crystal icon indicating copy to clipboard operation
crystal copied to clipboard

Redirects in `HTTP::StaticFileHandler` does not preserve a request's query parameters

Open syeopite opened this issue 6 months ago • 2 comments

To be honest I'm not actually sure about the validity of this issue because triggering it generally requires a malformed request.

When a server has HTTP::StaticFileHandler within its handler chain any request that has double slashes will get redirected to a normalized path with only single slashes. But this redirect also removes any query parameters.

So when requesting a server that has HTTP::StaticFileHandler like so:

http://localhost:12345//route?k=v

the user will get redirected to

http://localhost:12345/route

And the loss of the query parameters can mean a change in functionality within the handlers in the handler chain after the redirect.

I originally discovered this on Crystal version 1.16.0 but the problem still exists in 1.17.0-dev after the refactor to the handler.

syeopite avatar May 17 '25 11:05 syeopite

Another use case than other handlers is client-side code which may use URL-parameters, even for statically served files.

it generally requires a malformed request.

Could you elaborate on that? Why is the request considered malformed? As far as I can see, this applies to completely valid requests.

straight-shoota avatar May 17 '25 12:05 straight-shoota

Why is the request considered malformed?

Just an incorrect statement on my part.

I didn't know any other way to produce this issue and I was under the assumption that double slash paths aren't considered to be valid syntax but apparently they actually are.

syeopite avatar May 17 '25 13:05 syeopite