如何清理物理地址（在 Node 中......以防止黑客攻击）？
我有一个 Node 应用程序，它收集用户的地址并将其发送到 Yahoo PlaceFinder api（返回用户的地理位置）。
用户应填写“地址”字段并单击“提交”。
许多不同的地址格式都是可接受的，例如：
- 90210（仅邮政编码）
- 123 fake street，beverly hills，CA 90210
- 123 fake street，90210
- ...等
我不关心用户是否输入有效地址。我什至不想考虑为此需要什么正则表达式。
我担心安全问题。
在使用我的 Node 应用程序 - 对 YahooPlace finder api 的 http.get() 请求处理用户的输入之前，我应该采取哪些步骤（如果有）来清理用户的输入？
I have a Node app that collects the user's address and sends it to the Yahoo PlaceFinder api (which returns the user's geolocation).
The user should fill out the "address" field and click submit.
Many different address formats are acceptable, such as:
- 90210 (just zip)
- 123 fake street, beverly hills, CA 90210
- 123 fake street, 90210
- ... etc
I'm not concerned if the user enters a valid address or not. I don't even want to think about what RegEx would be needed for that.
I am concerned about security.
What steps (if any) should I take to sanitize the user's input before processing it with with my Node app - http.get()request to YahooPlace finder api?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
让我给出一个相当务实的答案，超越通常的“根据可接受值白名单清理不受信任的数据”响应。当您说“收集用户的地址”时，您实际上是：
如果您是只需获取输入并将其传递给雅虎，那么问题就更多是他们的而不是你的，因为你没有将自己暴露于上述任何一种攻击向量。您可能会发现，如果是这种情况，那么沿着清理路径走下去就没有太多意义，这对于像自由格式地址这样可变的东西来说不可避免地会非常困难。
Let me give a fairly pragmatic answer beyond the usual "sanitise your untrusted data against a white list of acceptable values" response. When you say "collects the user's address", are you actually either:
If you're simply taking the input and passing it off to Yahoo, then the problem is more theirs than yours as you're not exposing yourself to either of the above attack vectors. You might find that if this is the case, there's not a lot of point in going down the sanitisation path which will inevitably be very difficult against something as variable as a free-form address.
我敢说最简单的方法是对他们的输入应用正则表达式，只允许字母数字字符，也许还有逗号和句点。我不确定这是否允许所有有效地址通过，但如果失败，您可以显示一条错误消息，其效果是“仅使用 [A-z0-9,.]”
，理论上，这应该可以缓解大多数类型的问题您会看到的漏洞利用，因为它们很可能需要某种形式的控制字符来破坏您的代码。除非出现某种溢出，我很确定考虑到您的情况，逗号和句点相对无害。
I dare say the simplest method would be to apply a regex to their input, allowing only alphanumeric characters, along with perhaps a comma and a period. I'm not sure if that would allow all valid addresses through, but if it fails you could display an error message to the effect of "only use [A-z0-9,.]"
That should, in theory, mitigate most types of exploits you would see, as they would most likely need some form of control character to break your code. Barring an overflow of some sort, I'm pretty sure commas and periods are relatively harmless given your situation.