Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Encoder.getCanonicalizedURI(URI) for the test case of a double-ampersand in the HTML Query #826

Closed
xeno6696 opened this issue Jan 23, 2024 · 1 comment
Labels

Comments

@xeno6696
Copy link
Collaborator

Per Issue #824

Discovered bug where %2C&html=&& should throw a MixedEncodingException but instead constructs a URL sequence of ,&html=null&=null&

Note that this does not result in an exploitable URL string, the & is never decoded. It's also debatable whether this is a false negative.

It's possible that this bug might be acceptable, it isn't clear as per RFC what the correct behavior should be in this circumstance. (double-ampersand) However, there's some possible nuance and a possible false negative implied here and it's unclear what the correct path should be.

@kwwall @jeremiahjstacey

@xeno6696 xeno6696 added the bug label Jan 23, 2024
@xeno6696 xeno6696 changed the title Fix Encoder.getCanonicalizedURI(UR) for the test case of a double-ampersand in the HTML Query Fix Encoder.getCanonicalizedURI(URI) for the test case of a double-ampersand in the HTML Query Jan 24, 2024
@kwwall
Copy link
Contributor

kwwall commented May 27, 2024

Closed via PR #828.

@kwwall kwwall closed this as completed May 27, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants