coheigea commented on PR #3596:
URL: https://github.com/apache/cxf/pull/3596#issuecomment-6291795283
There is one remaining gap - the ; case that was kept for the TCK still
writes the path straight after the host with no /. @ is a legal path character,
so it isn’t encoded.
```
fromPath("http://foo.com";).matrixParam("a", "@evil.com").build() ->
http://foo.com;[email protected] host=evil.com
fromPath("http://foo.com";).path(";@evil.com").build() ->
http://foo.com;@evil.com host=evil.com
fromPath("http://foo.com";).path("{x}").build(";@evil.com") ->
host=evil.com
fromPath("http://foo.com";).replaceMatrix("[email protected]").build() ->
host=evil.com
```
Possible fix: in the originalPathEmpty && thePath.startsWith(";") branch of
buildUriString, encode @ as %40 before appending.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
