unicode - Why is it that "using anything but a utf-8 decoder...might be insecure" in a URL percent decoding algorithm? -

-

i implementing url parser , have question w3c url spec (at http://www.w3.org/tr/2014/wd-url-1-20141209/ ) in section "2. percent-encoded bytes" has following algorithm (emphasis added):

to percent decode byte sequence input, run these steps:

using utf-8 decoder when input contains bytes outside range 0x00 0x7f might insecure , not recommended.

  1. let output empty byte sequence.

  2. for each byte byte in input, run these steps:

    1. if byte not '%', append byte output.

    2. otherwise, if byte '%' , next 2 bytes after byte in input not in ranges 0x30 0x39, 0x41 0x46, , 0x61 0x66, append byte output.

    3. otherwise, run these substeps:

      1. let bytepoint 2 bytes after byte in input, decoded, , interpreted hexadecimal number.

      2. append byte value bytepoint output.

      3. skip next 2 bytes in input.

  3. return output.

in original spec, word "decoded" (in bold above) link utf-8 decoding algorithm. assume "utf-8 decoder" referred in second sentence (italicized) above.

i understand invalid sequences of utf-8 bytes can cause security problems. however, in step uses decoder, bytes have been verified valid ascii hex digits preceding sub-substep 2, seems using utf-8 decoder here security overkill.

can explain how using other utf-8 decoder in algorithm possibly insecure, when decoder used byte values in ranges 0x30 0x39, 0x41 0x46, , 0x61 0x66? or interpreting incorrectly in spec?

it seems me bytes outside range 0x00 0x7f copied output as-is (either in substep 1 because not %, or in sub-substep 2 because not ascii hex digits), never end in decoder in algorithm.


Comments

Post a Comment

Popular posts from this blog

qt - Using float or double for own QML classes -

-
i've created components , helper methods using c++ , qt used in qml gui. of methods calculate gui elements (size, transformations, scene graph items creation). target arm 32 bit using opengl / eglfs render output. opengl using float , qml using real (defined double ). what should use in c++ do not lose precision? if use qreal ( double ) shouldn't lose precision. if git grep float in qtbase.git , can find out bit more: dist/changes-5.2.0-**************************************************************************** dist/changes-5.2.0-* important behavior changes * dist/changes-5.2.0-**************************************************************************** dist/changes-5.2.0- dist/changes-5.2.0- - qt compiled qreal typedef'ed double on dist/changes-5.2.0: platforms. qreal float on arm chipsets before. guarantees more dist/changes-5.2.0- consistent behavior between platforms qt supports, binary dist/chan...
Read more

Create Outlook appointment via C# .Net -

-
i need create outlook appointment using microsoft.office.interop.outlook , while can work locally on own workstation , works if run web application via server's browser, not work when connect server externally. hence, think might permission issue. i changed application pool identity " localsystem " don't access denied error. unfortunately, doesn't work. the app behaves if appointment created, appointment doesn't appear in outlook. here include file on top of aspx.cs page using outlook = microsoft.office.interop.outlook; here code using pop appointment. outlook.application apptapp = new outlook.application(); outlook.appointmentitem appt = apptapp.createitem(outlook.olitemtype.olappointmentitem) outlook.appointmentitem; appt.subject = txtfirstname.text + " " + txtlastname.text; appt.body = txtcomment.text; appt.alldayevent = false; appt.start = datetime.parse(txtreminderdate.text + " 8:00 am"); appt.end = datetime.p...
Read more

ios - Swift Array Resetting Itself -

-
i have 2 arrays: pointhistory , datehistory . have nstimer , , when timer runs out, action called. in action appending int pointhistory , , current date string datehistory . here timer action: func timeraction() { let steppervalue = int(stepper.value) employee.numberofpoints = steppervalue networking.saveemployee(employee, completion: { (error) -> void in if error != nil { let alert = uialertcontroller(title: "error", message: "there error updating \(self.employee.name)'s points", preferredstyle: .alert) let alertaction = uialertaction(title: "ok", style: .cancel, handler: nil) alert.addaction(alertaction) self.presentviewcontroller(alert, animated: true, completion: nil) } }) var dateformatter = nsdateformatter() dateformatter.dateformat = "mm-dd-yyyy" dateformatter.timezone = nstimezone.localtimezone() var date = nsdate() var ...
Read more