You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Discovered bug where %2C&html=&& should throw a MixedEncodingException but instead constructs a URL sequence of ,&html=null&=null&
Note that this does not result in an exploitable URL string, the & is never decoded. It's also debatable whether this is a false negative.
It's possible that this bug might be acceptable, it isn't clear as per RFC what the correct behavior should be in this circumstance. (double-ampersand) However, there's some possible nuance and a possible false negative implied here and it's unclear what the correct path should be.
xeno6696
changed the title
Fix Encoder.getCanonicalizedURI(UR) for the test case of a double-ampersand in the HTML Query
Fix Encoder.getCanonicalizedURI(URI) for the test case of a double-ampersand in the HTML Query
Jan 24, 2024
Per Issue #824
Discovered bug where
%2C&html=&&
should throw a MixedEncodingException but instead constructs a URL sequence of,&html=null&=null&
Note that this does not result in an exploitable URL string, the
&
is never decoded. It's also debatable whether this is a false negative.It's possible that this bug might be acceptable, it isn't clear as per RFC what the correct behavior should be in this circumstance. (double-ampersand) However, there's some possible nuance and a possible false negative implied here and it's unclear what the correct path should be.
@kwwall @jeremiahjstacey
The text was updated successfully, but these errors were encountered: