Re: [VE][403] Add Subject Here

Günter Hansen wrote:

> Validating http://www.udev.info/ <http://www.udev.info/update/>
> Error [403]: "reference to external entity in attribute value"
>
> <a
> href="/cgi-bin/cone/cone_wrapper.cgi?TODO=2410&ID*=*201005MHGZuL">more
> ....</a>
>
> There is a thing I don’t understand (or maybe I simply didn’t know about
> it?). Is it forbidden to put a parameter called “ID” into a URL?
>
> The Validator shows this to be invalid, although its within a URL … !?
> Can this be right?

I think it's the unescaped ampersand rather than the ID per se.
I'm not sure whether the recommend fix is to escape the ampersand,
as in "/cgi-bin/cone/cone_wrapper.cgi?TODO=2410&amp;ID*=*201005MHGZuL"
or to represent it using % notation.  I am sure that someone more
expert (or more awake) than I will advise, but try the former
in the meantime.

Philip Taylor