Lindens prevent escape

Keiko Rau and I have finally found why her servers are broken. The answer is simple really. The servers running on the 1.19 update (specifically Second Life Server 1.19.0.79086) have a bug in the llEscapeURL method.


Originally, this method should be escaping any character that is not a-z, A-Z, or 0-9. This makes the other characters safe to send back and forth to other web serves on the internet. When you escape a character, it is tranlated into its hexadecimal equivilent. For example, a plus sign becomes %2B (hex is 0×2B, decimal is 43).


Keiko Rau was only affected by one character. The equal sign. She had url encoded a base64 string and then created a hash on it. The hash didn’t match what her server expected because those values are automatically url decoded on her web server (except the now non-encoded equal signs). I am not sure of the exact details, but the encoding was the heart of the matter.


I created a script to discover the extent of the problem. I simply looped through 0 to 255 and recorded the corresponding ascii character value in a list. I then hopped on over to a 1.18 havok sim and compared the values. A list of values were spit out of what didn’t match.