ESAPI Encoder Canonizes Changing Request Parameters

Question

One of my REST APIs has a query parameter called "partners", which is a list of integers, so you can specify multiple values ​​in the URL. To prevent XSS attacks, I remove malicious content in the input using ESAPI. Here is the problem:

I noticed that the cannonicalize method for the ESAPI encoder (which uses the default codecs: HTMLEntityCodec, PercentCodec, JavaScriptCodec) changes the values ​​of the request parameters because it considers & p or & pa to be some encoding. See examples below.

Sort of

http://localhost:8080/product?partner=1

It works as expected.

On the other hand, something like

http://localhost:8080/product/?pidentity=1&pidentity=2

Entrance after canonization becomes

   `pidentity=1πdentity=2`

, , .

URL-

http://localhost:8080/product?partner=1&partner=2

partner=1∂rtner=2

& pa '∂'.

, , , , (, , ). - , ? , XSS , .

Answer 1

, , - , " ", URL-, , (.. )

, . , "" "" , .

partner = 1 & partner = 2 ,

= 1 & = 2

(, , - ) - , control .

1 & partner = 2,

= 1% 26partner = 2 & = 2

, , , .

, , URL.

:

• https://www.owasp.org/index.php/Double_Encoding
• https://www.owasp.org/index.php/Mixed_encoding
• https://www.owasp.org/index.php/Category:Encoding