Consider disabling ;-separated query parameters by default
Nobody has claimed this yet.
- Dominant language
- Racket
- Stars
- 99
- Forks
- 48
- PR merge metrics
- No merged PRs in 30d
Description
Recently, people have pointed out that the combination of common caching proxies and web frameworks that treat ; as a query separator can lead to security problems; see here: https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
This led Python to change the default behavior: https://bugs.python.org/issue42967
See also this article: https://lwn.net/Articles/846847/
We have a few choices here:
- Do nothing (probably a bad idea)
- Enable users of the web server to disable
;as a separator. - Like 2, but make that the default. (This is what Python did)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file, test, or entry point is named. Start by reviewing how the web server parses query parameters and the cited Python, Snyk, and LWN references; done requires an agreed choice among the three proposed behaviors and corresponding implementation coverage.
Written by the indexing model from the issue text.
Assessment
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100