Thu 10 Mar 2011 08:19:07 PM UTC, original submission:
In the event, that someone sends a malformed name/value pair, Cgicc (IMHO) is not handling it nicely. This was introduced in 3.2.4 following the optimization of cgicc::Cgicc::parseFormInput().
If the NV pairs are perfect, there is no problem. In the event that someone does '?a=b&&c=d', parseFormInput generates ...
name = 'a', value = 'b'
name = '&c', value = 'd'
The supplied patch "fixes" this, as '&' is always supposed to be a sub delimiter, and reproduces the behavior as originally coded, and as seen in CGI.pm. The extra '&' gets dropped in this case, and the name becomes 'c'
After applying my patch, the name/value pairs in the following string ...
"&begin=1&normal=ok&&doubleamp=1&empty=&empty&two=2&&&&&last==ok"
Results in ...
[begin] [1]
[normal] [ok]
[doubleamp] [1]
[empty] []
[ampempty] []
[two] [2]
[last] [=ok]
This mimics CGI.pm which is the "outside" test I used as a common point of reference.
|