You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Fix Encoder.getCanonicalizedURI(URI) for the test case of a double-ampersand in the HTML Query #826
Discovered bug where %2C&html=&& should throw a MixedEncodingException but instead constructs a URL sequence of ,&html=null&=null&
Note that this does not result in an exploitable URL string, the & is never decoded. It's also debatable whether this is a false negative.
It's possible that this bug might be acceptable, it isn't clear as per RFC what the correct behavior should be in this circumstance. (double-ampersand) However, there's some possible nuance and a possible false negative implied here and it's unclear what the correct path should be.
changed the title [-]Fix Encoder.getCanonicalizedURI(UR) for the test case of a double-ampersand in the HTML Query[/-][+]Fix Encoder.getCanonicalizedURI(URI) for the test case of a double-ampersand in the HTML Query[/+]on Jan 24, 2024
Activity
[-]Fix Encoder.getCanonicalizedURI(UR) for the test case of a double-ampersand in the HTML Query[/-][+]Fix Encoder.getCanonicalizedURI(URI) for the test case of a double-ampersand in the HTML Query[/+]kwwall commentedon May 27, 2024
Closed via PR #828.