mirror of
https://github.com/angular/angular.git
synced 2026-09-14 13:54:52 +08:00
3192dccaa3
`makeCacheKey` joined the request fields with `|` before hashing. The url and the serialized body can contain `|` themselves, so a shifted field boundary (url `/items/a` + body `b|c` vs url `/items/a|b` + body `c`) produced the same joined string and the same key, letting two distinct requests share a transfer cache slot. Join with `\0` instead, which cannot occur in a valid url or in encoded params, so the field boundaries cannot be forged by field content.