Here’s the problem I’m working on: bots probing my site for vulnerabilities will try injecting special character sequences into params, like /articles/abc%DE~%C7%1FY, which becomes the binary <<97, 98, 99, 222, 126, 199, 31, 89>>, which is not a valid string. No doubt this attack targets Oracle Ser…

You could add a plug which checks the :request_path. Something like this: plug fn (conn, _opts) -> if String.valid?(conn.request_path) do conn else conn |> Plug.Conn.put_status(:im_a_teapot) |> Plug.Conn.halt() end end This is a quick draft based on the docs. You might want t…

Thanks! I realized I could modify your suggestion to use the Plug validation function and throw a relevant exception, mimicking the behavior of the other param parsing: plug :validate_path_utf8 defp validate_path_utf8(conn, _opts) do conn.request_path |> URI.decode() |> Plug.Conn.Ut…

As to a different part of your question, I don’t think the standard requires the path to be valid UTF8. If I’m right, it wouldn’t be appropriate for the default behavior to require it–leaving it up to devs to check the path for stricter requirements would be right. (After all, the path used to comm…

I cede to your superior google-fu

[image] malaire: Current URL standard seems to be based on valid UTF-8 encoding. Agreed, that’s how I read this sentence in Section 1.3 : Sequences of percent-encoded bytes , percent-decoded , should not cause UTF-8 decode without BOM or fail to return failure. I imagine this is why Plug.P…

I have never heard of that standard, but instead used RFC 3986 as a reference, where they explicitely state, that the standard does not define any particular encoding, but uses US-ASCII throughout the document. Section 2, 1. paragraph: […] This specification does not mandate any particular chara…

These new “Living Standards” seem to be quite new. But W3C does say that for HTML the WHATWG standard is current standard: HTML Standard is the current HTML standard. It obsoletes all other previously-published HTML specifications. And that WHATWG HTML Standard refers to this URL Standard . In G…

Elixir Programming Language Forum

Handling invalid UTF-8 strings from URL path params

Questions & Help Questions

malaire July 15, 2020, 7:17pm 5

Current URL standard seems to be based on valid UTF-8 encoding.