fix(http): prevent duplicate search params in transfer cache key generation - #68424
Closed
kon72 wants to merge 1 commit into
Closed
fix(http): prevent duplicate search params in transfer cache key generation#68424kon72 wants to merge 1 commit into
kon72 wants to merge 1 commit into
Conversation
This comment was marked as outdated.
This comment was marked as outdated.
JeanMeche
reviewed
Apr 28, 2026
kon72
force-pushed
the
fix-transfer-cache-key
branch
from
April 28, 2026 16:52
06034dd to
4d30666
Compare
Member
|
Your commit was authored by |
…ration Updates `sortAndConcatParams` in TransferCache to deduplicate search param keys before sorting and concatenating them into a string. Since `URLSearchParams.prototype.keys()` returns all keys including duplicates, the previous implementation could produce a string of length `O(N^2)` where `N` is the number of duplicate search param keys, potentially leading to OOM and excessive CPU usage when the request body is controllable by the user. For example, the search params `foo=1&bar=2&foo=3` would produce the string `bar=2&foo=1,3&foo=1,3` instead of the expected `bar=2&foo=1,3`. Also adds tests for `sortAndConcatParams` to verify that it correctly normalizes both `HttpParams` and `URLSearchParams`.
kon72
force-pushed
the
fix-transfer-cache-key
branch
from
April 28, 2026 16:56
4d30666 to
d9825eb
Compare
Author
Weird. It looks like VS Code Copilot extension silently added |
14 tasks
Member
|
We'll likely go with #68571 which is a broader fix. |
|
This pull request has been automatically locked due to inactivity. Read more about our automatic conversation locking policy. This action has been performed automatically by a bot. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Updates
sortAndConcatParamsin TransferCache to deduplicate search param keys before sorting and concatenating them into a string.Also adds tests for
sortAndConcatParamsto verify that it correctly normalizes bothHttpParamsandURLSearchParams.PR Checklist
Please check if your PR fulfills the following requirements:
PR Type
What kind of change does this PR introduce?
What is the current behavior?
Since
URLSearchParams.prototype.keys()returns all keys including duplicates, the previous implementation could produce a string of lengthO(N^2)whereNis the number of duplicate search param keys, potentially leading to OOM and excessive CPU usage when the request body is controllable by the user.For example, the search params
foo=1&bar=2&foo=3would produce the stringbar=2&foo=1,3&foo=1,3instead of the expectedbar=2&foo=1,3.What is the new behavior?
sortAndConcatParamscorrectly handle duplicate search param key.Does this PR introduce a breaking change?
Other information