[wp-trac] Re: [WordPress Trac] #8152: WordPress should force all URL query string requests to be 255 characters or less

[WordPress Trac]

#8152: WordPress should force all URL query string requests to be 255 characters
or less
-------------------------+--------------------------------------------------
 Reporter:  _ck_         |        Owner:  anonymous
     Type:  defect       |       Status:  new      
 Priority:  normal       |    Milestone:  2.8      
Component:  Security     |      Version:  2.6.1    
 Severity:  normal       |   Resolution:           
 Keywords:  needs-patch  |  
-------------------------+--------------------------------------------------
Changes (by westi):

 * cc: westi (added)
  * keywords:  => needs-patch
  * milestone:  2.7 => 2.8

Comment:

 Not changing this for 2.7

 I would prefer if we were to do anything to block the request with a 414
 Request URI too long rather than trimming the content of $_GET variables
 otherwise we introduce the possibility of weird bugs

 From RFC 2068:
   The HTTP protocol does not place any a priori limit on the length of
   a URI. Servers MUST be able to handle the URI of any resource they
   serve, and SHOULD be able to handle URIs of unbounded length if they
   provide GET-based forms that could generate such URIs. A server
   SHOULD return 414 (Request-URI Too Long) status if a URI is longer
   than the server can handle (see section 10.4.15).

   Note: Servers should be cautious about depending on URI lengths
   above 255 bytes, because some older client or proxy implementations
   may not properly support these lengths.

-- 
Ticket URL: <http://trac.wordpress.org/ticket/8152#comment:1>
WordPress Trac <http://trac.wordpress.org/>
WordPress blogging software