PROBLEM - URL Slashes Squire 3 & Paladin

[benanamen]

Multiple slashes in url work. I have the fix but I want to see how Jason handles it.

This works.

Code: [Select]

https://cutcodedown.com///////for_others///////squire3///////live///////////static////////////////test//////

[Jason Knight]

My answer would probably be to add this to Request's internal parsing stage.

Code: [Select]

if (strpos(self::$path, '//')) Bomb::http(400);

In fact, I'm adding that now. Also why my HTTP bomb supports the full range of 400 and 500 errors. There are cases where something other than 404 is appropriate. 400 "Bad Request" fitting the bill nicely here.

That will be #00033 on the changelog in the next milestone.

Though I'm not entirely sure why this is a problem, since if you don't create a link to a URI like that, how would it come to exist on anything that would use it? Not like it's going to muck up search unless some asshat intentionally sabotages you in back-links.

Which... ok, that's reason enough to add that fix. Thanks. Helpful.

[benanamen]

My "fix" for my CMS was to strip out the redundant slashes with a rewrite rule in htaccess .

After reading your post and in light of the other thread regarding mixed case paths, I agree the app should "bomb" with an error.

I will be updating my CMS and fixing my fix. 

[Jason Knight]

My "fix" for my CMS was to strip out the redundant slashes with a rewrite rule in htaccess .

Which is more processing that ends up applied to all files, not just our redirect. It's bad enough the rewriterule we have and the difficulties of implementing the same on other server software, without tying us even more to Apache.

After reading your post and in light of the other thread regarding mixed case paths, I agree the app should "bomb" with an error.

Yeah, it's part of why that full mechanism is there. As this grows there will be more and more cases for showing different 4xx and 5xx messages. I do think I need to expand Bomb::http() so that more information can be passed to it, allowing for a more robust and informative error_log().