Why wouldn’t this behavior be a good idea? The purpose of ? in your url is to pass a query. But the query must specify something — either a defined key or key=value pairing recognized by the underlying software run on your site. Otherwise it’s useless and (typically should be) ignored by it. So this:
?http://some-other-site.com
is pretty meaningless to a WordPress site, unlike:
?p=1234
Also note with:
?p=1234?anything-at-all
the second query component: ?anything-at-all, would be ignored as it’s invalid. A normal query with one or more additional key/key=value pairs would use the & operator.
Just because I can’t think of a way to exploit this quirk, doesn’t mean someone else couldn’t do it.
How difficult would it be to give an error when the query is invalid, instead of ignoring it? And would it be worth the effort? I don’t know the answers to these questions.
In general, however, it seems that many exploits *have* been possible as a result of seemingly innocent quirks. And I am getting really bizarre “queries” involving highly specific addresses that make me wonder whether there is something other than a chance error of some sort.
“Just because I can’t think of a way to exploit this quirk, doesn’t mean someone else couldn’t do it.“
Couldn’t you say that about… well, almost anything?
“How difficult would it be to give an error when the query is invalid, instead of ignoring it?“
Note you originally brought up invalid queries that are invalid not because they are broken or misused, but because WordPress will not recognize them. I can pass:
?funk=wagnalls
as a string suffixed to my site’s url. This is just a ‘get’ query waiting for something to parse it and understand it, and unless something does and can (which WordPress normally would not), it would be beyond difficult to make use of it for some sort of ‘exploit,’ or to pass some sort of error based on it.
There’s nothing wrong with being concerned over areas of security leakage like this in WordPress, especially when passing query strings and the like, but keep in mind you can only break through a back door* that exists, not one that doesn’t.
* And hopefully set off some alarms. :)
