Automattic / Automattic/wp-super-cache

Single quote path is cached incorrectly

Open
#962 0 comments 0 reactions 0 assignees View on GitHub
[Plugin] Super Cache bug
Dominant language
PHP
Stars
436
Forks
130
Avg merge
15h 11m
Merged PRs (30d)
10

Description

We came across a bug in our cache where someone typed `http://example.com/'` instead of `http://example.com/` for the first hit after a fresh install. That page is (supposed to be) a 404, but for some reason it got cached, and it got cached as `/index.html`. When the user changed from `/'` to `/` they were served the cached page in place of the correct content.

This seems to be special to the single quote character. I tried to repro with double quote, pipe, pre-escaped values, etc. and everything was escaped (e.g. `" => %22`) as expected. Bare question mark was stripped and cached as the base page, as I would expect.

I haven't had a chance to set up a limited test case to repro, and unfortunately I can't share our configuration - but I can try any patch, logging or configuration change that you suggest. I was looking at https://github.com/Automattic/wp-super-cache/commit/617deac2628915761e8928f4d336ed4cffb71ee0 and https://github.com/Automattic/wp-super-cache/commit/4d0f06e119f0b579a9a730bbb16bb9bf35346e1d with the hope that those would be the problem, but unfortunately it does repro for us under 1.4.5.

I did "fix" the problem by adding `"'"` to the `auto_rejected` array in [wp-cache-phase2.php](https://github.com/Automattic/wp-super-cache/blob/master/wp-cache-phase2.php#L141), but A) that's certainly not the correct place to fix this, B) I'm hoping that this is a known problem for something stupid I'm doing in the config, and C) it might be an actual bug that others might encounter.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.