3 ms·
Just addressing this attack in particular, is there any legitimate reason to have consecutive white spaces in a URL bar?
by cdubzzz 10y ago
Just addressing this attack in particular, is there any legitimate reason to have consecutive white spaces in a URL bar?
- contravariant 10y agoIf you accept that someone is allowed to embed text documents into a URL then you also need to either allow people to link to text documents containing large runs of white space, or introduce some very weird restrictions to the kind of documents that can be embedded that way.
- lucideer 10y ago"legitimate" is highly subjective in this instance. Personally, I would argue that there's none. The only use case I can think of is submitting a form with arbitrary text in a field value, but most such submits should be POSTed. The main exception - search keywords - are a lot less likely to need to support repeating whitespace. However, a better question is: do a lot of legitimate websites in the wild put multiple spaces in the address field. Obvious answer is that millions do, so there's nothing browsers can really do here.