In making use of the Wayback CDX server API (documented here), I noticed that certain resumeKeys, as returned by a previous call that exceeded the limit, lead to an infinite loop when performing subsequent calls that make use of that resumeKey. As suggested in the documentation, I am simply appending the verbatim value of resumeKey to the URL, preceded by &resumeKey=.
Examples:
All of the above queries produce a resumeKey equivalent to that with which they were called, resulting in an infinite loop. The reason is most probably mishandling of the resumeKey parameter by the CDXServer.java script, in which query.resumeKey is URL decoded one too many times (first natively by the environment, then again explicitely). All the addresses above namely feature some special characters (such as pluses, percent sign, spaces, commas) and the fact that URL decoding happens twice can be further demonstrated by these addresses based on the one mentioned in the documentation:
They all produce the same result, what suggests that URL decoding actually happens twice. And with URIs that include actual URL-decoded data, that leads to catastrophic consequencies.
In making use of the Wayback CDX server API (documented here), I noticed that certain resumeKeys, as returned by a previous call that exceeded the limit, lead to an infinite loop when performing subsequent calls that make use of that resumeKey. As suggested in the documentation, I am simply appending the verbatim value of resumeKey to the URL, preceded by
&resumeKey=.Examples:
All of the above queries produce a resumeKey equivalent to that with which they were called, resulting in an infinite loop. The reason is most probably mishandling of the resumeKey parameter by the CDXServer.java script, in which query.resumeKey is URL decoded one too many times (first natively by the environment, then again explicitely). All the addresses above namely feature some special characters (such as pluses, percent sign, spaces, commas) and the fact that URL decoding happens twice can be further demonstrated by these addresses based on the one mentioned in the documentation:
They all produce the same result, what suggests that URL decoding actually happens twice. And with URIs that include actual URL-decoded data, that leads to catastrophic consequencies.