{"action":"created","issue":{"url":"https://api.github.com/repos/dmitryd/typo3-realurl/issues/341","repository_url":"https://api.github.com/repos/dmitryd/typo3-realurl","labels_url":"https://api.github.com/repos/dmitryd/typo3-realurl/issues/341/labels{/name}","comments_url":"https://api.github.com/repos/dmitryd/typo3-realurl/issues/341/comments","events_url":"https://api.github.com/repos/dmitryd/typo3-realurl/issues/341/events","html_url":"https://github.com/dmitryd/typo3-realurl/issues/341","id":191898396,"number":341,"title":"data is retrieved from tx_realurl_urldata when cHash is wrong","user":{"login":"taniamorales","id":24214136,"avatar_url":"https://avatars.githubusercontent.com/u/24214136?v=3","gravatar_id":"","url":"https://api.github.com/users/taniamorales","html_url":"https://github.com/taniamorales","followers_url":"https://api.github.com/users/taniamorales/followers","following_url":"https://api.github.com/users/taniamorales/following{/other_user}","gists_url":"https://api.github.com/users/taniamorales/gists{/gist_id}","starred_url":"https://api.github.com/users/taniamorales/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/taniamorales/subscriptions","organizations_url":"https://api.github.com/users/taniamorales/orgs","repos_url":"https://api.github.com/users/taniamorales/repos","events_url":"https://api.github.com/users/taniamorales/events{/privacy}","received_events_url":"https://api.github.com/users/taniamorales/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-11-28T00:43:47Z","updated_at":"2016-11-29T08:22:24Z","closed_at":"2016-11-29T08:22:24Z","body":"To start let me tell you how much my colleges and I appreciate the efforts done lately on security level. But I have reviewed the latest commits and I was not able to find one that completely fits to the issue I am adding here so I am requested a feedback to be able to identify a proper solution.\r\n\r\nI received a report that points out to a wrong functionality of the cHash mechanism as the tx_realurl_urldata table is flooded when links (potential harmful) to pages that use a wrong cHash value are requested.\r\nfor example: ../index.php?%25%3Cacx%3E%3CScRiPt_%3Eprompt(990364)%3C%2FScRiPt%3E=&cHash=af00923fd079986f875d2852b95e1627\r\n\r\nthe cHash will of course not match any page that can be cached but realurl tries to retrieve it.\r\nSELECT * FROM tx_realurl_urldata WHERE rootpage_id=1 AND original_url='L=0%25%3Cacx%3E%3CScRiPt_%3Eprompt(990364)%3C%2FScRiPt%3E=&cHash=af00923fd079986f875d2852b95e1627\r\n\r\nMy colleagues questions are:\r\nWhy does the cHash with the injected prompt() script goes through? Why were pages cached? Why was realURL data cached? What do we need to do to prevent it?\r\n\r\nIs it possible that something is done wrong on the configuration of the site itself that  could create this issue or do you think it can be reported as a bug?\r\n\r\nThanks for your feedback!"},"comment":{"url":"https://api.github.com/repos/dmitryd/typo3-realurl/issues/comments/263505661","html_url":"https://github.com/dmitryd/typo3-realurl/issues/341#issuecomment-263505661","issue_url":"https://api.github.com/repos/dmitryd/typo3-realurl/issues/341","id":263505661,"user":{"login":"dmitryd","id":306133,"avatar_url":"https://avatars.githubusercontent.com/u/306133?v=3","gravatar_id":"","url":"https://api.github.com/users/dmitryd","html_url":"https://github.com/dmitryd","followers_url":"https://api.github.com/users/dmitryd/followers","following_url":"https://api.github.com/users/dmitryd/following{/other_user}","gists_url":"https://api.github.com/users/dmitryd/gists{/gist_id}","starred_url":"https://api.github.com/users/dmitryd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dmitryd/subscriptions","organizations_url":"https://api.github.com/users/dmitryd/orgs","repos_url":"https://api.github.com/users/dmitryd/repos","events_url":"https://api.github.com/users/dmitryd/events{/privacy}","received_events_url":"https://api.github.com/users/dmitryd/received_events","type":"User","site_admin":false},"created_at":"2016-11-29T08:22:24Z","updated_at":"2016-11-29T08:22:24Z","body":"Closed because not a bug. Only bugs are allowed in the bug tracker.\r\n\r\nSee [Getting help](https://github.com/dmitryd/typo3-realurl/wiki/Getting-help) if you need help."}}
{"actor":{"display_login":"dmitryd"}}