Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

try url decode uri in access log #18

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

kevinlemonra
Copy link

请求日志中的中文路径显示不出来 小改一下

@marjune163
Copy link
Collaborator

我这边测试下来在Linux VGA终端上不加载字体的情况下,中文都会变成方块,可能这种情况下辨识度更低了。

另外这里直接记录了用户的请求而没有做过滤,与unicode有关的漏洞时有发生,如果用户精心构造一个特殊的字节序列,查看日志的计算机可能受到攻击,需要如何防范呢?

@kevinlemonra
Copy link
Author

我觉得,如果不是记录到数据库或是显示在网页上,而只是记录到日志文件中的话,问题不大。至于查看日志的机器的安全性,那就要看他怎么查看了。

@marjune163
Copy link
Collaborator

%08 是退格键,我试下来如果请求带有这个序列就可以往前删除。

@marjune163
Copy link
Collaborator

我增加了过滤逻辑,并且保留了Unescape前的原始URL:a9be3ec

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants