url 编码 保留冒号_URI编码解惑

What is a URI?

A Uniform Resource Identifier (URI) provides a simple and extensible means for identifying a resource.
The term "Uniform Resource Locator" (URL) refers to the subset of URIs that, in addition to identifying a resource, provide a means of locating the resource by describing its primary access mechanism(e.g., its network "location").
The term "Uniform Resource Name" (URN) has been used historically to refer to both URIs under the "urn" scheme [RFC2141], which are required to remain globally unique and persistent even when the resource ceases to exist or becomes unavailable, and to any other URI with the properties of a name.
Future specifications and related documentation should use the general term "URI" rather than the more restrictive terms "URL" and "URN" [RFC3305].
Uniform Resource Identifier (URI): Generic Syntax​tools.ietf.org

从最新的URI RFC 3986可以看出,URI提供了一种简单、可以扩展的方式来定位一个资源,URL是URI的一个子集,必然也遵循URI标准,未来所有标准应该使用URI来替代URL和URN,从历史中各个URX的出现和发展看,当前URI是一个综合了历史上各个规范的通用规范。

URI结构

fe75a47f1c5147832d51bce9c1f47c2b.png
URL encoding the space character: + or %20?​stackoverflow.com
9b4c69e155c8fdf1fa90c502820d8155.png

URI字符类型

保留字符和非保留字符

c60e6c521b75c011ed6d7da42ae55437.png

保留字的编码(%+ascii十六进制)

8d9027340b37f0666c88f6d181e4dcca.png
https://en.wikipedia.org/wiki/Percent-encoding​en.wikipedia.org
  1. 非保留字符无需转义,保留原样
  2. 保留字符需要根据不同的上下文位置进行转义,换句话说就是在不同的URI结构部分中,保留字的是否需要转义不太一样,但不论是否有特殊意义,都转义也没错,如果不知道是否需要转义,那就都转义吧
  3. 如果不是保留字也不是非保留字,那么必须编码,需要先将字符转为utf-8字节序列,然后每个字节转为:%+字节的十六进制表示

特殊的application/x-www-form-urlencoded

在Form请求中有两种数据格式:application/x-www-form-urlencoded和multipart/form-data,通常默认是前者,后者通常用于文件上传

application/x-www-form-urlencoded遵循的是html和xform标准,虽然也在不断进化,比如,用+代替了%20,但依然比较古老

要注意的地方在于:GET和POST的区分,当用GET请求时,form数据会变成URI的query部分,遵循URI标准,但用POST的时候遵循的是html和xform标准

这个地方有点坑,好在目前大多数语言和浏览器都能很好的处理这种情况,一般不会遇到问题,而且现在越来越多的人开始用application/json作为请求头,用来告诉服务端消息主体是序列化后的 JSON 字符串,x-www-form-urlencoded用的也越来越少了

常见问题

1. 空格在URI中到底用"+" 还是 "%20" ?

在URI的path部分,空格需要转成%20,而在query部分,空格需要转成+号

2. escape or encodeURI

escape:

  • 不对 ASCII 字母、数字进行编码
  • 不对 *@-_+./ 进行编码
  • 其他所有的字符都会被转义序列替换

encodeURI:

  • 不对 ASCII 字母和数字进行编码
  • 不对 -_.!~*'();/?:@&=+$,# 这20个ASCII 标点符号进行编码
  • 其他所有的字符都会被转义序列替换

encodeURI遵循3896标准

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
suricata中void DetectHttpUriRegister (void) { /* http_uri content modifier / sigmatch_table[DETECT_AL_HTTP_URI].name = "http_uri"; sigmatch_table[DETECT_AL_HTTP_URI].desc = "content modifier to match specifically and only on the HTTP uri-buffer"; sigmatch_table[DETECT_AL_HTTP_URI].url = "/rules/http-keywords.html#http-uri-and-http-uri-raw"; sigmatch_table[DETECT_AL_HTTP_URI].Setup = DetectHttpUriSetup; #ifdef UNITTESTS sigmatch_table[DETECT_AL_HTTP_URI].RegisterTests = DetectHttpUriRegisterTests; #endif sigmatch_table[DETECT_AL_HTTP_URI].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_CONTENT_MODIFIER; sigmatch_table[DETECT_AL_HTTP_URI].alternative = DETECT_HTTP_URI; / http.uri sticky buffer / sigmatch_table[DETECT_HTTP_URI].name = "http.uri"; sigmatch_table[DETECT_HTTP_URI].alias = "http.uri.normalized"; sigmatch_table[DETECT_HTTP_URI].desc = "sticky buffer to match specifically and only on the normalized HTTP URI buffer"; sigmatch_table[DETECT_HTTP_URI].url = "/rules/http-keywords.html#http-uri-and-http-uri-raw"; sigmatch_table[DETECT_HTTP_URI].Setup = DetectHttpUriSetupSticky; sigmatch_table[DETECT_HTTP_URI].flags |= SIGMATCH_NOOPT|SIGMATCH_INFO_STICKY_BUFFER; DetectAppLayerInspectEngineRegister2("http_uri", ALPROTO_HTTP1, SIG_FLAG_TOSERVER, HTP_REQUEST_LINE, DetectEngineInspectBufferGeneric, GetData); DetectAppLayerMpmRegister2("http_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetData, ALPROTO_HTTP1, HTP_REQUEST_LINE); DetectAppLayerInspectEngineRegister2("http_uri", ALPROTO_HTTP2, SIG_FLAG_TOSERVER, HTTP2StateDataClient, DetectEngineInspectBufferGeneric, GetData2); DetectAppLayerMpmRegister2("http_uri", SIG_FLAG_TOSERVER, 2, PrefilterGenericMpmRegister, GetData2, ALPROTO_HTTP2, HTTP2StateDataClient); DetectBufferTypeSetDescriptionByName("http_uri", "http request uri"); DetectBufferTypeRegisterSetupCallback("http_uri", DetectHttpUriSetupCallback); DetectBufferTypeRegisterValidateCallback("http_uri", DetectHttpUriValidateCallback); g_http_uri_buffer_id = DetectBufferTypeGetByName("http_uri"); 每一句都加上详细的注释
05-25

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值