Stop reflecting request.GET into pagination links - #9153
Open
chosak wants to merge 1 commit into
Open
Conversation
The pagination module (molecules/pagination.html) currently generates its previous/next links by taking request.GET and appending "page" to the query string. This behavior carries over not just valid query string parameters (like "q", "topics", etc.) but any invalid ones that the user might append. For example, visiting a page like /about-us/newsrooom/ with query string ?dosomething=evil would generate pagination links like ?dosomething=evil&page=2. This issue is covered in internal cfgov#4525. This change refactors the pagination module so that it takes an explicit set of "pagination_params" that are used to generate links. Each caller using the pagination module must provide a base set of parameters. This touches every place (9) that pagination is used on cf.gov. For local testing with a current site dump, try the use cases below. Note that although the URLs include invalid parameters, those are not carried over to the pagination links. 1. Filterable list results, for example http://localhost:8000/archive/blog/?page=3&categories=at-the-cfpb&invalid=badparam. 2. iRegs search results, for example http://localhost:8000/rules-policy/regulations/search-regulations/results/?page=2&q=test®s=1002&order=relevance&results=25&invalid=badparam. 3. TDP activity search, for example localhost:8000/consumer-tools/educator-tools/youth-financial-education/teach/activities/?page=2&grade_level=4&invalid=badparam. 4. Sitewide search, for example http://localhost:8000/search/?page=2&q=mortgage&invalid=badparam. 5. Credit card ageements search, for example http://localhost:8000/credit-cards/agreements/issuer/synchrony-financial/?page=2&invalid=badparam. 6. Ask CFPB portal page, for example http://localhost:8000/consumer-tools/credit-reports-and-scores/answers/basics/?page=2&invalid=badparam. 7. Ask CFPB search result, for example http://localhost:8000/ask-cfpb/search/?page=2&q=mortgage&invalid=badparam. 8. Ask CFPB tag browsing, for example localhost:8000/ask-cfpb/search-by-tag/interest/?page=2&invalid=badparam. 9. Prepaid agreements search, for example localhost:8000/data-research/prepaid-accounts/search-agreements/?page=2&q=visa&search_field=all&invalid=badparam.
wpears
approved these changes
Aug 7, 2026
wpears
left a comment
Member
There was a problem hiding this comment.
Works like a dream. Thanks for finally fixing this in a way that's not just dependent on escaping.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The pagination module (molecules/pagination.html) currently generates its previous/next links by taking request.GET and appending "page" to the query string. This behavior carries over not just valid query string parameters (like "q", "topics", etc.) but any invalid ones that the user might append. For example, visiting a page like /about-us/newsrooom/ with query string ?dosomething=evil would generate pagination links like ?dosomething=evil&page=2.
This issue is covered in internal cfgov#4525.
This change refactors the pagination module so that it takes an explicit set of "pagination_params" that are used to generate links. Each caller using the pagination module must provide a base set of parameters.
This touches every place (9) that pagination is used on cf.gov. For local testing with a current site dump, try the use cases below. Note that although the URLs include invalid parameters, those are not carried over to the pagination links.