Search results

Crashes on malformed requests due to an issue in httpx

Status: Open.

#297 In planety/prologue;

· hourianto opened on Mar 10, 2026

getPathParams() decodes %2F after route matching, which breaks segment boundaries and enables unintended traversal vulnerabilities

Status: Open.

#296 In planety/prologue;

· hourianto opened on Mar 10, 2026

UploadFile.save() is a direct arbitrary-write primitive if app code trusts multipart filenames

Status: Open.

#295 In planety/prologue;

· hourianto opened on Mar 10, 2026

Basic auth parsing crashes on malformed headers

Status: Open.

#294 In planety/prologue;

· hourianto opened on Mar 10, 2026

Signed-cookie sessions are vulnerable to key injection because session state is serialized with a custom delimiter-based parser instead of a structured format

Status: Open.

#293 In planety/prologue;

· hourianto opened on Mar 10, 2026

Static-file authorization is bypassable because directory allowlisting is implemented as a plain string prefix check

Status: Open.

#292 In planety/prologue;

· hourianto opened on Mar 10, 2026

handle multiple file upload from a single input element

Status: Open.

#269 In planety/prologue;

· rchan96 opened on Jun 15, 2025

Random IndexDefects

Status: Open.

#258 In planety/prologue;

· hmbemba opened on Feb 28, 2025

Migrate to re2

Status: Open.

#256 In planety/prologue;

· PhilippMDoerner opened on Feb 16, 2025

import prologue breaks VS Code error highlighting

Status: Open.

#253 In planety/prologue;

· dawdmaow opened on Dec 22, 2024

signedcookiesession only work when using resp macro

Status: Open.

#246 In planety/prologue;

· TokenChingy opened on Aug 24, 2024

Graphql support?

Status: Open.

#238 In planety/prologue;

· baseplate-admin opened on May 16, 2024