c0fb53548c
The userinfo check read the authority after `//`, so `https:\\alice:pw@host`, `https:alice:pw@host` and `https:/\alice:pw@host` passed. object.url now refuses any `?`, `#`, `@` or `\`, a path `@` included, so no query, fragment or user information enters an observation however a parser splits the URL. Corpus cases for the three bypasses, a backslash alone and a path `@`; the escaped-URL observation keeps a quote (its backslash moved out with the rule). Section 8.2 also states that no syntax keeps an address, a token or personal data out of `cid`: an emitter MUST NOT put one there, and the charset stays a syntax rule. Co-Authored-By: Claude Opus 5.5 <[email protected]>
36 lines
771 B
JSON
36 lines
771 B
JSON
{
|
|
"v": 1,
|
|
"sid": "6f1c2a9e0b7d4c3a8e5f1d2c3b4a5968",
|
|
"sn": 0,
|
|
"ts_ms": 1790000000000,
|
|
"event": "response",
|
|
"cid": "aaf90792d6ff5318e5f306fbb000dfcbe73637e244aad1a2eff6dae537cd6b5f",
|
|
"st": "v",
|
|
"sf": "o",
|
|
"object": {
|
|
"ot": null,
|
|
"url": "https:/\\viewer:[email protected]/t/base.wai",
|
|
"content_hash": null,
|
|
"capability": null,
|
|
"rendition": null,
|
|
"layer": null,
|
|
"layers_total": null,
|
|
"layer_cap": null,
|
|
"counted": null,
|
|
"transferred": null,
|
|
"d_ms": null,
|
|
"dl_ms": null,
|
|
"ttfb_ms": null,
|
|
"ttlb_ms": null,
|
|
"rc": 200,
|
|
"path": null,
|
|
"receipt": null
|
|
},
|
|
"present": null,
|
|
"switch": null,
|
|
"layer_change": null,
|
|
"capable": null,
|
|
"cohort": null,
|
|
"metrics": null,
|
|
"claim": null
|
|
}
|