Skip to content

Commit 6af5f92

Browse files
committed
Fix semicolons as separators for GET
Fix to use semicolons as separators for GET not for POST A semicolon ';' should be used as a separator according to a W3.org recommendation http://www.w3.org/TR/1999/REC-html401-19991224/appendix/notes.html#h-B.2.2 The following commit was for only POST not for GET, but the test is written for GET, which is kind of a discrepancy. Do not truncate POST data on `;`, closes #543 71c6911
1 parent dfda3a5 commit 6af5f92

File tree

2 files changed

+21
-10
lines changed

2 files changed

+21
-10
lines changed

lib/rack/request.rb

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -188,7 +188,7 @@ def GET
188188
if @env["rack.request.query_string"] == query_string
189189
@env["rack.request.query_hash"]
190190
else
191-
p = parse_query(query_string)
191+
p = parse_query(query_string, '&;')
192192
@env["rack.request.query_string"] = query_string
193193
@env["rack.request.query_hash"] = p
194194
end
@@ -212,7 +212,7 @@ def POST
212212
form_vars.slice!(-1) if form_vars[-1] == ?\0
213213

214214
@env["rack.request.form_vars"] = form_vars
215-
@env["rack.request.form_hash"] = parse_query(form_vars)
215+
@env["rack.request.form_hash"] = parse_query(form_vars, '&')
216216

217217
@env["rack.input"].rewind
218218
end
@@ -365,8 +365,8 @@ def reject_trusted_ip_addresses(ip_addresses)
365365
ip_addresses.reject { |ip| trusted_proxy?(ip) }
366366
end
367367

368-
def parse_query(qs)
369-
Utils.parse_nested_query(qs, '&')
368+
def parse_query(qs, d)
369+
Utils.parse_nested_query(qs, d)
370370
end
371371

372372
def parse_multipart(env)

test/spec_request.rb

Lines changed: 17 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -134,14 +134,25 @@
134134
req.params.should.equal "foo" => "bar", "quux" => "bla"
135135
end
136136

137-
should "not truncate query strings containing semi-colons #543" do
138-
req = Rack::Request.new(Rack::MockRequest.env_for("/?foo=bar&quux=b;la"))
139-
req.query_string.should.equal "foo=bar&quux=b;la"
140-
req.GET.should.equal "foo" => "bar", "quux" => "b;la"
141-
req.POST.should.be.empty
142-
req.params.should.equal "foo" => "bar", "quux" => "b;la"
137+
should "not truncate query strings containing semi-colons #543 only in POST" do
138+
mr = Rack::MockRequest.env_for("/",
139+
"REQUEST_METHOD" => 'POST',
140+
:input => "foo=bar&quux=b;la")
141+
req = Rack::Request.new mr
142+
req.query_string.should.equal ""
143+
req.GET.should.be.empty
144+
req.POST.should.equal "foo" => "bar", "quux" => "b;la"
145+
req.params.should.equal req.GET.merge(req.POST)
143146
end
144147

148+
should "use semi-colons as separators for query strings in GET" do
149+
req = Rack::Request.new(Rack::MockRequest.env_for("/?foo=bar&quux=b;la;wun=duh"))
150+
req.query_string.should.equal "foo=bar&quux=b;la;wun=duh"
151+
req.GET.should.equal "foo" => "bar", "quux" => "b", "la" => nil, "wun" => "duh"
152+
req.POST.should.be.empty
153+
req.params.should.equal "foo" => "bar", "quux" => "b", "la" => nil, "wun" => "duh"
154+
end
155+
145156
should "limit the keys from the GET query string" do
146157
env = Rack::MockRequest.env_for("/?foo=bar")
147158

0 commit comments

Comments
 (0)