: Windows
Java: 1.7.something


Confirmation Status: Unconfirmed

 Description   

There are a couple of issues regarding spaces in usernames I've noticed while poking around the client (and I'd guess the server as well). The key one that breaks many http servers is that you don't URLencode the strings, so that, say, "Socks the Fox" gets sent in the headers as this:
GET /MinecraftSkins/Socks the Fox.png HTTP/1.1

Which looks fine until you realize that HTTP servers see a GET for "/MinecraftSkins/Socks" with a protocol version of "the Fox.png HTTP/1.1" It probably also causes issues with servers that don't like unencoded UTF characters in URLs, but I don't think that will be as problematic.

If you'd run the strings through URLencode.encode(x,x) you'd get the proper URL:
GET /MinecraftSkins/Socks+the+Fox.png HTTP/1.1

Combine this with better tokenizing of server commands (i.e. '/give "Socks the Fox" 157') and you'd be able to support spaces in names properly.

Note that the issue also appears in the launcher as well, which breaks updating for users with spaces in their names 'cause it breaks up the requests and ends up asking for nonexistant files.

So basically the fix is as simple as changing all the constructors for URLs from "new URL(string);" to "new URL(URLEncoder.encode(string, "UTF-8"));" which should be almost as easy as Find/Replace. You wanna be HTTP compliant, right? ;P



 Comments   
Comment by Tails [ 29/Jul/13 ]

No answer, assuming no longer an issue.

Comment by Tails [ 18/Mar/13 ]

Is this still a concern in the current Minecraft version? If so, please update the affected versions in order to best aid Mojang ensuring bugs are still valid in the latest releases/pre-releases.

Comment by Jade Harley [ 06/Feb/13 ]

The URL encoding was a bug report because it's not standards-compliant. I think that maintaining standards compliance is important.

As well, I don't see any reason for the Mojang to not support spaces in user names. It doesn't really add anything security wise, so it seemed kind of arbitrary. I don't expect them to drop everything to add spaces-in-usernames support, but they might want it some day and I'd like to point out things that can help make it happen.

As far as my moral compass, I lost that years ago. I just wander about until I find something interesting I'd be happy to give Mojang my source so they could see how I do it, and maybe protect against it in the future. It's a bit of a mess, but then again so is Minecraft

If you don't mind me asking, I'd also like to know how you found my site, since I've only released it to a few people yesterday and from what I can tell it doesn't show up in Google. Just interested

Comment by [Mod] Torabi [ 06/Feb/13 ]

And why would Mojang be interested in helping you help others pirate Minecraft? While they have a pretty lax stance on piracy, I don't think they'll appreciate your attempts to mimic the value-added services of authentication and custom skins that are supposed to be part of the motivation for purchasing Minecraft. You might want to get your moral compass checked; it seems a bit off.

Comment by Jade Harley [ 04/Feb/13 ]

I've gotten it so that I can intercept the important strings and filter them (the way Dean suggested, ATM) before sending them on to the URL constructors. HTTP servers have to accept UTF-8 URLs now anyway IIRC due to the new DNS specs, so spaces and a handful of other characters are the only thing that need to be escaped (and since I disallow '/' in usernames on my system purely due to filename issues I don't worry about that, though I could if I wanted to I guess).

I've also hacked in some basic command token parsing so that you can quote usernames with spaces and it'll work (i.e. '/give "Socks the Fox" 137' properly gives me my command block). Haven't tried it with a command block yet, but it's either already properly tokenized for spaced usernames or as simple as putting quotes around the @p or whatever in the command block command. Once I've gotten the server version of my launcher finished I should have 100% spaces in usernames support. Because I can.

HTTP standards compliance FTW!

Comment by Dean Baset [ 03/Feb/13 ]

I believe that this is fixed by replacing all of the Spaces with %20

Comment by Jade Harley [ 01/Feb/13 ]

Not in your system

It's okay, I've already worked around it by running the URL constructor parameters through a simplified encoder before sending them off to their constructors. I still think it'd be a good idea to run them through the URLencoder. There are plenty of non-technical users who might consider characters like üôĶ etc. alphanumeric and this seems to be a rather ambiguous restriction on user names. Like I said, the URL encoding and simplistic command tokenization are the only thing between you and full Unicode-and-spaces-in-usernames support.

Comment by [Mojang] Nathan Adams [ 01/Feb/13 ]

Do remember that player names cannot have spaces or non alphanumeric characters!

Comment by Jade Harley [ 01/Feb/13 ]

Welp, after experimenting and finding out some stuff, it looks like the fix I proposed is not actually that simple. You'd have to URLencoder.encode the name separately, before passing it to the rest of the string. Still, it's a good idea to properly sanitize your inputs.

Generated at Sun Jan 12 12:19:11 UTC 2025 using Jira 9.12.2#9120002-sha1:301bf498dd45d800842af0b84230f1bb58606c13.