Tom - I reposted this/your message because it appears to me your original got buried with the old BBS just before the cutover - Jack

I've got an odd query string that is intended to include a the following:



Which correctly encoded is:



I'm passing the entire query string through CGIOP_GETPARARY, and everything is being correctly decoded apart from the second "<" in fact, any "<" after the first is being decoded as "[" instead.




I can't see any issues with the string itself, or the way in which it's being processed. This is using 6.4.1557.5.

Thanks, Tom

It appears that the conversion of < (after the first one) to [ was a deliberate defensive move to guard against malicious HTML injection. Whether that's an appropriate defense, or whether a defense is even needed here, is an open question. Since the result is being passed to the application directly, perhaps we should just assume the application had set the magic "trust me" bit and would take over responsibility for worrying about stuff like this?

After further reflection on this, I decided that it wasn't CGIUTL's place to protect you from HTML injection hacks, at least not in this particular case (where the result is being passed back to the application rather than the browser). It might be worth further discussion for the operations that do output directly to the browser. But for the moment, I've posted beta patches that remove that dubious feature...

ash64notes.txt

ash-6.4.1558.8-w32-upd.zip
ash-6.4.1558.8-w32c-upd.zip
ash-6.4.1558.8-el5-upd.tz
ash-6.4.1558.8-el7-upd.tz

It'll also be in the 6.4.1664.2 patch which addresses an unrelated 6.5 change and may be posted elsewhere on this forum later tonight or tomorrow.

Alternatively, you could just convert all the "[" characters back to "<" (assuming that those characters won't otherwise occur on their own in your queries.)

(As a bonus this would give you an excuse to familiarize yourself with the somewhat obscure but highly useful XSTRIP.SBR.)

Thanks Jack, we'd actually been making that assumption already, and had some injection protection in place in various parts of the system.

I'd not actually come across XSTRIP before, so will be sure to dip into that one, much appreciated!