Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Sanitization of target URL not working correctly #7

Open
aKacharava opened this issue Dec 3, 2021 · 0 comments
Open

Sanitization of target URL not working correctly #7

aKacharava opened this issue Dec 3, 2021 · 0 comments
Labels

Comments

@aKacharava
Copy link

aKacharava commented Dec 3, 2021

When a URL is parsed, some characters, like ( , ; etc. are internally converted to -. If a page exists for the --ed version of the URL, that page will be shown.

For example, when visiting the URL https://example.com/about-us/, instead of typing /about-us/ you can type different special characters in between "about" and "us" and still visit the page:

  • /about(us/
  • /about)us/
  • /about,us/
  • /about;us/
  • etc.

This is caused by the sanitizing function that is called on the target URL. I think this is incorrect and should be changed.

https://github.com/SimplyEdit/simply-edit-backend/blob/90855886c71d5f9d9a6c8c1e7cd95185964cbab2/www/simply-edit/http.php#L92

@Potherca Potherca added the bug label Dec 3, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

2 participants