java - 在 ESAPI 中编码和规范化

Question

我明白 ESAPI 的用途，但我看到这两行在很多 ESAPI 示例中重复出现。有人可以解释一下这到底是做什么的吗？

ESAPI.encoder().canonicalize(inputUrl,false,false);

Answer 1

参见 docs :

Canonicalization is simply the operation of reducing a possibly encoded string down to its simplest form. This is important, because attackers frequently use encoding to change their input in a way that will bypass validation filters, but still be interpreted properly by the target of the attack. Note that data encoded more than once is not something that a normal user would generate and should be regarded as an attack.

在您的示例中设置为 false 的两个附加参数分别指示是否限制多重编码和混合编码(请参阅文档了解含义)。