Skip to content

Add an option to enable decoding null bytes from url encoded forms #61968

Open
@Tragetaschen

Description

@Tragetaschen

Is there an existing issue for this?

  • I have searched the existing issues

Is your feature request related to a problem? Please describe the problem.

While reading a form, there are two code paths. One is active for UTF8 and ASCII, another is active for all other encodings. The former uses the UrlDecoder and that throws when it decodes a null byte (%00) from a form. The second path on the other hand treats the form as data url and accepts the null byte creating a string instance with a U+0000 code point.

Describe the solution you'd like

I understand that the RFC suggests not allowing null, but having the option in the first path to accept it anyways would certainly help.

Additional context

As a workaround, it's possible to always force the second code path by registering an EncodingProvider and manipulating the request header to include a known charset value that maps to an instance of UTF8Encoding that isn't the Encoding.UTF8 instance.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area-mvcIncludes: MVC, Actions and Controllers, Localization, CORS, most templates

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions