A small bug in thinkphp

Two days ago found their website inexplicably a bit more files
Original address: http://bbs.csdn.net/topics/390469279

This morning to observe these inexplicable HTML files, finally found the problem!!!
Reason:
If you turn on static caching, you have parameters in the static rules, such as

Static cache ' html_cache_on ' =>true, ' html_cache_rules ' = = Array (' infor:search ' = = Array (' Home/{:module}/{:action} /{key} '),

Examples Show
{Key}=test
Html/home/infor/search/test.html
{key}=.. /boot
Html/home/infor/boot.html
Yes, the second static file HTML flies to the parent directory, so the server directory has a lot more files and folders.
This should be considered a small bug of thinkphp, although it is not harmful to the site, but very annoying

The solution is simple, too.
is static rules do not directly use parameters, recommended that you use MD5 processing {$_server. REQUEST_URI|MD5}

A witty silk?

Reply to discussion (solution)

Come and see, the static cache is relatively small.

This is not a thinkphp bug.
It's natural for you to be responsible for your own actions.

For the rules of your example, if key =. /boot
by $rule = Preg_replace ('/{(\w+)}/e ', "\$_get[' \\1 ']", $rule);
To be interpreted as home/module_name/action_name/. /boot

What reason does TP have to prevent you from putting static files in the parent directory?

This is not a thinkphp bug.
It's natural for you to be responsible for your own actions.

For the rules of your example, if key =. /boot
by $rule = Preg_replace ('/{(\w+)}/e ', "\$_get[' \\1 ']", $rule);
To be interpreted as home/module_name/action_name/. /boot

What reason does TP have to prevent you from putting static files in the parent directory?

I think TP should consider the filter of the {key} parameter.

If you want to filter, you have to give the rules, write code
URLs like http://bbs.csdn.net/topics/390469279/..x, at least, do not constitute an attack.
You can't expect people to do everything for you, after all, he's just a development tool.
If this is the case of Dede, it can be said that it is a bug

