Hacker News new | past | comments | ask | show | jobs | submit login

The bit about the semicolon separator was new to me. Are there many web services using the semicolon to send parameters?

In any case, it seems that the real bug is that browsers don't properly recognize `;` as a separator and can derive the resource name from what comes after. That's definitely a problem; it would be crazy if, for example, you could craft a querystring ending with "&/file.bat" and the browser would parse it as a file download.




Parameters I'm not sure, but there was a hot minute back before Rails 2.0 shipped where it was using them:

https://github.com/rails/rails/commit/0cac2806a6fd9f1f63cdce...

That 2007 commit rolled back to just using slashes.


I'm sure there's some sites, but even if the percentage is in the low single digits (i.e. a smallish but still very significant percentage), I still think that browsers is probably the right place for this to be fixed.

Getting everyone to go through every part of their app and properly harden up their url routing to protect against this seems unlikely to happen - it's simply too much work for many companies.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: