Why value cannot be put into a request path as a road id or item identifier, or
undefined when it can. The rules apply to the value with surrounding whitespace
trimmed, as the client sends it.
A blank value is rejected (it would build //services/... and leak the upstream
"Cannot GET" text). The client percent-encodes the id, but the upstream decodes %2F back to / and
resolves .. before routing, so "A1/../A2" would fetch the A2 data (exit 0) and
"A2/" would pass for "A2"; get("x/../<id>") would fetch <id>. No road id or
identifier the API issues contains a / (one that did could not be fetched either:
the upstream would route it as two segments). "." and ".." are rejected too:
percent-encoding leaves them unchanged and URL parsing would resolve them.
Why
valuecannot be put into a request path as a road id or item identifier, or undefined when it can. The rules apply to the value with surrounding whitespace trimmed, as the client sends it.A blank value is rejected (it would build
//services/...and leak the upstream "Cannot GET" text). The client percent-encodes the id, but the upstream decodes%2Fback to/and resolves..before routing, so"A1/../A2"would fetch the A2 data (exit 0) and"A2/"would pass for"A2";get("x/../<id>")would fetch<id>. No road id or identifier the API issues contains a/(one that did could not be fetched either: the upstream would route it as two segments)."."and".."are rejected too: percent-encoding leaves them unchanged and URL parsing would resolve them.