humanmade / humanmade/altis-cms

Marlformed query strings can cause infinate redirects

Open
#541 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
PHP
Stars
46
Forks
4
Avg merge
14h 31m
Merged PRs (30d)
13

Description

This is quite similar to https://github.com/humanmade/altis-cms/issues/302 from what I can see.

Steps to reproduce:
1. Set your front-page to a page in WP settings
2. Make sure batcache is enabled
3. Request `https://yoursite.com/?=123`
4. Observe redirect_canonical should redirect to `https://yoursite.com/`
5. Try to request `https://yoursite.com/`
6. Observe an infinite redirect to `https://yoursite.com/`

When the query string is "malformed", specifically in this case, it's an empty `key` in `?=123` (no key, value of 123). In these situations `$_GET` is `[]`, but `$_SERVER['QUERY_STRING']` is `=123`. And, `parse_url` will be ` ["query"]=> string(4) "=123"`

As you can maybe imagine, this causes issues when the assumption is the query / URL can be re-built from $_GET. One place that makes this assumption is Batcache. Effectively the cache will be stored as if there were no query params (see https://github.com/humanmade/batcache/blob/master/advanced-cache.php#L555, ` parse_str('=123', $result ) === []`).

As `redirect_canonical` will do a 301 redirect, that redirect will get stored in Batcache _against the homepage with no url params cache key_. Therefore, the homepage will infinite redirect.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.