[issue2551381] roundup-server parses URI's with multiple '?" incorrectly.

New submission from John Rouillard:

A url that has two '? in it like:

    http://localhost:9001/rest/data/status?@page_index=?

will generate a 404 not found error when passed to roundup-server. While a
wsgi or cgi run roundup instance will generate a different 4xx code.

This is because roundup-server uses rfind to find the right most '?' when
it should be using the left most according to:
https://www.rfc-editor.org/rfc/rfc3986#section-3.4

     The query component contains non-hierarchical data that, along with
   data in the path component (Section 3.3), serves to identify a
   resource within the scope of the URI's scheme and naming authority
   (if any).  The query component is indicated by the first question
   mark ("?") character and terminated by a number sign ("#") character
   or by the end of the URI.

Discovered this while setting up fuzz testing on some rest uri's.

----------
assignee: rouilj
components: Web interface
messages: 8228
nosy: rouilj
priority: normal
severity: major
status: new
title: roundup-server parses URI's with multiple '?" incorrectly.
type: behavior

_________________________________________________
Roundup tracker <[email protected]>
<https://issues.roundup-tracker.org/issue2551381>
_________________________________________________