security1 publisher
ocaml-cohttp stops percent-encoded ..%2f from escaping the docroot
The fix decodes a request path exactly once before removing dot segments, so ..%2f..%2f no longer resolves outside the docroot. Servers that gate access on path prefixes still have to call the new Cohttp.Path.normalise themselves.
Publishers:github.com
Reality
- Evidence66
- Adoption
- Insufficient
- Hype gap−25
- Incentives35
- Confidence60