Silverstripe-framework: [CONTROL] URL parsing bug

[jonom]

Affected Version

SS 4.1, possibly earlier

Description

If an invalid extension (e.g. ".css") is added to a valid URL (e.g. /about-us) a 404 response should be returned. Instead a 200 response is returned along with the normal content, as if the extension has been ignored.

Steps to Reproduce

1. Create a new SS4 site with composer create-project
2. Navigate to mysite.localhost/about-us/.css or mysite.localhost/contact-us.embassy

Notes

Only works if a single period is used and no other special characters. Adding these strings to a URL won't trigger the bug:

• .css.jpg
• .fake-url

[dhensby]

That's because the extension is ignored :/ this is somewhat intended behaviour...

[dhensby]

the extension is taken off and discarded when resolving the URLs

[jonom]

If it's intentional feel free to close this issue, but what's the benefit of discarding the extension? From my viewpoint an invalid URL shouldn't return a valid response... but then again it's probably not likely that this issue would lead to a real world problem for someone.

[kinglozzer]

I seem to remember a discussion about this before - I _think_ it was originally intended so that you could have /api.json or /api.xml handled by the same URL handler, but switch out how you output the response by checking $request->getExtension().

I’m not a fan of the behaviour if that’s the only reason for it, I’ll try to find the other issue

Edit: https://github.com/silverstripe/silverstripe-framework/issues/5385

[dhensby]

I'm afraid this is just legacy behaviour that may have to many advocates to remove...

[jonom]

I think @JorisDebonnet's issue is a great example that this feature has some drawbacks. If it can cause params to break that's not great. Making it an opt-in feature for SS5 would be a good idea I think.

[dhensby]

Making it an opt-in feature for SS5 would be a good idea I think

I think what would be much better is to be able to define routes more flexibly (including regex for example) rather than keeping this rather opinionated feature