Is theme_pager() vulnerable to HTTP Parameter Pollution? I'm currently running vulnerability scans against my application, which is based on Drupal. One "High" vulnerability is HTTP Parameter Pollution (HPP), and it has to do with pages that make use of drupal's theme_pager(). 

I know that it could indeed be (and probably is) a false-positive, but I need to be able to understand why it isn't a vulnerability so that I can remediate the scanning report. I'm hoping that someone with more security experience than I can help.

The found vulnerability is as follows (I'll use drupal.org in this example):


Visit a url that has a pager on it: 

https://drupal.org/search/site/cat

Append a useless query parameter+value to the url such as %26foo%3dbar (or &amp;foo=bar , I'm not sure if it actually matters)

https://drupal.org/search/site/cat%26foo%3dbar

The "vulnerability", as I understand it, is that the pager link URLs (1,2,3,4,etc) all contain the &amp;foo=bar param.


The actual scan output was as follows:


  Vulnerability description This script is possibly vulnerable to HTTP Parameter Pollution > attacks.
  
  HPP attacks consist of injecting encoded query string delimiters into other existing parameters. If the web application does not properly sanitize the user input, a malicious user can compromise the logic of the application to perform either clientside or server-side attacks.
  
  This vulnerability affects /.
  Discovered by: Scripting (HTTP_Parameter_Pollution.script).
  
  Attack details
  
  Path Fragment input / was set to qui&amp;n950086=v982658
  Parameter precedence: last occurrence
  Affected link: /search/node/qui?page=1&amp;n950086=v982658
  Affected parameter: page=1
  
  Request GET /search/node/qui%26n950086%3dv982658


So my question is two-fold: Should this be considered a false-positive? How is Drupal protecting itself from HPP?

Thanks!
Simple answer: no, theme_pager() isn't vulnerable to this kind of attack.

The pager functions only use the page parameter and don't make use of any other. As far as Drupal core goes, that argument is used only in the context of a PDO-prepared database query, and so any effort at malicious manipulation of that page parameter will simply fail.

As with anything, careless use of theme_pager() outside of the proper API - e.g. using the associated preparatory functions manually without properly prepared database queries - can result in unwanted side-effects. But the function and its associates aren't inherently insecure, and from a core perspective are used safely.