Security vulnerabilities and automated fixes for url encoding issues
1 post found
A critical URL parameter injection vulnerability in the `getUserInfoByKeyword()` function allowed attackers to manipulate API requests by injecting special characters into the search keyword parameter. The fix applies `encodeURIComponent()` to properly encode the keyword before concatenating it into the URL, preventing parameter tampering and null byte injection attacks.