how to make http://abcd.com/../../xyz/a.do work
I tried to run something like this http://abcd.com/../../xyz/a.do via browser.But it didn't succeed.
My question is can we run a url where it is fetching data from directories not child of abcd.comThanks
开发者_如何学JAVAEdit:
Let say I have this directory structure under /www/: /xzy /blah/abcd.com/And I want to access data in /xyz
No.
Relative URIs are resolved into absolute URIs by the client. ../
just causes the previous directory to be dropped. If there isn't one, then the ../
is ignored.
It would be a pretty major security problem if a web server could be instructed to fetch arbitrary content from above the web root.
That is a very old security exploit (directory traversal) that actually worked some years ago. Nowadays, web servers are not susceptible to that.
精彩评论