开发者

how to make http://abcd.com/../../xyz/a.do work

I tried to run something like this http://abcd.com/../../xyz/a.do via browser.But it didn't succeed.

My question is can we run a url where it is fetching data from directories not child of abcd.com

Thanks

开发者_如何学JAVA

Edit:

Let say I have this directory structure under /www/:

/xzy

/blah/abcd.com/

And I want to access data in /xyz


No.

Relative URIs are resolved into absolute URIs by the client. ../ just causes the previous directory to be dropped. If there isn't one, then the ../ is ignored.

It would be a pretty major security problem if a web server could be instructed to fetch arbitrary content from above the web root.


That is a very old security exploit (directory traversal) that actually worked some years ago. Nowadays, web servers are not susceptible to that.

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜