Skip to content
This repository was archived by the owner on Apr 12, 2024. It is now read-only.

HTTP Get Params not escaped correctly #10209

Closed
DanielHeath opened this issue Nov 24, 2014 · 2 comments
Closed

HTTP Get Params not escaped correctly #10209

DanielHeath opened this issue Nov 24, 2014 · 2 comments

Comments

@DanielHeath
Copy link

Angular does not url-encode semicolon characters (whereas encodeURIComponent(';') does).

As a result, if a user types a semicolon into a field which is included in a GET request resulting in a call like

$http.get('/', params: {per_page: 20, search: 'foo;bar'})

According to the relevant spec

We recommend that HTTP server implementors, 
and in particular, CGI implementors, support 
the use of ";" in place of "&"

A server using Rails will follow this spec and interpret the request as
{"per_page" =>"20", "search"=>"foo", "bar"=>nil}

Angular should escape GET params the same way as encodeURIComponent does.

@DanielHeath
Copy link
Author

Sorry, I see this was already reported as #9224

@pkozlowski-opensource
Copy link
Member

Ok, if this is a duplicate let's move the discussion to the existing issue.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants