{"action":"created","issue":{"url":"https://api.github.com/repos/dmitryd/typo3-realurl/issues/160","repository_url":"https://api.github.com/repos/dmitryd/typo3-realurl","labels_url":"https://api.github.com/repos/dmitryd/typo3-realurl/issues/160/labels{/name}","comments_url":"https://api.github.com/repos/dmitryd/typo3-realurl/issues/160/comments","events_url":"https://api.github.com/repos/dmitryd/typo3-realurl/issues/160/events","html_url":"https://github.com/dmitryd/typo3-realurl/issues/160","id":155011612,"number":160,"title":"DOS on page-cache is possible","user":{"login":"rvock","id":209159,"avatar_url":"https://avatars.githubusercontent.com/u/209159?v=3","gravatar_id":"","url":"https://api.github.com/users/rvock","html_url":"https://github.com/rvock","followers_url":"https://api.github.com/users/rvock/followers","following_url":"https://api.github.com/users/rvock/following{/other_user}","gists_url":"https://api.github.com/users/rvock/gists{/gist_id}","starred_url":"https://api.github.com/users/rvock/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/rvock/subscriptions","organizations_url":"https://api.github.com/users/rvock/orgs","repos_url":"https://api.github.com/users/rvock/repos","events_url":"https://api.github.com/users/rvock/events{/privacy}","received_events_url":"https://api.github.com/users/rvock/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/dmitryd/typo3-realurl/labels/on%20hold","name":"on hold","color":"f7c6c7"}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-05-16T11:31:37Z","updated_at":"2016-09-08T09:00:57Z","closed_at":"2016-09-08T09:00:57Z","body":"TYPO3 uses the cHash-Parameter to validate URLs and only cache a page, if a valid cHash is found. Otherwise it would be possible to only change a parameter and create a new cache-entry in the database:\r\nwww.example.org/en/?test=1\r\nwww.example.org/en/?test=2\r\nwww.example.org/en/?test=3\r\nwww.example.org/en/?test=4\r\n\r\nThis will generate 4 cache entries, even though there is no valid cHash in the URL. (see https://typo3.org/documentation/article/the-mysteries-of-chash-1/ )\r\n\r\nThis happens because UrlDecoder::doDecoding calls calculateChash and generates a valid cHash:\r\nhttps://github.com/dmitryd/typo3-realurl/blob/131ce5c/Classes/Decoder/UrlDecoder.php#L155"},"comment":{"url":"https://api.github.com/repos/dmitryd/typo3-realurl/issues/comments/245536778","html_url":"https://github.com/dmitryd/typo3-realurl/issues/160#issuecomment-245536778","issue_url":"https://api.github.com/repos/dmitryd/typo3-realurl/issues/160","id":245536778,"user":{"login":"dmitryd","id":306133,"avatar_url":"https://avatars.githubusercontent.com/u/306133?v=3","gravatar_id":"","url":"https://api.github.com/users/dmitryd","html_url":"https://github.com/dmitryd","followers_url":"https://api.github.com/users/dmitryd/followers","following_url":"https://api.github.com/users/dmitryd/following{/other_user}","gists_url":"https://api.github.com/users/dmitryd/gists{/gist_id}","starred_url":"https://api.github.com/users/dmitryd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmitryd/subscriptions","organizations_url":"https://api.github.com/users/dmitryd/orgs","repos_url":"https://api.github.com/users/dmitryd/repos","events_url":"https://api.github.com/users/dmitryd/events{/privacy}","received_events_url":"https://api.github.com/users/dmitryd/received_events","type":"User","site_admin":false},"created_at":"2016-09-08T09:00:57Z","updated_at":"2016-09-08T09:00:57Z","body":"Fixed in 2.0.15. See https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2016-021/"}}
{"actor":{"display_login":"dmitryd"}}