-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Issue #11579 - Reject Target in Request Path #11580
Conversation
@joakime status? |
I haven't look at this in a while, since we moved it here from PR #11496 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This is a placeholder review waiting for progress on this. Please request re-review when it is ready.
rebase against 12.1.x |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Let me have a go at this from the compliance end of things...
if (last != null && state.ordinal() > last.ordinal()) | ||
throw new IllegalArgumentException("uri cannot go beyond " + last); | ||
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I don't think we should not parse past the fragment etc. We should parse to the end, but record a violation if there is a fragment.
Closing in favor of PR #12504 |
Initial implementation of rejecting a URI Target in the Request Path.