Decode directory separators in source URLs

URLs with encoded directory-separator characters are not correctly
processed by QUrl.

Task-number: QTBUG-25981
Change-Id: I78173ef44c4850774b56753335bea34db04c0735
Reviewed-by: Chris Adams <christopher.adams@nokia.com>

4 files changed, 29 insertions, 4 deletions

diff --git a/src/qml/doc/src/typesystem/basictypes.qdoc b/src/qml/doc/src/typesystem/basictypes.qdoc
index 3c1b849b5b..c24787b4c8 100644
--- a/src/qml/doc/src/typesystem/basictypes.qdoc
+++ b/src/qml/doc/src/typesystem/basictypes.qdoc
@@ -167,6 +167,21 @@ See \l {QML Basic Types} for the list of basic types that are supported by the Q
     Usually you will only have to do this once, because relative URLs resolved from
     that file will use the same protocol.
 
+    URLs may contain encoded characters using the 'percent-encoding' scheme
+    specified by \l {http://tools.ietf.org/html/rfc3986}{RFC 3986}.  These characters
+    will be preserved within properties of type \c url, to allow QML code to
+    construct precise URL values. An exception to this rule is the preemptive
+    decoding of directory-separator characters (\c '/') - these characters are decoded
+    to allow the URL to be correctly classified.
+
+    For example, a local file containing a '#' character, which would normally be
+    interpreted as the beginning of the URL 'fragment' element, can be accessed by
+    encoding the characters of the file name:
+
+    \qml
+    Image { source: encodeURIComponent("/tmp/test#1.png") }
+    \endqml
+
     \sa {QML Basic Types}
 */
 
diff --git a/src/qml/qml/qqmlcompiler.cpp b/src/qml/qml/qqmlcompiler.cpp
index 2bb99ddbab..13ff9e81e3 100644
--- a/src/qml/qml/qqmlcompiler.cpp
+++ b/src/qml/qml/qqmlcompiler.cpp
@@ -515,6 +515,8 @@ void QQmlCompiler::genLiteralAssignment(QQmlScript::Property *prop,
             {
             Instruction::StoreUrl instr;
             QString string = v->value.asString();
+            // Encoded dir-separators defeat QUrl processing - decode them first
+            string.replace(QLatin1String("%2f"), QLatin1String("/"), Qt::CaseInsensitive);
             QUrl u = string.isEmpty() ? QUrl() : output->url.resolved(QUrl(string));
             instr.propertyIndex = prop->index;
             instr.value = output->indexForUrl(u);
diff --git a/src/qml/qml/qqmlproperty.cpp b/src/qml/qml/qqmlproperty.cpp
index 33f860fb17..d0c2761373 100644
--- a/src/qml/qml/qqmlproperty.cpp
+++ b/src/qml/qml/qqmlproperty.cpp
@@ -1319,10 +1319,16 @@ bool QQmlPropertyPrivate::write(QObject *object,
             u = value.toUrl();
             found = true;
         } else if (variantType == QVariant::ByteArray) {
-            u = QUrl(QString::fromUtf8(value.toByteArray()));
+            QString input(QString::fromUtf8(value.toByteArray()));
+            // Encoded dir-separators defeat QUrl processing - decode them first
+            input.replace(QLatin1String("%2f"), QLatin1String("/"), Qt::CaseInsensitive);
+            u = QUrl(input);
             found = true;
         } else if (variantType == QVariant::String) {
-            u = QUrl(value.toString());
+            QString input(value.toString());
+            // Encoded dir-separators defeat QUrl processing - decode them first
+            input.replace(QLatin1String("%2f"), QLatin1String("/"), Qt::CaseInsensitive);
+            u = QUrl(input);
             found = true;
         }
 
diff --git a/src/qml/qml/v4/qv4bindings.cpp b/src/qml/qml/v4/qv4bindings.cpp
index ff16f3b95b..7d42b47d53 100644
--- a/src/qml/qml/v4/qv4bindings.cpp
+++ b/src/qml/qml/v4/qv4bindings.cpp
@@ -1296,7 +1296,9 @@ void QV4Bindings::run(int instrIndex, quint32 &executedBlocks,
         if (src.isUndefined()) {
             output.setUndefined();
         } else {
-            const QString tmp(*src.getstringptr());
+            QString tmp(*src.getstringptr());
+            // Encoded dir-separators defeat QUrl processing - decode them first
+            tmp.replace(QLatin1String("%2f"), QLatin1String("/"), Qt::CaseInsensitive);
             if (instr->unaryop.src == instr->unaryop.output) {
                 output.cleanupString();
                 MARK_CLEAN_REGISTER(instr->unaryop.output);
@@ -1326,7 +1328,7 @@ void QV4Bindings::run(int instrIndex, quint32 &executedBlocks,
             COLOR_REGISTER(instr->unaryop.output);
         }
     }
-    QML_V4_END_INSTR(ConvertStringToUrl, unaryop)
+    QML_V4_END_INSTR(ConvertStringToColor, unaryop)
 
     QML_V4_BEGIN_INSTR(ConvertStringToVariant, unaryop)
     {