dotnet / dotnet/aspnetcore

Blazor WASM: change way querystring parameters are generated for arrays

Open
#54,154 2 comments 0 reactions 0 assignees View on GitHub
area-blazor
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 10h
Merged PRs (30d)
281

Description

### Is there an existing issue for this?

- [X] I have searched the existing issues

### Is your feature request related to a problem? Please describe the problem.

Hello guys.

Currently, you can use the `GetUriWithQueyStringParameters` method to get an uri with querystring parameters that is populated with new values while keeping others which don't need to change. The only thing that I'd like to see improved is the way arrays are added to the querystring. Today, if you pass an array, you'll get an url in the form `?arr=option1&arr=option2...` which seems to be the most popular way to pass an array though querystring parameters. The problem with this approach is that many firewalls thed to consider this an attack ([Http Parameter Pollution](https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/04-Testing_for_HTTP_Parameter_Pollution)) even when the duplication happens at the queryparameter level.

### Describe the solution you'd like

Besides this syntax, Web API apps have been able to handle querystring parameters with a slightly different syntax ( ex.: `?arr[0]=option1&arr[1]=options2...`) without any issues for years. Can this behavior be extended to the `GetUriWithQueryStringParameters` method instead of using the current default approach?

Thanks.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.