On Wed, Feb 10, 2010 at 2:07 AM, Bert Huijben <bert_at_qqmail.nl> wrote:
> This thread suggests using full urls everywhere. And the thread closes with the reasoning that this will cause all kinds of new security issues as we have to do the url encoding everywhere. (Encoding one time more than required or one time less than required introduces security bugs).
>
> Always opening at the repository root and using repos_relpaths for further communication wouldn't have this issues, but has the potential of creating more issue #3242 like issues.
No - keep in mind that (at least with Serf) we should be able to hold
open the TCP connection for reuse within a time window. IMO, we
shouldn't go down the path of altering how we treat ra_session stuff -
just teach ra_serf to lazily close connections or whatnot seems the
best strategy. (Yes, there might be some pool issues, but those would
have to be addressed anyway if there is sharing going on.) -- justin
Received on 2010-02-10 17:28:47 CET