search

simplesamlphp / SAML-tracer

Browser extension for examining SAML messages
https://addons.mozilla.org/nl/firefox/addon/saml-tracer/
BSD 2-Clause "Simplified" License
141 stars 39 forks source link

The escape sequence '\?' is equivalent to just '?' #73

Closed khlr closed 2 years ago

khlr commented 2 years ago

Recently I played around with GitHub Actions in my SAML-tracer fork and came to know that there's a useless backslash in the regular expression for parsing the query string of GET requests:

The escape sequence '\?' is equivalent to just '?', so the sequence may still represent a meta-character when it is used in a regular expression.

Tool CodeQL, Rule ID js/useless-regexp-character-escape

Instead of parsing the query string manually, SAML-tracer can make use of URLSearchParams which greatly facilitates the process.

But there's one thing that made me wonder: Does anyone know why there's been a semicolon in the regular expression?

var r = new RegExp('[&;\?]');

It's clear that one would want an URL to be split on ? and & to get the name value pairs of the query string. But why should it be split on ; as well??

thijskh commented 2 years ago

W3C has recommended that query string parameters can also be semicolons. Although it does not seem widely in actual use.

Code is much improved by indeed depending on URLSearchParams, good improvement!

khlr commented 2 years ago

Thanks for the info @thijskh ! I wasn't aware of that. As you said - semicolon doesn't seem to be really used. So hopefully we can ignore it. URLSearchParams doesn't take it into account anyway ¯_(ツ)_/¯