What are the security risks of allowing all charac

问题:

I'm using the Codeigniter PHP framework. In one of the config files, you can set the allowed URL characters:

$config['permitted_uri_chars'] = 'a-z 0-9~%.:_\-'; 

So if I attempt to go to this url: website.com/controller/%22quotedString%22, I will get an error unless I append a quote to the permitted characters:

$config['permitted_uri_chars'] .= '"'; 

My application actually needs to allow all weird characters in the URL, but I don't want have a huge hardcoded list of characters. Codeigniter warns against allowing all characters:

/*
|--------------------------------------------------------------------------
| Allowed URL Characters
|--------------------------------------------------------------------------
|
| As a security measure you are STRONGLY encouraged to restrict URLs to
| as few characters as possible.  By default only these are allowed: a-z 0-9~%.:_-
|
| Leave blank to allow all characters -- but only if you are insane.
|
| DO NOT CHANGE THIS UNLESS YOU FULLY UNDERSTAND THE REPERCUSSIONS!!
|
*/

They don't say exactly what are security issues with allowing all characters. So what are the issues?

回答1:

There are no inherent security risks to allowing all possible characters in your URL. Security issues depend on what your application does with them.

回答2:

See this answer. It pretty much explains what a user can do if you allow them to do whatever they want :) Basically, by not allowing '<' and "'" in your urls, you defend yourself from XSS and SQL Injections. However, if you escape properly and control everything I believe there is no problem in allowing all characters in a URL.