iiinova — where your digital self keeps evolving

Lorenzo Leonardini

@pianka.it

Computer scientist, cybersecurity guy, wannabe musician You might know me as "pianka" CTF player with @aboutblankets 🔗 sec.leonardini.dev

Posts Replies Media

Lorenzo Leonardini @pianka.it · 02/01/2025

Currenly playing around with Bun's URL parser, and I must say it's pretty fun. It's not vulnerable as it's never used raw, but expect a few GH issues and a blog post about it. Spoiling the least interesting quirk to keep you on your toes :) Hopefully I'm not ruining anybody's future challenge :')

The URL `http://a@b@c` is parsed to as username `a`, password `b` and hostname `c`

080

Lorenzo Leonardini @pianka.it · 28/12/2024

TIL that in Go this snippet produces `/foo/bar`, and... I feel like that's.. wrong..? The HTTP server router does not handle this as `/foo/bar`, and parsing this with Node returns `/foo%2fbar` (which is what I expected) Does anyone have any insight on this?

u, _ := url.Parse("http://localhost/foo%2fbar")
fmt.Println(u.Path)

220