DOS on page-cache is possible

[rvock]

TYPO3 uses the cHash-Parameter to validate URLs and only cache a page, if a valid cHash is found. Otherwise it would be possible to only change a parameter and create a new cache-entry in the database:
www.example.org/en/?test=1
www.example.org/en/?test=2
www.example.org/en/?test=3
www.example.org/en/?test=4

This will generate 4 cache entries, even though there is no valid cHash in the URL. (see https://typo3.org/documentation/article/the-mysteries-of-chash-1/ )

This happens because UrlDecoder::doDecoding calls calculateChash and generates a valid cHash:
https://github.com/dmitryd/typo3-realurl/blob/131ce5c/Classes/Decoder/UrlDecoder.php#L155

[dmitryd]

True. This is expected.

Your proposals?.. How do we avoid bad cHash in the following cases if there is no URL cache entry and cHash recalculation:

• URL with parameters
• URL with empty parameters that do not get to the URL but affect cHash

[itmdesign]

Any new information on this subject?

[dmitryd]

None that I can disclose.

[dmitryd]

Fixed in 2.0.15. See https://typo3.org/teams/security/security-bulletins/typo3-extensions/typo3-ext-sa-2016-021/