[TYPO3-dev] Storing URLs to the DB: encoded or not?

[Helmut Hummel]

Hi Christian,

On 07.12.14 21:58, Christian Stüdemann wrote:

> where do you do the urlencode?

What exactly do you mean with urlencode?

Do you really mean the rawurlencode() PHP function?
Or do you mean something like htmlspecialchars()?

To rawurlencode() an uri does not make sense unless you use it as 
argument value in (another) URI.

For the following I assume you mean htmlspecialchars()

> Do you do the urlencode in the view and
> the url/uri is stored to the DB in decoded format? Or do you store the
> url/uri encoded to the DB and do no encoding in the view at all?

> I would prefer encoding in the view in order to make sure that each and
> everything (no matter which source it comes from) is encoded for
> security reasons...

You answered your question yourself already :)

To explain it a bit:

When it comes to encoding of a value there are two rules:

1. Always encode directly before you use it in a certain context
2. Use the appropriate encoding for the context

e.g. $value is you value to be used (pseudo code):

<h1><?php htmlspecialchars($value) ?></h1>
<script>a=<?php GeneralUtility::quoteJSvalue($value) ?></script>

$db->exec_SELECTQuery('*', 'table', 'foo=' . $db->fullQuoteStr($value));

...

The reasons are simple:

1. At the point you are using a value in a certain context, you don't 
know where the value comes from. The only way to avoid security issues 
is to correctly encode it there.

2. If you would (additionally) encode your URI for HTML before storing 
it in the database, you will never be able to use this value from db in 
any other context (JavaScript, HTTP redirect ...) than for inserting it 
in an HTML context.

HTH

Kind regards,
Helmut

-- 
Helmut Hummel
Release Manager TYPO3 6.0
TYPO3 CMS Active Contributor, TYPO3 Security Team Member

TYPO3 .... inspiring people to share!
Get involved: typo3.org