Hacker News new | past | comments | ask | show | jobs | submit login

> and may in fact be a symptom of deeper string-validation issues

It may also be a sign that there's a very early filtering stage that drops request at a very remote edge, which is a very good thing to do. See [0]; basically, you configure your server to completely drop requests that contain any character that has any possibility of being suspicious.

[0] http://twiki.org/p/pub/Support/ConfigureFailsOnNext/mod_secu...




I think you meant to post in a different thread?


It's a response to the "Big List of Naughty Strings" article, liked from the Every Programmer Should Know List.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: