Hyphen in shortCode breaks PATCH via API

[mitchellkellett]

How Shlink is set up

• Shlink Version: 3.5.3
• PHP Version: 8.1
• How do you serve Shlink: Self-hosted Apache
• Database engine used: MariaDB

Summary

When you generate a shortcode that has a hyphen in it, you cannot use PATCH to update it via the API.

Current behavior

Receiving error saying Short URL not found.

Expected behavior

Expecting to be able to update the existing link that has been created.

How to reproduce

1. Create a shortened URL. Specify the slug to include a hyphen. (eg, INV-1234)
2. Make a PATCH request to update any attribute of the link.
   https://links.website.app/rest/v3/short-urls/INV-1234

{
  "longUrl": "https://accounting.website.app/invoices/INV-1234/pdf",
  "title": "Invoice # 1234",
  "customSlug": "INV-1234",

}

3. Receive error.

{
    "shortCode": "INV-1234",
    "title": "Short URL not found",
    "type": "https://shlink.io/api/error/short-url-not-found",
    "status": 404,
    "detail": "No URL found with short code \"INV-1234\""
}

[acelaya]

I see some possible reasons for this:

• Apache is not properly configured, making it forward incorrect URL info to Shlink.
• The short URL does not belong to the default domain, in which case you need to provide the domain as query param to the PATCH request.
• The API key used in the PATCH request does not have permissions to edit that specific short URL

[mitchellkellett]

Thanks for replying @acelaya.

I can rule out 2 and 3 as it’s using the default domain with the initial API key.

I’ve also tested this with a basic pho echo and Apache is getting the correct URL. If I make the short URL without the hyphen it works. So I can confirm it’s definitely hyphen related.

I’m running out of other things to fault. Any other ideas? Are you able to replicate this issue?

[acelaya]

I have been testing this using apache, and also other runtimes, like openswoole and roadrunner. I could not reproduce this in any case.

There's also a handful of E2E and unit tests covering this scenario, not counting that it is a heavily used one, so I doubt it's not working in normal circumstances.

Can you provide the exact POST and PATCH requests you did to create and edit the short URL?

Also, could you try to provide a failing test? These are good starting points:

• https://github.com/shlinkio/shlink/blob/e80b7448f5436ec4c1e98474d3b92745e127cb82/module/Rest/test-api/Action/EditShortUrlTest.php
• https://github.com/shlinkio/shlink/blob/develop/module/Core/test/ShortUrl/ShortUrlServiceTest.php

[mitchellkellett]

POST Request

curl --location --request PATCH 'https://links.website.app/rest/v3/short-urls/INV-1234?domain=support.website.app' \
--header 'X-Api-Key: 00000000-0000-0000-0000-000000000000' \
--header 'Content-Type: application/json' \
--data '{
  "longUrl": "https://support.atlassian.net/servicedesk/customer/portal/2/PG-347",
  "title": "Testing",
  "customSlug": "PG-347",
  "domain": "support.website.app"
}'

Response

{
    "shortCode": "PG-347",
    "shortUrl": "https://support.website.app/PG-347",
    "longUrl": "https://support.atlassian.net/servicedesk/customer/portal/2/PG-347",
    "deviceLongUrls": {
        "android": null,
        "ios": null,
        "desktop": null
    },
    "dateCreated": "2023-05-02T06:53:17+00:00",
    "tags": [],
    "meta": {
        "validSince": null,
        "validUntil": null,
        "maxVisits": null
    },
    "domain": "support.website.app",
    "title": "Testing",
    "crawlable": false,
    "forwardQuery": true,
    "visitsSummary": {
        "total": 0,
        "nonBots": 0,
        "bots": 0
    },
    "visitsCount": 0
}

PATCH Request

curl --location --request PATCH 'https://links.website.app/rest/v3/short-urls/PG-347?domain=support.website.app' \
--header 'X-Api-Key: 00000000-0000-0000-0000-000000000000' \
--header 'Content-Type: application/json' \
--data '{
  "longUrl": "https://support.atlassian.net/servicedesk/customer/portal/2/PG-347",
  "title": "Testing Changing the Title",
  "customSlug": "PG-347",
  "domain": "support.website.app"
}'

For good measure, I also tried without including the domain in the body.

curl --location --request PATCH 'https://links.website.app/rest/v3/short-urls/PG-347?domain=support.website.app' \
--header 'X-Api-Key: 00000000-0000-0000-0000-000000000000' \
--header 'Content-Type: application/json' \
--data '{
  "longUrl": "https://support.atlassian.net/servicedesk/customer/portal/2/PG-347",
  "title": "Testing Changing the Title",
  "customSlug": "PG-347"
}'

Response

{
    "shortCode": "PG-347",
    "domain": "support.website.app",
    "title": "Short URL not found",
    "type": "https://shlink.io/api/error/short-url-not-found",
    "status": 404,
    "detail": "No URL found with short code \"PG-347\" for domain \"support.website.app\""
}

I'll work on getting a failing test as well but thought this would be a good starting point.

[acelaya]

I see you are explicitly providing a domain during the short URL creation (POST), and since the response includes it in the domain field instead of null, it means that is not the default domain (the one provided during shlink-installer install or via DEFAULT_DOMAIN env var.

That is the reason of the 404 during the PATCH request. You need to provide the domain as query param there as well.