Skip to content

Fix Encoder.getCanonicalizedURI(URI) for the test case of a double-ampersand in the HTML Query #826

@xeno6696

Description

@xeno6696

Per Issue #824

Discovered bug where %2C&html=&& should throw a MixedEncodingException but instead constructs a URL sequence of ,&html=null&=null&

Note that this does not result in an exploitable URL string, the & is never decoded. It's also debatable whether this is a false negative.

It's possible that this bug might be acceptable, it isn't clear as per RFC what the correct behavior should be in this circumstance. (double-ampersand) However, there's some possible nuance and a possible false negative implied here and it's unclear what the correct path should be.

@kwwall @jeremiahjstacey

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions