3 ms·
I wondered why this bug wouldn't raise itself as a data corruption problem, where url parameter keys or values had a semicolon in them on purpose, which would t
by tyingq 5y ago
I wondered why this bug wouldn't raise itself as a data corruption problem, where url parameter keys or values had a semicolon in them on purpose, which would then corrupt the data.
It seems it's because you're supposed to encode semicolons. So while urllib.parse is doing the wrong thing, it doesn't come up much in practice because urllib.parse.urlencode() encodes the semi-colon as %3B.
- uranusjr 5y agoFurthermore, urlparse is almost always the wrong choice for the job. It parses path parameters (not to be confused with IRL parameters aka query string), which is why it splits in semicolon in the first place, an obsolete practice that I don’t even remember when’s the last time I found make sense. urlsplit is both more correct and does not have the bug/vulnerability to begin with.