规范表示是什么意思及其对网站的潜在漏洞
我在谷歌上搜索了规范表示的含义，发现了一些非常神秘的文档。 任何人都可以快速解释规范表示以及网站中针对规范表示攻击的一些典型漏洞是什么？
I searched on google for a meaning of canonical representation and turned up documents that are entirely too cryptic. Can anyone provide a quick explanation of canonical representation and also what are some typical vulnerabilities in websites to canonical representation attacks?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
规范化是获取输入（例如文件名或字符串）并将其转换为标准表示形式的过程。
例如，如果您的 Web 应用程序仅允许访问 C:\websites\mydomain 下的文件，则通常引用文件名的任何输入都会被规范化为物理直接路径，而不是使用相对路径的路径。 如果您想打开 C:\websites\mydomain\example\example.txt 该函数的一个输入可能是 example\example.txt。 很难确定这是否超出了网站的边界，因此规范化功能将查看应用程序目录并将相对路径更改为物理路径，即 C:\websites\mydomain\example\example.txt。 这显然更容易检查，因为您只需在文件路径的开头进行字符串比较即可。
对于 HTML 输入，您采用 %20 之类的输入并通过取消编码对其进行规范化，因此这将变成一个空格。 这是一个好主意，因为不同的编码方式有很多，规范化意味着您只需检查解码后的字符串，而不是尝试覆盖所有编码变体。
基本上，您正在接受逻辑上等效的输入，并将它们转换为标准形式，然后您可以采取行动。
Canonicalisation is the process by which you take an input, such as a file name, or a string, and turn it into a standard representation.
For example if your web application only allows access to files under C:\websites\mydomain then typically any input referring to filenames is canonicalised to be a physical, direct path, rather than one which uses relative paths. If you wanted to open C:\websites\mydomain\example\example.txt one input into that function may be example\example.txt. It's hard to work out if this goes outside the boundaries of your web site, so the canonicalisation function would look at the application directory and change that relative path into a physical one, C:\websites\mydomain\example\example.txt. This is obviously easier to check as you simply do a string compare on the start of the file path.
For HTML inputs you take inputs like %20 and canonicalise them by unencoding, so this would turn into a space. This is a good idea as the number of different ways of encoding are numerous, canonicalisation means you would check the decoded string only, rather than try to cover all the encoding variations.
Basically you are taking input which is logically equivalent and converting them to a standard form which you can then act upon.
以下解释来自此处的“应用程序安全和开发 STIG”：
The following explanation is from the "Application Security and Development STIG" found here:
规范化意味着将接收到的数据减少到最简单的形式，用于输入验证。
Canonicalisation means reducing the data received to its simplest form, it's used for Input validation.
规范（我认为）意味着控制台输入是“典型行为”。 非规范是指输入不标准，需要专门的知识，例如linux上“vi”的输入行为。
Canonical (I think) means that console input is "typical behavior". Non-canonical means that input is non-standard and requires special knowledge, such as the input behavior of "vi" on linux.