caddyhttp: Enhance comment

Matthew Holt committed Jul 16, 2022 at 23:33 UTC 8bdee04651d93a5a799f6816ceafaa7ac61fe26d

1 file changed +6 -3

modules/caddyhttp/matchers.go

+6 -3

@@ -632,12 +632,15 @@ func (m MatchQuery) Match(r *http.Request) bool {

632 // parse query string just once, for efficiency

633 parsed, err := url.ParseQuery(r.URL.RawQuery)

634 if err != nil {

635 - // Illegal query string. Likely bad escape sequence or syntax.

635 + // Illegal query string. Likely bad escape sequence or unescaped literals.

636 // Note that semicolons in query string have a controversial history. Summaries:

637 // - https://github.com/golang/go/issues/50034

638 // - https://github.com/golang/go/issues/25192

639 - // W3C recommendations are flawed and ambiguous, and different servers handle semicolons differently.

640 - // Filippo Valsorda rightly wrote: "Relying on parser alignment for security is doomed."

639 + // Despite the URL WHATWG spec mandating the use of & separators for query strings,

640 + // every URL parser implementation is different, and Filippo Valsorda rightly wrote:

641 + // "Relying on parser alignment for security is doomed." Overall conclusion is that

642 + // splitting on & and rejecting ; in key=value pairs is safer than accepting raw ;.

643 + // We regard the Go team's decision as sound and thus reject malformed query strings.

644 return false

645 }

646