iOS GCM: CIQ settings do not accept the text "alert"( and "%20" is URL-decoded

Related: https://forums.garmin.com/forum/deve...and-characters

Environment
iOS 10.3.3 (iPhone)
Garmin Connect Mobile: 3.22.4.1

Description
Entering certain text in CIQ app settings (string properties) causes unexpected behaviour. As far as I know, it doesn't matter which CIQ app you use, as long as it has a string setting.

NOTE: Because this forum seems to have a similar problem to iOS GCM, please ignore the quotes in"alert"( for this bug report to make sense.

Case A: "alert"(
If you enter "alert"( in a string field and attempt to save settings, you will be presented with an "Access Denied" error page. This is perhaps related to the fact that "alert"() is a function in javascript, although other javascript functions or reserved keywords don't seem to trigger this behaviour. Placing any number of spaces between the "t" and "(" does not mitigate this problem.

Case B: Text such as "%20" is inappropriately URL decoded
e.g.
1) Enter "hello%20world" in a string field (without quotes, not that it should make a difference)
2) Save settings
3) Open settings again
Actual behaviour: string field contains "hello world"
Expected behaviour: string field contains "hello%20world"

This is clearly related to the bug linked above where a stray "%" will cause settings to be displayed with default values on the next load.

Clearly there is an issue with URL encoding and decoding of app settings transferred via HTTP. e.g. Perhaps settings are never encoded on send, but always decoded on receive, or something like that.

App to use for re-creation:
Training Notes:
https://apps.garmin.com/en-GB/apps/e...9-fe49891d7e76

Any one of the "Line" fields, which are strings, will exhibit the behaviour described above.

Former Member over 9 years ago

Hey,

I've been working on this and the linked issue a bit more today. I've been testing with the same setup with the exception of my version of iOS being 10.3.2. I am upgrading to 11.03 to see if there was a change in 10.3.3 and above that is causing the issue. I cannot reproduce Case A, but I can reproduce Case B. I'm opening a ticket for this, but I'm not sure if it's intended behavior or not.

Thanks,
-Coleman

flowstate over 9 years ago

Hey, thanks for getting back so quickly!

Well, I don't see how Case B could be intended behaviour, because it prevents people from using strings that have "%" in them (same as the related problem in the linked non-con). Imagine simple training notes such as:

"Run at 80% Max HR"
"70% effort"

It's not the specific case of "%20" turning into a space that bothers me, it's the fact that I would expect all text that's entered as a string setting to be preserved, unless it's explicitly forbidden. And if it's explicitly forbidden, there should be an error message that explicitly addresses why, IMO. IMO it looks like there's just some unintentional issues with URL decoding and encoding. Especially because the problems with "+" and "<"/">" are reportedly only happening on iOS and not Android.

It's almost like saying you can't use "%" in gmail because "%" is a reserved character for URLs.

Case A is a problem for my app (which parses math formulas), because ALERT is one of my functions. I've had a user ask for support because they're unable to use that function.

I attached some screenshots with repro for case A, with Training Notes. See Line 1:

ALE RT(

(remove the space between ALE and RT, because the forum doesn't like "ALERT" followed by "(" either)

It also happens with my own app, AppBuilder. I'm sure any app with string settings will be affected.

https://apps.garmin.com/en-NZ/apps/d...a-9b8485d2fc80 community.garmin.com/.../1266802.png

flowstate over 9 years ago

I will say that something has def changed, because I used to type "ALERT" (followed by open parenthesis) all the time in my app settings, using iOS.

Former Member over 8 years ago

FlowState,

I wanted to let you know that this one is being worked on right now. It was a little bigger and multifaceted than we thought it was going to be, but I wanted to give you an update and let you know that we are close to a fix. Once it's confirmed that case B has been fixed, we will make sure to let you know, but you will still need wait for it to be released in GCM.

Thanks,
- Coleman

Horsetooth over 8 years ago

Any updates on this? I'm seeing access denied when trying to enter URLs into String settiings. I had changed the setting from url to string for another issue (maybe with Garmin Express), so i don't want to change it back. It works fine on android, just not iOS.

Former Member over 8 years ago

Hey Horsetooth,

I am not having this issue, but it may be that I'm using a Beta version of GCMiOS. My understanding is that the fix ended up being on the App Store side of things and should generally be fixed without updating, but there may have been some small pieces there too as I'm not as familiar with their set of code. I've verified that I am not getting any errors when saving ALERT( or a URL as a string. Do you want to double check for me or maybe give me the specific URL you are getting this with?

Thanks,
- Coleman

Horsetooth over 8 years ago

Hey Horsetooth,
Do you want to double check for me or maybe give me the specific URL you are getting this with?

Hi Coleman, in this app, https://apps.garmin.com/en-US/apps/8ea31125-3ceb-4937-941c-3e25fcd87ad3, under the setting "Offline (local uploader) URL", enter: http://127.0.0.1:1979

mine & a user's iOS devices won't take that, they go to the ACCESS DENIED settings message...

Former Member over 8 years ago

Okay. I've tried the linked app with the suggested settings on both the Beta I was testing and the current production release on iOS and I'm still not reproducing...this is a head scratcher. Anything unique about your setup? Common iOS version between you and the user? etc.

Horsetooth over 8 years ago

Okay. I've tried the linked app with the suggested settings on both the Beta I was testing and the current production release on iOS and I'm still not reproducing...this is a head scratcher. Anything unique about your setup? Common iOS version between you and the user? etc.

I'm using iOS 10.3.3 on an iPhone 5C (I don't have anything more recent) with Garmin Connect 4.6 and a Forerunner 235.
I'll check with the user to see what versions/models he's using.

Horsetooth over 8 years ago

and the user with the Access Denied settings issue was using IOS version 11.3.1 on an iPhone 8 and Garmin Connect version 4.6.0.18 with a fenix5.

It may help to type something else into the Offline URL field first (such as "spike") and save it, and then go back and try to change it to http://127.0.0.1:1979