#28609: Original request URI is not available to development server
-------------------------------------+-------------------------------------
Reporter: Jay Lynch | Owner: nobody
Type: | Status: new
Cleanup/optimization |
Component: Core (Management | Version: 1.11
commands) |
Severity: Normal | Resolution:
Keywords: server http-server | Triage Stage:
runserver | Unreviewed
Has patch: 1 | Needs documentation: 0
Needs tests: 0 | Patch needs improvement: 0
Easy pickings: 0 | UI/UX: 0
-------------------------------------+-------------------------------------
Comment (by Graham Dumpleton):
Some web servers do provide `REQUEST_URI` and to be compatible with them
you could add it, but anyone using it should be well warned that it can be
somewhat dangerous to rely on it.
The reason is that it is the raw path that appears in the HTTP request.
This is before the web server would normalise it. It for example has not
had repeating slashes removed, nor path elements such as `../`. If a user
doesn't clean up the URL they can put themselves at risk if they then use
the path to do things like map to a filesystem path. That is, it could be
used in path traversal attacks.
Often the reason people want access to `REQUEST_URI` is based on wanting
to do things which are considered bad practice. For example, wanting to be
able to see repeating slashes because they used a URI as part of the path.
Or trying to see raw url encoding escape sequences such as in this case.
So you could definitely add, but I would discourage people using it.
--
Ticket URL: <https://code.djangoproject.com/ticket/28609#comment:2>
Django <https://code.djangoproject.com/>
The Web framework for perfectionists with deadlines.
--
You received this message because you are subscribed to the Google Groups
"Django updates" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To post to this group, send email to [email protected].
To view this discussion on the web visit
https://groups.google.com/d/msgid/django-updates/066.15bf16cfdf8d8745e55ac7bf4877091c%40djangoproject.com.
For more options, visit https://groups.google.com/d/optout.
