AWS mediapackage documentation change
Summary
Expanded query parameter formatting guidelines with URL encoding requirements for special characters (+ becomes %2B, etc.), clarified error behavior for malformed queries, and updated timezone notation examples
Security assessment
The changes emphasize proper URL encoding to prevent malformed requests that could lead to incomplete manifests. While this improves reliability and prevents parsing errors, there's no explicit mention of addressing a security vulnerability. The documentation now highlights security-adjacent best practices for parameter handling.
Diff
diff --git a/mediapackage/latest/userguide/msettings-params.md b/mediapackage/latest/userguide/msettings-params.md index 4cf71dd27..b3aa95db4 100644 --- a//mediapackage/latest/userguide/msettings-params.md +++ b//mediapackage/latest/userguide/msettings-params.md @@ -5 +5 @@ -Query syntaxQuery parametersURL encoding query parameters +Query parameter formattingQuery syntaxQuery parametersURL encoding query parameters @@ -9 +9,27 @@ Query syntaxQuery parametersURL encoding query parameters -To use time-shifted viewing query parameters, append `aws.manifestsettings` to your playback request to MediaPackage. MediaPackage evaluates the query, and serves a client manifest based on those query parameters. Manifest queries are _not_ case-sensitive and can be up to 1024 characters long. If the query is malformed, MediaPackage returns an error. For query syntax, see the following section. +To use time-shifted viewing query parameters, append `aws.manifestsettings` to your playback request to MediaPackage. MediaPackage evaluates the query, and serves a client manifest based on those query parameters. + +The following sections describe how to configure time-shift viewing query parameters. + +## Query parameter formatting + +Use the following guidelines when constructing query parameters: + + * Queries are not case sensitive. + + * Queries can be up to 1,024 characters. + + * Reserved characters in the queries must be URL encoded as indicated in the [URI: General Syntax](https://datatracker.ietf.org/doc/html/rfc3986) standard. + +At a minimum, if your query includes multiple parameters, the following characters in the query must be URL encoded. If they're not, MediaPackage processes just the first query parameter in the string. + +Character | Encoded value +---|--- +: (colon) | %3A +; (semicolon) | %3B +, (comma) | %2C +\+ (plus) | %2B + + + + +If the query is malformed, MediaPackage returns an incomplete or empty manifest. For query syntax, see the following section. @@ -36 +62 @@ In all cases, the date and time must be notated in one of the following formats: - * ISO 8601 dates, such as 2017-08-18T21:18:54+00:00. Where -08:00 is the timezone UTC -08:00. + * ISO 8601 dates, such as 2017-08-18T21:18:54%2B08:00, where **%2B08:00** is the timezone UTC+08:00. The plus (+) must be URL-encoded.