Canonicalize()
Canonicalization is simply the operation of reducing a potentially encoded, query string down to its simplest form.
This is important, because attackers frequently use encoding to change their input in a way that will bypass validation filters, but still be interpreted properly by the target of the attack.
Note that data encoded more than once is not something that a normal user would generate and should be regarded as an attack.
Requires Extension: ESAPI extension
Canonicalize( input=string, restrictMultiple=boolean, restrictMixed=boolean, throwOnError=boolean );
Returns: String
Examples
plain = "<";
plain_bad = "%26lt; %26lt; %2526lt%253B %2526lt%253B %2526lt%253B";
dump(Canonicalize(plain,true,true));
// checking for malicious string
try {
dump(Canonicalize(plain_bad,true,true).LogMessage);
} catch (Any e) {
dump(var = e.LogMessage, label = "exception message");
}
See also
- Encode/Decode
- Parsing
- Internet Protocols
- Search Issue Tracker
- Search Lucee Test Cases (good for further, detailed examples)