The methods that reach a static- or dynamic-policy route by id build the path by concatenation, "/api/v1/static-policies/" + id, without url.PathEscape. An id that contains /, ? or # therefore reaches a different route, or turns the rest of the id into a query or a fragment, instead of being refused or sent as one path segment.
The affected methods: GetStaticPolicy, UpdateStaticPolicy, DeleteStaticPolicy, ToggleStaticPolicy, GetStaticPolicyVersions, CreatePolicyOverride, DeletePolicyOverride, GetDynamicPolicy, UpdateDynamicPolicy, DeleteDynamicPolicy and ToggleDynamicPolicy.
This is pre-existing, not a regression. The ids these routes take are UUIDs and slugs today, so no known caller is affected. It was found in review of the v11 parity change (#237), which builds each of these paths from its route template and deliberately leaves escaping out, so that change does not alter what goes on the wire.
Fix: escape the id where the template's {id} is filled, with a test that sends an id containing / and ? and asserts the path the server receives.
The methods that reach a static- or dynamic-policy route by id build the path by concatenation,
"/api/v1/static-policies/" + id, withouturl.PathEscape. An id that contains/,?or#therefore reaches a different route, or turns the rest of the id into a query or a fragment, instead of being refused or sent as one path segment.The affected methods:
GetStaticPolicy,UpdateStaticPolicy,DeleteStaticPolicy,ToggleStaticPolicy,GetStaticPolicyVersions,CreatePolicyOverride,DeletePolicyOverride,GetDynamicPolicy,UpdateDynamicPolicy,DeleteDynamicPolicyandToggleDynamicPolicy.This is pre-existing, not a regression. The ids these routes take are UUIDs and slugs today, so no known caller is affected. It was found in review of the v11 parity change (#237), which builds each of these paths from its route template and deliberately leaves escaping out, so that change does not alter what goes on the wire.
Fix: escape the id where the template's
{id}is filled, with a test that sends an id containing/and?and asserts the path the server receives.