router
router copied to clipboard
Adds a test to demonstrate encoded path matching
This is a copy / tweak of existing tests and demonstrates that router routes things that are URL encoded.
At least one of our frontend apps is not built to handle URL encoded paths and errors under some circumstances. A sort of fix has been implemented for collections.
Should we "fix" router to not behave like this?
Related stack overflows are seem inconclusive - for example Apache allows you to toggle a setting to allow / disallow this.
- https://stackoverflow.com/questions/3235219/urlencoded-forward-slash-is-breaking-url
- https://stackoverflow.com/questions/1957115/is-a-slash-equivalent-to-an-encoded-slash-2f-in-the-path-portion-of-a?
Hmm interesting. Sounds like the current behaviour has potential for request smuggling shenaningans (but I've spent like 30 s thinking about it so not making any claims here!)