Ultimately the question is where does the untrusted data come ... • Aaron Parecki

50°F

Jim Manico @ Kauai https://twitter.com/manicode • Mar 31
SafeBase64 protects against path traversal or path manipulation where urlencoding and normal Base64 do not!

Ultimately the question is where does the untrusted data come from and how is it used, because URL-safe-base64-encoding a "../" will just decode to "../" on the other side.

American Airlines Flight 1986 DFW to PDX in Dallas, Texas • 82°F

Fri, Mar 31, 2023 6:00pm -05:00

1 like 2 replies
- Jim Manico @ Kauai
Have you written a response to this? Let me know the URL:
- Jim Manico @ Kauai twitter.com/manicode
  
  Just looking for safely at time of url construction. Extraction, decoding and reuse in another url will require additional encoding.
  
  Fri, Mar 31, 2023 11:16pm +00:00 (via brid.gy)
- Jim Manico @ Kauai twitter.com/manicode
  
  Most important use cases are sending data to a server that is added to a path for a REST request, SSRF weakness. Also, building dynamic URL’s in templates and web Ui’s.
  
  Fri, Mar 31, 2023 11:01pm +00:00 (via brid.gy)

Posted in /replies using indigenous.abode.pub/ios