router icon indicating copy to clipboard operation
router copied to clipboard

Adds a test to demonstrate encoded path matching

Open sihugh opened this issue 4 years ago • 1 comments

This is a copy / tweak of existing tests and demonstrates that router routes things that are URL encoded.

At least one of our frontend apps is not built to handle URL encoded paths and errors under some circumstances. A sort of fix has been implemented for collections.

Should we "fix" router to not behave like this?

Related stack overflows are seem inconclusive - for example Apache allows you to toggle a setting to allow / disallow this.

  • https://stackoverflow.com/questions/3235219/urlencoded-forward-slash-is-breaking-url
  • https://stackoverflow.com/questions/1957115/is-a-slash-equivalent-to-an-encoded-slash-2f-in-the-path-portion-of-a?

sihugh avatar Mar 04 '20 17:03 sihugh

Hmm interesting. Sounds like the current behaviour has potential for request smuggling shenaningans (but I've spent like 30 s thinking about it so not making any claims here!)

sengi avatar May 09 '24 11:05 sengi