12

I'm trying to get public profile information from LinkedIn. To achieve this I have to provide
http://api.linkedin.com/v1/people/url=public-profile-url, where public-profile-url MUST be URL encoded.

The issue is that .NET classes such as HttpClient, WebRequest etc use Uri class which seems to "canonize" the provided URL, so that I can't get the proper formatted request sent.

The URI must be:

http://api.linkedin.com/v1/people/url=http%3a%2f%2fwww.linkedin.com%2fin%2fiftachragoler

but is:

http://api.linkedin.com/v1/people/url=http://www.linkedin.com/in/iftachragoler

In this way, I get 'Bad Request' from LinkedIn.

Is there any way I can have Uri/UriBuilder not to decode that URL?

Cœur
  • 37,241
  • 25
  • 195
  • 267
Hennadii Omelchenko
  • 665
  • 8
  • 18
  • Are you doing something like `"http://api.linkedin.com/v1/people/url=" + uri.ToString()`? Then the URI class is doing exactly what it should do and you're doing it wrong. – dtb Jun 14 '12 at 13:52
  • Actually, I'm doing "http://api.linkedin.com/v1/people/url=" + Url.Encode(profileUrl), and then passing that to DotNetOpenAuth which itself passing it to UriBuilder. – Hennadii Omelchenko Jun 14 '12 at 13:55
  • 2
    There is no Url class in .NET. Please show the actual code you're using. – dtb Jun 14 '12 at 13:59
  • 1
    Sorry, my fault: var linkedInRequestUrls = string.Format(LinkedInRestApi.PeoplePersonByPublicUrl, HttpUtility.UrlEncode(url)) – Hennadii Omelchenko Jun 14 '12 at 14:09

2 Answers2

8

There is report about that on Microsoft connect. By default escaped slashes not allowed due to security reasons.

http://connect.microsoft.com/VisualStudio/feedback/details/94109/

Cites from there:

I try to use the LinkedIn api, for which I need the following link: http://api.linkedin.com/v1/people/url=http%3A%2F%2Fwww.linkedin.com%2Fin%2Fyourlinkedinname:public

As you can see the url field needs to be escaped. How to solve this?

Answer:

We currently don't allow escaped slashes and dots to appear in the path because this is a common way to attacker a server when the URI scheme supports path compression.

But there is tab with workarounds. One of them for .NET 4 is to add app.config:

For .NET 4.0, you can control this through the config file:

http://msdn.microsoft.com/en-us/library/bb882619.aspx

http://msdn.microsoft.com/en-us/library/ee656539.aspx

<configuration>
<uri>
    <schemeSettings>
     <clear/>
     <add name="http" genericUriParserOptions="DontUnescapePathDotsAndSlashes"/>
    </schemeSettings>
</uri>
</configuration>

For .NETs before .NET was constructor for Uri class with parameter "dontEscape". For .NET 4 it's obsolete.

Regfor
  • 8,515
  • 1
  • 38
  • 51
0

What happens if you double escape it?

http://api.linkedin.com/v1/people/url=http%253a%252f%252fwww.linkedin.com%252fin%252fiftachragoler
ICR
  • 13,896
  • 4
  • 50
  • 78