Submitting using curl

wulfram · 06-24-2011, 11:45 AM

I am writing a script that is used to submit a package to testflight from my build system. In order to make the presentation as clear as possible I would like to include some basic HTML in the note section, however, using a < or > causes an error in curl. I have tried different variations of quoting and escaping but have not yet been able to find the solution.

Code:

VERSION_HEADER='<strong>Version: </strong>'
VERSION=`cat $VERSION_NUMBER_FILE`
NOTES+=( "$VERSION_HEADER$VERSION\n" )
NOTES+=${CHANGESET[@]}

curl -v http://testflightapp.com/api/builds.xml -F file="@$PWD/$FILE_TO_UPLOAD"  -F api_token=$API_TOKEN -F team_token=$TEAM_TOKEN -F notes="`echo ${NOTES[@]}`" -F notify=True -F distribution_lists='Testers'

Using the above I get:

Code:

curl: (26) failed creating formpost data

If I use a \ to escape the < and > then the curl passes but the submission is \< and \> which is not well formatted html.

If I use VERSION_HEADER="'<strong>Version: </strong>'" then the single quotes are submitted.

If I use < or > then those are submitted but the receiving api does not decode them correctly.

Can anyone suggest a way to submit exactly:
<strong>Version: </strong>

audriusk · 06-24-2011, 12:34 PM

You need to URL-encode your data before submitting it. It would look like this (using Python in example):

Code:

>>> import urllib
>>> print urllib.quote('<strong>foo</strong>')
%3Cstrong%3Efoo%3C/strong%3E

curl has --data-urlencode option, although I'm not sure if it can be used like -F.

ntubski · 06-24-2011, 12:46 PM

From the cURL manual:

Code:

  To send a field value literally without interpreting a leading '@'
  or '<', or an embedded ';type=', use --form-string instead of
  -F. This is recommended when the value is obtained from a user or
  some other unpredictable source. Under these circumstances, using
  -F instead of --form-string would allow a user to trick curl into
  uploading a file.

Also, you can use "${NOTES[*]}" instead of "`echo ${NOTES[@]}`".

wulfram · 06-24-2011, 02:56 PM

Thanks very much. The --form-string works exactly as I need it.