Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I recently noticed that some people accidentally will use special characters at the end of a URL to link to a site. Example: .html%C2%A0

Some people will also try to inject escape sequences like \x18\xbaL\x03@\xea$\x03HZm (known apache vulnerability) to hack your Apache server

So, my question is wouldn't it be smart to disallow any characters after .html and simply rewrite it? Wouldn't that make it more difficult to inject anything into an URL?

I haven't tested the rule yet, but it will look similar to this in the end:

RewriteRule (.*)\.html.+ /$1\.html [R=301,L]

Thanks Oliver

share|improve this question

1 Answer 1

up vote 0 down vote accepted

This really won't provide additional security - and if it ever does cause any issues (not terribly likely, but what if I use a directory named "mysitefiles.htmldocuments"?), it'll just be extra complexity to debug.

Put up a nice helpful 404 page for the bad links, and if someone's going to throw an 8-year-old character injection vulnerability at you, they can do it just as easily against a URL that doesn't end in HTML, or stick it earlier in the URL.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.