Forum OpenACS Q&A: Response to TCL, Filters, Security

Collapse
Posted by Jens Strupp on
Let me be more specific with an example:

How does TCL work with Unicode chars that come in via
ns_conn url? (and are used later with ad_conn url);

This was a well known problem for (mostly) M$ servers:

http://www.yourxyzsite.com/..%c0%af../
(this becomes "/../../")

or, what happens if you place an index.adp file in the directory
above "pages" and do:

http://www.yourxyzsite.com/..%c0%af

or: http://www.yourxyzsite.com/..%c0%afindex.adp

Does the index.adp come up?
(I have no installation to test it myself at the moment).

How can a Unicode string be transformed to the normal ascii
representation in TCL? (of course, only if it's within the
ascii-range like above)

Thanks.