diff options
| author | Yuriy Andamasov <yuriy@vyos.io> | 2026-07-28 05:24:34 +0300 |
|---|---|---|
| committer | Yuriy Andamasov <yuriy@vyos.io> | 2026-07-28 05:24:34 +0300 |
| commit | cfca705f325a073c00e221a080eff968112d7653 (patch) | |
| tree | 40d910b59dcfbb7dd7e3cd77c016ee3eba67b74d /docs/contributing/debugging.md | |
| parent | 957af46300afc91dee324100d9dc0ad91c4a144f (diff) | |
| download | vyos-documentation-cfca705f325a073c00e221a080eff968112d7653.tar.gz vyos-documentation-cfca705f325a073c00e221a080eff968112d7653.zip | |
security: normalize pre-existing percent escapes in encodePath
Adversarial-review finding (Codex, medium): location.pathname returns
well-formed escapes verbatim, so blind encodeURIComponent double-encoded
them (%2E -> %252E), broke the HEAD probe on escaped deep links, and
dumped the user at the version root. Each segment is now decoded first
(malformed escapes keep the raw segment — no throw), then re-encoded to
canonical single encoding. Decoding cannot resurrect dot-segments:
the URL parser resolves '.'/'..' and their percent-encoded forms during
navigation, so pathname never presents them (verified against the WHATWG
parser in Node).
workers suite 106/106 (+2 regression tests, mutation-verified).
🤖 Generated by [robots](https://vyos.io)
Diffstat (limited to 'docs/contributing/debugging.md')
0 files changed, 0 insertions, 0 deletions