4 ms·
The bit about the semicolon separator was new to me. Are there many web services using the semicolon to send parameters? In any case, it seems that the real bu
by STRML 12y ago
The bit about the semicolon separator was new to me. Are there many web services using the semicolon to send parameters?
In any case, it seems that the real bug is that browsers don't properly recognize `;` as a separator and can derive the resource name from what comes after. That's definitely a problem; it would be crazy if, for example, you could craft a querystring ending with "&/file.bat" and the browser would parse it as a file download.
- al2o3cr 12y agoParameters I'm not sure, but there was a hot minute back before Rails 2.0 shipped where it was using them: https://github.com/rails/rails/commit/0cac2806a6fd9f1f63cdce8d3fd1e86cefb22c1f https://github.com/rails/rails/commit/0cac2806a6fd9f1f63cdce... That 2007 commit rolled back to just using slashes.
- jfindley 12y agoI'm sure there's some sites, but even if the percentage is in the low single digits (i.e. a smallish but still very significant percentage), I still think that browsers is probably the right place for this to be fixed. Getting everyone to go through every part of their app and properly harden up their url routing to protect against this seems unlikely to happen - it's simply too much work for many companies.