Skip to content

Stop reflecting request.GET into pagination links - #9153

Open
chosak wants to merge 1 commit into
mainfrom
fix/pagination-params
Open

Stop reflecting request.GET into pagination links#9153
chosak wants to merge 1 commit into
mainfrom
fix/pagination-params

Conversation

@chosak

@chosak chosak commented Aug 6, 2026

Copy link
Copy Markdown
Member

The pagination module (molecules/pagination.html) currently generates its previous/next links by taking request.GET and appending "page" to the query string. This behavior carries over not just valid query string parameters (like "q", "topics", etc.) but any invalid ones that the user might append. For example, visiting a page like /about-us/newsrooom/ with query string ?dosomething=evil would generate pagination links like ?dosomething=evil&page=2.

This issue is covered in internal cfgov#4525.

This change refactors the pagination module so that it takes an explicit set of "pagination_params" that are used to generate links. Each caller using the pagination module must provide a base set of parameters.

This touches every place (9) that pagination is used on cf.gov. For local testing with a current site dump, try the use cases below. Note that although the URLs include invalid parameters, those are not carried over to the pagination links.

  1. Filterable list results, for example http://localhost:8000/archive/blog/?page=3&categories=at-the-cfpb&invalid=badparam.
  2. iRegs search results, for example http://localhost:8000/rules-policy/regulations/search-regulations/results/?page=2&q=test&regs=1002&order=relevance&results=25&invalid=badparam.
  3. TDP activity search, for example http://localhost:8000/consumer-tools/educator-tools/youth-financial-education/teach/activities/?page=2&grade_level=4&invalid=badparam.
  4. Sitewide search, for example http://localhost:8000/search/?page=2&q=mortgage&invalid=badparam.
  5. Credit card ageements search, for example http://localhost:8000/credit-cards/agreements/issuer/synchrony-financial/?page=2&invalid=badparam.
  6. Ask CFPB portal page, for example http://localhost:8000/consumer-tools/credit-reports-and-scores/answers/basics/?page=2&invalid=badparam.
  7. Ask CFPB search result, for example http://localhost:8000/ask-cfpb/search/?page=2&q=mortgage&invalid=badparam.
  8. Ask CFPB tag browsing, for example http://localhost:8000/ask-cfpb/search-by-tag/interest/?page=2&invalid=badparam.
  9. Prepaid agreements search, for example http://localhost:8000/data-research/prepaid-accounts/search-agreements/?page=2&q=visa&search_field=all&invalid=badparam.

The pagination module (molecules/pagination.html) currently generates
its previous/next links by taking request.GET and appending "page" to
the query string. This behavior carries over not just valid query string
parameters (like "q", "topics", etc.) but any invalid ones that the user
might append. For example, visiting a page like /about-us/newsrooom/
with query string ?dosomething=evil would generate pagination links like
?dosomething=evil&page=2.

This issue is covered in internal cfgov#4525.

This change refactors the pagination module so that it takes an explicit
set of "pagination_params" that are used to generate links. Each caller
using the pagination module must provide a base set of parameters.

This touches every place (9) that pagination is used on cf.gov. For
local testing with a current site dump, try the use cases below. Note
that although the URLs include invalid parameters, those are not
carried over to the pagination links.

1. Filterable list results, for example
  http://localhost:8000/archive/blog/?page=3&categories=at-the-cfpb&invalid=badparam.
2. iRegs search results, for example http://localhost:8000/rules-policy/regulations/search-regulations/results/?page=2&q=test&regs=1002&order=relevance&results=25&invalid=badparam.
3. TDP activity search, for example localhost:8000/consumer-tools/educator-tools/youth-financial-education/teach/activities/?page=2&grade_level=4&invalid=badparam.
4. Sitewide search, for example http://localhost:8000/search/?page=2&q=mortgage&invalid=badparam.
5. Credit card ageements search, for example http://localhost:8000/credit-cards/agreements/issuer/synchrony-financial/?page=2&invalid=badparam.
6. Ask CFPB portal page, for example http://localhost:8000/consumer-tools/credit-reports-and-scores/answers/basics/?page=2&invalid=badparam.
7. Ask CFPB search result, for example http://localhost:8000/ask-cfpb/search/?page=2&q=mortgage&invalid=badparam.
8. Ask CFPB tag browsing, for example localhost:8000/ask-cfpb/search-by-tag/interest/?page=2&invalid=badparam.
9. Prepaid agreements search, for example localhost:8000/data-research/prepaid-accounts/search-agreements/?page=2&q=visa&search_field=all&invalid=badparam.
@chosak
chosak requested review from anselmbradford and wpears August 6, 2026 21:22

@wpears wpears left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Works like a dream. Thanks for finally fixing this in a way that's not just dependent on escaping.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants