Preliminary research
When Two Parsers Disagree: Exploiting Query String Differentials for XSS
AI-collected research leads through 6 October 2026, including bounded month-by-month reviews of selected social and community sources from January through September. Unranked, incomplete, not community-vetted, and subject to change.
Uses a small Express application to explain mismatches between extended qs parsing and browser URLSearchParams. Bracket interpretation, normalized keys and a parameter-count cutoff let one parser validate a different value from the one later used by the browser. Complete constructions illustrate cross-parser validation errors.
Record
- Researcher
- Amirmohammad Safari
- Published by
- Voorivex
- Date
In the archive
Related sources
Tags
This page is the archive's own catalogue record. The research is the work of Amirmohammad Safari, first published at the original source. Preserved copies are kept so the citation survives its host.