Last modified: 2008-04-16 20:36:24 UTC

Wikimedia Bugzilla is closed!

Wikimedia migrated from Bugzilla to Phabricator. Bug reports are handled in Wikimedia Phabricator.
This static website is read-only and for historical purposes. It is not possible to log in and except for displaying bug reports and their history, links might be broken. See T15763, the corresponding Phabricator task for complete and up-to-date bug report information.
First Last Prev Next    This bug is not in your last search results.
Bug 13763 - & in url gives ERR_ACCESS_DENIED
& in url gives ERR_ACCESS_DENIED
Status: RESOLVED INVALID
Product: Wikimedia
Classification: Unclassified
General/Unknown (Other open bugs)
unspecified
All All
: Normal minor (vote)
: ---
Assigned To: Nobody - You can work on this!
http://en.wikipedia.org/w/api.php?&
:
Depends on:
Blocks:
  Show dependency tree / graph
 
Reported: 2008-04-16 12:16 UTC by Bryan Tong Minh
Modified: 2008-04-16 20:36 UTC (History)
3 users (show)

See Also:
Web browser: ---
Mobile Platform: ---
Assignee Huggle Beta Tester: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Description Bryan Tong Minh 2008-04-16 12:16:36 UTC 
An &amp; in an url gives ERR_ACCESS_DENIED instead of showing a MediaWiki error: <http://en.wikipedia.org/w/api.php?&amp;>
Comment 1 Chad H. 2008-04-16 12:27:51 UTC 
Are you sure? Works for me and shows the API help page.
Comment 2 OverlordQ 2008-04-16 12:29:04 UTC 
add the semicolon to the end, bugzilla autolinkification leaves that off.
Comment 3 Brion Vibber 2008-04-16 19:07:23 UTC 
This is done to prevent infinite loops by bad spiders.
Comment 4 Roan Kattouw 2008-04-16 19:53:28 UTC 
(In reply to comment #3)
> This is done to prevent infinite loops by bad spiders.
> 

Care to elaborate on that a bit or provide link to a more detailed description? I don't think it's obvious at all that &amp; can be used to create infinite loops (it isn't to me, anyway).
Comment 5 Brion Vibber 2008-04-16 20:36:24 UTC 
Worst case is:

1) URL contains: &

2) HTML encoding contains: &amp;

3) Stupid spider doesn't understand HTML right and goes to URL with &amp; instead of &

4) Spider follows infinite loop of appended links & -> &amp; -> &amp;amp; -> &amp;amp;amp;


Moderate case is simply that the bad spider hits incorrect URLs everywhere, breaking caching and returning incorrect results.
Note You need to log in before you can comment on or make changes to this bug.
First Last Prev Next    This bug is not in your last search results.

Navigation
Links