OwlCyberSecurity - MANAGER

Edit File: KNOWN-ISSUES

= Known issues with Rack and ECMA-262

* Many users expect the escape() function defined in ECMA-262 to be compatible
  with URI. Confusion is especially strong because the documentation for the
  escape function includes a reference to the URI specifications. ECMA-262
  escape is not however a URI escape function, it is a javascript escape
  function, and is not fully compatible. Most notably, for characters outside of
  the BMP. Users should use the more correct encodeURI functions.

= Known issues with Rack and Web servers

* Lighttpd sets wrong SCRIPT_NAME and PATH_INFO if you mount your
  FastCGI app at "/".  This can be fixed by using this middleware:

class LighttpdScriptNameFix
      def initialize(app)
        @app = app
      end

def call(env)
        env["PATH_INFO"] = env["SCRIPT_NAME"].to_s + env["PATH_INFO"].to_s
        env["SCRIPT_NAME"] = ""
        @app.call(env)
      end
    end

Of course, use this only when your app runs at "/".

Since lighttpd 1.4.23, you also can use the "fix-root-scriptname" flag
  in fastcgi.server.

= Known conflicts regarding parameter parsing

* Many users have differing opinions about parameter parsing. The current
   parameter parsers in Rack are based on a combination of the HTTP and CGI
   specs, and are intended to round-trip encoding and decoding. There are some
   choices that may be viewed as deficiencies, specifically:
    - Rack does not create implicit arrays for multiple instances of a parameter
    - Rack returns nil when a value is not given
    - Rack does not support multi-type keys in parameters
   These issues or choices, will not be fixed before 2.0, if at all. They are
   very major breaking changes. Users are free to write alternative parameter
   parsers, and their own Request and Response wrappers. Moreover, users are
   encouraged to do so.