Post #1472927
2026-03-26 13:16 UTC
@silverpill @liaizon Like, even just using urlparse() from different languages exposes us to implementation difference issues, so a simple split("#")[0] equality is *way* better than urlparse & field comparison for security reasons.
which means lowercasing is a bad-bad!
Replies (1)
-
@Profpatsch@mastodon.xyz 2026-03-26 13:18
@silverpill @liaizon check this :) https://blackhat.com/docs/us-17/thursday/us-17-Tsai-A-New-Era-Of-SSRF-Exploiting-URL-Parser-In-Trending-Programming-Languages.pdf