backlog: file #1243 -- close ASVS 1.2.2 on the merits, both limbs in one item - #364
Open
wshallwshall wants to merge 1 commit into
Open
backlog: file #1243 -- close ASVS 1.2.2 on the merits, both limbs in one item#364wshallwshall wants to merge 1 commit into
wshallwshall wants to merge 1 commit into
Conversation
…one item (#1107) Owner-ruled on both halves of the 1.2.2 encoding question, filed as one item because closing either half alone leaves the cell at partial. Limb A removes the verbatim flat FHIR query path. The default ships fhir_require_structured_params = False, so the shipped path appends the caller's search string with no encoding. The ruling was deletion rather than flipping the default: a flipped default leaves the unencoded sink reachable behind one config edit, which closes the cell on a setting rather than on the absence of the sink. Zero deployments means there is no migration cost to weigh against the simple correct end state. Limb B escapes the FHIR value separators in structured values. Percent-encoding neutralises the URL layer but not the FHIR value layer, so a comma, pipe or dollar inside a datum survives decoding and changes the query's meaning. The item records that limb B must NOT touch conditional_query, which is an operator-authored query string whose separators are deliberate, documented and test-pinned on both sinks. Its containment is the already-filed screen item. It also records that the four-shape screen sitting where encoding belongs is the gap, not a control, so it must not be anchored as evidence for the cell.
wshallwshall
enabled auto-merge (squash)
August 13, 2026 11:33
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Files one backlog item. Docs-only:
docs/BACKLOG.md, +18 lines, 0 deletions.#1243 -- close ASVS 1.2.2 on the merits: remove the verbatim flat FHIR query path, and escape the
FHIR value separators in structured values.
Why both limbs are one item
Owner-ruled, both limbs. They are filed together deliberately because closing either alone leaves
the cell short:
[egress].fhir_require_structured_paramsshipsFalse(config/settings.py:2555), so the default appends the flat search string verbatim. Theruling is deletion, not a flipped default -- setting it
Truewould leave the unencoded sinkreachable behind one config toggle.
,|$in structured values. Limb A alone wouldmandate the structured path, and that path still leaks the value-layer separators.
So A without B mandates a route that is itself unescaped, and B without A leaves the verbatim route
reachable. Splitting them would let one land and read as closure.
Limb B deliberately does not touch
conditional_query, and the item says why: the distinction isprovenance, and it is easy to get backwards.
Scope fence
The item names what is not in scope so nobody folds it in -- the
match-versus-fullmatchgrammar-gate defect and the missing READ-path control-char screen are separate filings (#1240, #1241),
already on main.
Verification
70b3dff7, matching the filing session's reporta1344e8ais a real ancestor ofmain-- not stacked on an unmerged PR headdocs/BACKLOG.mdgit merge-treeagainstmainreturns clean (branched on the exit code, not on whether a treeoid printed -- it prints one either way)
parse_items: #1243 present, OPEN, exactly one status bannerSeverity is written in the conditional per CLAUDE.md section 0: no deployment axis, zero instances.