mod_rewrite NE 标志 - 何时在 URL 中编码特殊字符有帮助? [英] mod_rewrite NE flag - When is it helpful to encode special chars in the URL?

问题描述

我一直在查看 mod_rewrite 中的 [NE] (noescape) 标志.经过一番思考，我想不出我不想想要使用该标志的情况.这意味着，在几乎每个 RewriteRule 中保持启用标志似乎最有帮助.在某些情况下，不调用此标志会导致我出现问题.

I've been looking at the [NE] (noescape) flag in mod_rewrite. After some thought I couldn't figure out a situation when I would NOT want to use the flag. Meaning, it seems most helpful to keep the flag enabled in almost every RewriteRule. Not invoking this flag has caused me problems in a few circumstances.

我处理的大多数规则都是 HTTP 重定向([R])，而不是通过.

Most of the rules that I deal with are HTTP redirects ([R]), rather than passing through.

有人会解释什么时候让 mod_rewrite 对 URL 进行编码有帮助吗?

启用此标志或使用允许 mod_rewrite 转义这些特殊字符的默认行为通常是一种好习惯吗?为什么?

Is it generally good practice to enable this flag, or use the default behavior of allowing mod_rewrite escape these special characters? Why?

推荐答案

如果你看一下 mod_rewrite 的源代码，你会注意到它设置了一个 proxy-nocanon 标志如果 noescape 已启用.

If you look at the source code for mod_rewrite, you'll notice that it sets a proxy-nocanon flag if noescape is enabled.

在修改了第一次添加该行的地方，它还包含了这条评论:

In the revision where that line was first added, it also included this comment:

确保 mod_proxy_http 没有规范化 URI，并在 mod_proxy_http:proxy_http_canon() 的文件名中保留任何(可能是 qsappend 的)查询字符串

make sure that mod_proxy_http doesn't canonicalize the URI, and preserve any (possibly qsappend'd) query string in the filename for mod_proxy_http:proxy_http_canon()

接下来，如果您阅读 mod_proxy 文档，您会看到以下提到的 nocanon:

Following on from that, if you read the mod_proxy documentation, you'll see the following mention of nocanon:

通常，mod_proxy 会规范化 ProxyPassed URL.但这可能与某些后端不兼容，尤其是那些使用 PATH_INFO 的后端.可选的 nocanon 关键字抑制了这一点，并将 URL 路径raw"传递给后端.请注意，这可能会影响后端的安全性，因为它会取消代理提供的针对基于 URL 的攻击的正常有限保护.

Normally, mod_proxy will canonicalise ProxyPassed URLs. But this may be incompatible with some backends, particularly those that make use of PATH_INFO. The optional nocanon keyword suppresses this, and passes the URL path "raw" to the backend. Note that may affect the security of your backend, as it removes the normal limited protection against URL-based attacks provided by the proxy.

我可能弄错了，但这对我来说意味着在 mod_proxy 中使用 nocanon(以及在 mod_rewrite 中扩展 noescape)具有潜在的安全后果.这将解释为什么默认情况下禁用它，甚至认为在大多数情况下启用它似乎更有用.

I'm may be mistaken, but that implies to me that the use of nocanon in mod_proxy (and by extension noescape in mod_rewrite) has potential security ramifications. That would explain why it is disabled by default, even thought it seems like it would be more useful to have it enabled in most cases.

这篇关于mod_rewrite NE 标志 - 何时在 URL 中编码特殊字符有帮助?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！