[GitHub] [trafficserver] neex commented on issue #7563: cache key collision because of username URL decode in url_CryptoHash_get_general

[GitBox <gi...@apache.org>]

neex commented on issue #7563:
URL: https://github.com/apache/trafficserver/issues/7563#issuecomment-791365042


   I think the "fair" solution would be to encode back some characters (e.g. `/`, `:`', `@` and so on) so that if one of these appears in the username/password, it will always be in its encoded form.
   
   However, note that several (but less security impactful) issues can arise in the other part of the URL. E.g. in some hypothetical example, we can register a user with the name `victim&page=posts` and then get a page like `index.php?username=victim%26page=posts` cached as if it were `index.php?username=victim&page=posts` and still get cache poisoning (but inside the same domain).


----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

For queries about this service, please contact Infrastructure at:
users@infra.apache.org