Project

General

Profile

Actions
Copy link

Bug #14596

open
WW RM

Incorrect handling of user provided wtd containing "=" character

Bug #14596: Incorrect handling of user provided wtd containing "=" character

Added by Wojciech Wil 2 months ago. Updated 17 days ago.

Status:
Implemented @Emweb
Priority:
Normal
Assignee:
Romain Mardulyn
Target version:
4.14.2
Start date:
06/15/2026
Due date:
% Done:

0%

Estimated time:

Description

Running hello example like so

../../build/examples/hello/hello.wt --docroot . --http-listen 0.0.0.0:8080 -c ../../wt_config.xml.in

Where in example config file wt_config.xml.in the only change is <reload-is-new-session>false</reload-is-new-session>, so that wtd parameter is visible in browser URL and then wtd is modified to have extra '=' character like wtd=123abc=d app is stuck in infinite loop of creating new sessions. Wt version 4.11.4.

Change like this fixes the issue

--- a/src/web/skeleton/Boot.js
+++ b/src/web/skeleton/Boot.js
@@ -143,10 +143,10 @@ _$_$endif_$_();
       const params = getParams();
 
       for (let i = 0, len = params.length; i < len; i++) {
-        const tokens = params[i].split("=");
-        if (tokens.length >= 2) {
-          if (tokens[0] === name) {
-            return unescape(tokens[1]);
+        const eqPos = params[i].indexOf("=");
+        if (eqPos !== -1) {
+          if (params[i].substring(0, eqPos) === name) {
+            return unescape(params[i].substring(eqPos + 1));
           }
         }
       }
@@ -160,11 +160,10 @@ _$_$endif_$_();
       const params = getParams();
 
       for (let i = 0, len = params.length; i < len; i++) {
-        const tokens = params[i].split("=");
-        if (tokens.length >= 2) {
-          if (tokens[0] === name) {
-            tokens[1] = escape(value);
-            params[i] = tokens.join("=");
+        const eqPos = params[i].indexOf("=");
+        if (eqPos !== -1) {
+          if (params[i].substring(0, eqPos) === name) {
+            params[i] = name + "=" + escape(value);
             found = true;
             break;
           }

RM Updated by Romain Mardulyn 2 months ago Actions
Copy link
 #1

Hi Wil,

This bug has already been fixed in later versions of Wt.

RM Updated by Romain Mardulyn about 2 months ago Actions
Copy link
 #2

  • Status changed from New to Rejected

WW Updated by Wojciech Wil 27 days ago Actions
Copy link
 #3

Hi Romain,

Just tested with latest version 4.14.0, when adding to config <is-invalid-wtd-suspicious>false</is-invalid-wtd-suspicious> as suggested in config file when using <reload-is-new-session>false</reload-is-new-session> the problem is still present for hello example application.

RM Updated by Romain Mardulyn 26 days ago Actions
Copy link
 #4

  • Status changed from Rejected to New

RM Updated by Romain Mardulyn 25 days ago Actions
Copy link
 #5

  • Target version set to 4.14.2

RM Updated by Romain Mardulyn 19 days ago Actions
Copy link
 #6

  • Status changed from New to InProgress
  • Assignee set to Romain Mardulyn

RM Updated by Romain Mardulyn 19 days ago Actions
Copy link
 #7

  • Status changed from InProgress to Review
  • Assignee deleted (Romain Mardulyn)

ED Updated by emil de keyser 19 days ago Actions
Copy link
 #8

  • Assignee set to emil de keyser

ED Updated by emil de keyser 19 days ago Actions
Copy link
 #9

  • Status changed from Review to Resolved
  • Assignee changed from emil de keyser to Romain Mardulyn

RM Updated by Romain Mardulyn 17 days ago Actions
Copy link
 #10

  • Status changed from Resolved to Implemented @Emweb
Actions
Copy link

Also available in: PDF Atom