复制Unicode的土耳其语“无点”“ I”安全问题

时间:2019-12-17 03:52:20

标签: node.js security unicode

https://eng.getwisdom.io/hacking-github-with-unicode-dotless-i/是黑客新闻的热门话题,本文提供了一些示例代码来演示该问题。

// `MyRouteAttribute`, `MyHandler`, and `MyActionResult` are classes that belong to a mini-web-service library I wrote that can be hosted within ASP.NET WebForms but also ASP.NET Core and even completely outside of ASP.NET too.

[MyRoute( "GET", "/products")]
[MyRoute( "GET", "/products/categories/{categoryName}")]
class ProductsListHandler : MyHandler
{
    MyActionResult ProcessRequest( HttpContext httpContext )
}

[MyRoute( "GET", "/products/{productId}")]
class ProductsGetHandler : MyHandler
{
    MyActionResult ProcessRequest( HttpContext httpContext )
}

[MyRoute( "POST", "/products/{productId}")]
class ProductsPostHandler : MyHandler
{
    MyActionResult ProcessRequest( HttpContext httpContext )
}

但是,当我运行代码时,我看不到任何问题,因为https://repl.it/repls/ConsiderateRareQueries字符串不匹配...

我想念什么吗?

0 个答案:

没有答案