I'm maintaining a legacy web application which is composed of the application itself, accessible to the public, and the REST services which can be accessed only by the application through the LAN. At one point, the application performs a request to a URI of a service which looks like this:
GET https://internal-service/hello/world/user-input
Here, user-input
is based on something the user entered, and which is encoded by the application to prevent the user from injecting slashes and other special characters. The encoding is done by calling an appropriate (and reliable) function from the framework.
However, services are separated from the application by a reverse proxy which have a bunch of weird rules. One of them is that there should be no dots in an URI. To cope with this restriction, I replace all the dots from the encoded string by %2E
.
For instance, the input: “a/b.c” would lead the following URI to be called:
GET https://internal-service/hello/world/a%2Fb%2Ec
since the first step would produce “a%2Fb.c” and then the second step would replace the dot.
By doing that, am I jeopardizing the security of the whole system, by making it possible for the user to somehow inject unauthorized characters in the URI?
I'm afraid that there might be a quirk related to the way such string would be decoded to an UTF-8 string, i.e. that a specially crafted Unicode character followed by a dot would be encoded to %??%2E
which, in turn, would be decoded not to the same character followed by a dot, but by a completely different single character. Or, for instance, I would imagine it to be decoded to a question mark—a character which has a special meaning in an URI.
Is it possible?
Are there other risks?