Transformation params not properly URL escaped #540

Activity

1. wissam-khalili commented on Mar 31, 2024

   

   wissam-khalili

   on Mar 31, 2024

   More actions

   Hi @stirkac ,

   Thank you for reaching out.

   The example you have provided won't work and you will get:
   X-Cld-Error: Invalid color name "abc
   Whether we encode it or not - it will not work.

   Could you share your use case?
   If it's possible, can you provide some other parameter that works if you encode it and we are not encoding?

   Best Regards,
   Wissam
2. stirkac commented on Apr 1, 2024

   

   stirkac

   on Apr 1, 2024

   Author

   More actions

   Sorry, I made an assumption, but the actual value can be seen from the screenshot that is added: "#e6e6e640
   It was an accidental discovery, by pasting the value with the quotation mark. It's hard for me to share the exact code because transformation hash is dynamically constructed, but if it helps, here's the replicated use case with everything in plain sight:

   {"resource_type":"video","sign_url":true,"secure":true,"delivery_type":"authenticated","transformation":[{"color":"\"#e6e6e640","overlay":{"font_family":"Times","font_size":20,"font_weight":"bold","text":"Order #1419 for seb as - sebastjan@shopcircle.co on Thu, Mar 28, 24"}},{"effect":"anti_removal:90","flags":"layer_apply","gravity":"center"}]}

   and the resulting url:
   https://res.cloudinary.com/dymk9xwef/video/upload/s--DIhny0fj--/co_\"#e6e6e640,l_text:Times_20_bold:Order%20%231419%20for%20seb%20as%20-%20sebastjan%40shopcircle.co%20on%20Thu%252C%20Mar%2028%252C%2024/e_anti_removal:90,fl_layer_apply,g_center/dance-2.mp4
3. wissam-khalili commented on Apr 1, 2024

   

   wissam-khalili

   on Apr 1, 2024

   More actions

   Hi @stirkac,

   We do encode color, if a valid color is passed, for example, #e6e6e640 so in the resulting url it will be encoded to: co_rgb:e6e6e640. We do not sanitize input (strip spaces, quotes, etc).
   I hope this is helpful.
   Regards,
   Wissam