neex commented on issue #7563: URL: https://github.com/apache/trafficserver/issues/7563#issuecomment-791365042
I think the "fair" solution would be to encode back some characters (e.g. `/`, `:`', `@` and so on) so that if one of these appears in the username/password, it will always be in its encoded form. However, note that several (but less security impactful) issues can arise in the other part of the URL. E.g. in some hypothetical example, we can register a user with the name `victim&page=posts` and then get a page like `index.php?username=victim%26page=posts` cached as if it were `index.php?username=victim&page=posts` and still get cache poisoning (but inside the same domain). ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: [email protected]
