WebApp Sec mailing list archives
Re: Canonicalization
From: Peter Conrad <conrad () tivano de>
Date: Fri, 21 Apr 2006 09:19:04 +0200
Hi, On Thu, Apr 20, 2006 at 10:22:18PM -0400, Rossen Raykov wrote:
Is that ?simplest form? achievable? One can perform many and different encodings making the task of decoding them very difficult and resource consuming. Usually it is cheaper and safeties to do semantic checkup and treat the input as erroneous if it does not confirm to the expected input format.
you're comparing apples with oranges here. You must perform canonicalization *before* you can match the input against the expected format.
For example if you are expecting number anything different than a number is error.
Here are some different representations of the same number: 11 +11 11.0 11.00 011 All of these should pass as numbers. But if you want to check if the number is in a specific range, you must canonicalize it first. E. g. some programming languages treat numbers with leading 0 as octal numbers, which means that "011" is actually 9, not 11. Canonicalization prevents that kind of confusion. Bye, Peter -- Peter Conrad Tel: +49 6102 / 80 99 072 [ t]ivano Software GmbH Fax: +49 6102 / 80 99 071 Bahnhofstr. 18 http://www.tivano.de/ 63263 Neu-Isenburg Germany ------------------------------------------------------------------------- This List Sponsored by: SPI Dynamics ALERT: "How A Hacker Launches A Web Application Attack!" Step-by-Step - SPI Dynamics White Paper Learn how to defend against Web Application Attacks with real-world examples of recent hacking methods such as: SQL Injection, Cross Site Scripting and Parameter Manipulation https://download.spidynamics.com/1/ad/web.asp?Campaign_ID=701300000003gRl --------------------------------------------------------------------------
Current thread:
- Canonicalization susam_pal (Apr 12)
- Re: Canonicalization Yann (Apr 12)
- Re: Canonicalization Rogan Dawes (Apr 12)
- <Possible follow-ups>
- RE: Canonicalization PPowenski (Apr 12)
- Re: Canonicalization Andrew van der Stock (Apr 12)
- Re: Canonicalization Rossen Raykov (Apr 20)
- Re: Canonicalization Peter Conrad (Apr 21)
- Re: Canonicalization exon (Apr 21)
- Re: Canonicalization Jason Murray (Apr 23)
- Re: Canonicalization exon (Apr 24)
- Re: Canonicalization Rossen Raykov (Apr 20)
- Re: Canonicalization Yann (Apr 12)
- Re: Canonicalization Eoin (Apr 21)
- Re: Canonicalization Andrew van der Stock (Apr 22)
- Re: Canonicalization Rogan Dawes (Apr 14)
- Re: Canonicalization Jason (Apr 14)
- Re: Re: Canonicalization Mariusz Pękala (Apr 14)