crystal
crystal copied to clipboard
Redirects in `HTTP::StaticFileHandler` does not preserve a request's query parameters
To be honest I'm not actually sure about the validity of this issue because triggering it generally requires a malformed request.
When a server has HTTP::StaticFileHandler within its handler chain any request that has double slashes will get redirected to a normalized path with only single slashes. But this redirect also removes any query parameters.
So when requesting a server that has HTTP::StaticFileHandler like so:
http://localhost:12345//route?k=v
the user will get redirected to
http://localhost:12345/route
And the loss of the query parameters can mean a change in functionality within the handlers in the handler chain after the redirect.
I originally discovered this on Crystal version 1.16.0 but the problem still exists in 1.17.0-dev after the refactor to the handler.
Another use case than other handlers is client-side code which may use URL-parameters, even for statically served files.
it generally requires a malformed request.
Could you elaborate on that? Why is the request considered malformed? As far as I can see, this applies to completely valid requests.
Why is the request considered malformed?
Just an incorrect statement on my part.
I didn't know any other way to produce this issue and I was under the assumption that double slash paths aren't considered to be valid syntax but apparently they actually are.