Client-side HTTP parameter pollution in language-switcher URLs

[urban011]

Describe the issue
Burp Suite flags a client-side HTTP parameter pollution (HPP) vulnerability (Low / Firm) on IPT 3.3.2. The language-switcher links preserve all query parameters from the current request URL when appending request_locale. This allows an attacker to craft a URL that injects arbitrary parameters into the language-switcher hrefs in the rendered page.
Steps to reproduce

Request GET /%3fiof%26hms%3d1 (URL-encoded ?iof&hms=1 in the path)
IPT renders the home page with language links like:
html

The injected parameters (iof, hms) are reflected into the response

Expected behavior
Language-switcher links should only include request_locale as a parameter, or at minimum strip/encode unrecognized parameters from the current URL before embedding them in hrefs.
Impact
Low — the parameters are HTML-encoded and only affect language-switcher dropdown links. No sensitive operations are exposed. However, this finding blocks security scan sign-off for organizations that require clean Burp reports.
Environment

IPT 3.3.2
Jetty 12.0.21
Java 17
nginx reverse proxy with HSTS, X-Frame-Options, Referrer-Policy all configured

[mike-podolskiy90]

@urban011 Thank you for reporting this one