Possibly, but the code change fixes the vulnerability as a priority without changing much.

On 05/08/2013, at 6:42 PM, Viktor Klang (√) <notifications@github.com> wrote:

> In framework/src/play/src/main/scala/play/api/mvc/Http.scala:
> 
> > @@ -414,7 +417,13 @@ package play.api.mvc {
> >       */
> >      def decode(data: String): Map[String, String] = {
> >  
> > -      def urldecode(data: String) = java.net.URLDecoder.decode(data, "UTF-8").split("\u0000").map(_.split(":")).map(p => p(0) -> p.drop(1).mkString(":")).toMap
> > +      def urldecode(data: String) = {
> > +        data
> > +          .split("&")
> > +          .map(_.split("=", 2))
> > +          .map(p => URLDecoder.decode(p(0), "UTF-8") -> URLDecoder.decode(p(1), "UTF-8"))
> > +          .toMap
> Can this be done more efficiently?
> 
> —
> Reply to this email directly or view it on GitHub.