29

我有一个资源,. 这意味着我的 url 看起来像这样: http://myapp/index/. 我需要添加查询参数,使其看起来像这样: http://myapp/index/.?type=xml 我使用Freemarker来展示我的资源,并针对这种情况进行了百分比编码破解:

<#if key?matches("\\.")>
<li><a href="${contextPath}/index/%2E">${key}</a></li>
</#if>

这适用于 Firefox。但所有其他浏览器,如 IE、Safari、Chrom、Opera 都会忽略我的 url 编码点 ( http://myapp/index/%2E)。

有什么建议么?

4

2 回答 2

25

It's actually not really clearly stated in the standard (RFC 3986) whether a percent-encoded version of . or .. is supposed to have the same this-folder/up-a-folder meaning as the unescaped version. Section 3.3 only talks about “The path segments . and ..”, without clarifying whether they match . and .. before or after pct-encoding.

Personally I find Firefox's interpretation that %2E does not mean . most practical, but unfortunately all the other browsers disagree. This would mean that you can't have a path component containing only . or ...

I think the only possible suggestion is “don't do that”! There are other path components that are troublesome too, typically due to server limitations: %2F, %00 and %5C sequences in paths may also be blocked by some web servers, and the empty path segment can also cause problems. So in general it's not possible to fit all possible byte sequences into a path component.

于 2010-10-04T16:16:18.383 回答
13

这不可能。§2.3说“。” 是一个未保留字符,并且“在用相应的百分比编码的 US-ASCII 八位字节替换未保留字符方面不同的 URI 是等效的”。因此,/%2E%2E/与 相同/../,这将被规范化。

(这是 bobince 的回答和 slowpoison 的评论的组合。)

于 2014-07-21T14:18:29.233 回答