How do you safely do this? HTTPS://site.com/data/ + protect(untrusted); URL encoding is not the answer, it still allows path traversal. Base64 encoding is not the answer, the + and / characters, legal in base64, can skew a URL.
8
2
6
Replying to @manicode
what kind of protection? A JWT could work there, it uses only URL safe characters, and is integrity protected. If you don't need integrity protection then just URL safe Base64 I guess

Mar 31, 2023 · 10:48 PM UTC

1
1
Replying to @aaronpk
SafeBase64 protects against path traversal or path manipulation where urlencoding and normal Base64 do not!
1
Ultimately the question is where does the untrusted data come from and how is it used, because URL-safe-base64-encoding a "../" will just decode to "../" on the other side.
2
1
more replies