bugcgicc - Bugs: bug #36497, Form Variable Parsing Bug

 
 

bug #36497: Form Variable Parsing Bug

Submitted by:  None
Submitted on:  Sat 19 May 2012 02:10:12 AM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Sat 19 May 2012 02:10:12 AM UTC, original submission:

I googled this but was surprised to find no comments or fixes. Diff is
at the bottom.

W3C says the following at
http://www.w3.org/TR/1999/REC-html401-19991224/appendix/notes.html#h-B.2.2
We recommend that HTTP server implementors, and in particular, CGI
implementors support the use of ";" in place of "&" to save authors
the trouble of escaping "&" characters in this manner.

The fix below is very simple. It does permit then separation using
either a ; or a & which in my mind isn't very neat but proper URI
encoding requires that any form names or values containing ';' or '&'
be encoded to their % equivalent anyway.

--- Cgicc.cpp 2012-03-04 00:03:35.000000000 -0500
+++ Cgicc.cpp.bak 2012-03-04 00:02:11.000000000 -0500
@@ -365,12 +365,12 @@

// Decode the name
name = form_urldecode(data.substr(oldPos, pos - oldPos));
oldPos = ++pos;

- // Find the '&' OR ';' separating subsequent name/value pairs
- pos = data.find_first_of(";&", oldPos);
+ // Find the '&' separating subsequent name/value pairs
+ pos = data.find_first_of('&', oldPos);

// Even if an '&' wasn't found the rest of the string is a value
value = form_urldecode(data.substr(oldPos, pos - oldPos));

// Store the pair

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

No files currently attached

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follows 1 latest change.

Date Changed By Updated Field Previous Value => Replaced By
Sat 12 Jan 2013 11:12:07 AM UTCsebdiazOpen/ClosedOpen=>Closed

Back to the top


Powered by Savane 3.1-cleanup