Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

net/url: parseQuery() does not check for semicolon(;) in url #55018

Closed
zer0yu opened this issue Sep 12, 2022 · 2 comments
Closed

net/url: parseQuery() does not check for semicolon(;) in url #55018

zer0yu opened this issue Sep 12, 2022 · 2 comments
Labels
FrozenDueToAge

Comments

@zer0yu
Copy link

zer0yu commented Sep 12, 2022

What version of Go are you using (go version)?

$ go version
go version go1.18.5 darwin/amd64

Does this issue reproduce with the latest release?

yes

What operating system and processor architecture are you using (go env)?

go env Output
$ go env
GO111MODULE="on"
GOARCH="amd64"
GOBIN=""
GOCACHE="/Users/zero/Library/Caches/go-build"
GOENV="/Users/zero/Library/Application Support/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="darwin"
GOINSECURE=""
GOMODCACHE="/Users/zero/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="darwin"
GOPATH="/Users/zero/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/darwin_amd64"
GOVCS=""
GOVERSION="go1.18.5"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="clang"
CXX="clang++"
CGO_ENABLED="1"
GOMOD="/Users/zero/opt/uc/go.mod"
GOWORK=""
CGO_CFLAGS="-g -O2"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-g -O2"
CGO_FFLAGS="-g -O2"
CGO_LDFLAGS="-g -O2"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -arch x86_64 -m64 -pthread -fno-caret-diagnostics -Qunused-arguments -fmessage-length=0 -fdebug-prefix-map=/var/folders/89/6db44hqj2zgc46hbjm6bc5x40000gn/T/go-build4274838272=/tmp/go-build -gno-record-gcc-switches -fno-common"

What did you do?

What did you expect to see?

import (
	"net/url"
)

func main() {
line = "http://example.com/page.php?uid=2;123"
parsed, err := url.Parse(line)
fmt.Println(url.ParseQuery(parsed.RawQuery))
}

expect

map[uid:[2;123]]

but in fact

map[]

A nil value is returned when the query URL contains a semicolon(;) character

What did you see instead?

semicolon(;) character is parsed into the value of the dict
@narslan
Copy link

narslan commented Sep 12, 2022 •
edited

url.ParseQuery would throw the error invalid semicolon separator in query if it hadn't been suppressed.
You might find the relevant code change explanatory that introduces this behavior.
net/url: reject query values with semicolons

A workaround might be:
parsed.RawQuery = strings.ReplaceAll(parsed.RawQuery, ";", "%3b")

@seankhliao seankhliao changed the title affected/package: net/url: parseQuery() does not check for semicolon(;) in url net/url: parseQuery() does not check for semicolon(;) in url Sep 12, 2022
@seankhliao
Copy link
Member

This is working as intended. net/url.Parse just stores net/url.URL.RawQuery which is only parsed on demand, either by net/url.URL.Query() (dropping malformed values) or net/url.ParseQuery() (reporting an error). Both are documented.

@seankhliao seankhliao closed this as not planned Won't fix, can't repro, duplicate, stale Sep 12, 2022
@golang golang locked and limited conversation to collaborators Sep 12, 2023
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FrozenDueToAge
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@narslan @gopherbot @seankhliao @zer0yu