Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Kerodon incorrectly uses query-string when submitting form #54

Open
jeroenvandijk opened this issue Jun 20, 2022 · 1 comment
Open

Kerodon incorrectly uses query-string when submitting form #54

jeroenvandijk opened this issue Jun 20, 2022 · 1 comment

Comments

@jeroenvandijk
Copy link

When we (press "save") on this form:

<form action="/myform?email=hi>
  <input hidden="email" value="hello"/>
  <input type="submit" value="save"/>
</form>

Kerodon will wrongly reuse the query string resulting in a request path of /myform?email=hi&email=hello. This is inconsistent with the behaviour I see in my browser (latest chrome). Kerodon is also wrong according to specifications mentioned here [1].

This problem surfaces when the parameters are parsed with ring.middleware.params/wrap-params this results in {"email" ["hi" "hello"]} instead of {"email" "hello"}.

[1] https://stackoverflow.com/questions/1116019/when-submitting-a-get-form-the-query-string-is-removed-from-the-action-url/9882750#9882750

@jeroenvandijk
Copy link
Author

It seems that #45, from 2016, is claiming the opposite. Not sure where this is coming from, the link and specification I was referring to is already from 2009.

@ayato-p do you happen to remember your particular situation?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant