¡¸´úÂëÉó¼Æ¡¹ÖªÊ¶ÐÇÇòÖÐ@1ue ·¢±íÁËһƪÓÐȤµÄÎÄÕ¡¶Ì½Ë÷Java·´ÐòÁл¯ÈÆWAFÐÂ×ËÊÆ¡·£¬ÉîÈëÑо¿ÁËÒ»ÏÂÆäÖеÄÔÀí£¬ÎÒ·¢ÏÖÕâÊÇÒ»¸ö¶ÔÎÒÀ´ËµºÜ¡°Ð¡±£¬µ«Êµ¼ÊÉÏÄê¼ÍÒѾºÜ´óµÄTrick¡£
UTF-8ÊÇÏÖÔÚ×îÁ÷ÐеıàÂ뷽ʽ£¬Ëü¿ÉÒÔ½«unicodeÂë±íÀïµÄËùÓÐ×Ö·û£¬ÓÃijÖÖ¼ÆË㷽ʽת»»³É³¤¶ÈÊÇ1µ½4λ×Ö½ÚµÄ×Ö·û¡£
²Î¿¼Õâ¸ö±í¸ñ£¬ÎÒÃǾͿÉÒÔºÜÇáËɵؽ«unicodeÂëת»»³ÉUTF-8±àÂ룺
First code point | Last code point | Byte 1 | Byte 2 | Byte 3 | Byte 4 |
---|---|---|---|---|---|
U+0000 | U+007F | 0xxxxxxx | |||
U+0080 | U+07FF | 110xxxxx | 10xxxxxx | ||
U+0800 | U+FFFF | 1110xxxx | 10xxxxxx | 10xxxxxx | |
U+10000 | U+10FFFF | 11110xxx | 10xxxxxx | 10xxxxxx | 10xxxxxx |
¾Ù¸öÀý×Ó£¬Å·Ôª·ûºÅ€µÄunicode±àÂëÊÇU+20AC£¬°´ÕÕÈçÏ·½·¨½«Æäת»»³ÉUTF-8±àÂ룺
10 0000 1010 1100
£¬½«ËùÓÐλÊý´Ó×óÖÁÓÒ°´ÕÕ4¡¢6¡¢6·Ö³ÉÈý×飬µÚÒ»×鳤¶È²»Âú4Ç°Ãæ²¹0£º0010
£¬000010
£¬101100
1110
¡¢10
ºÍ10
£¬½á¹ûÊÇ11100010
¡¢10000010
¡¢10101100
£¬¶ÔÓ¦µÄ¾ÍÊÇ\xE2\x82\xAC
\xE2\x82\xAC
¼´ÎªÅ·Ôª·ûºÅ€µÄUTF-8±àÂëÄÇô£¬Á˽âÁËUTF-8µÄ±àÂë¹ý³Ì£¬ÎÒÃǾͿÉÒÔºÜÈÝÒ×Àí½âOverlong EncodingÊÇʲôÎÊÌâÁË¡£
Overlong Encoding¾ÍÊǽ«1¸ö×Ö½ÚµÄ×Ö·û£¬°´ÕÕUTF-8±àÂ뷽ʽǿÐбàÂë³É2λÒÔÉÏUTF-8×Ö·ûµÄ·½·¨¡£
ÈÔÈ»¾ÙÀý˵Ã÷£¬±ÈÈçµãºÅ.
£¬Æäunicode±àÂëºÍascii±àÂëÒ»Ö£¬¾ùΪ0x2E
¡£°´ÕÕÉÏ±í£¬ËüÖ»Äܱ»±àÂë³Éµ¥×Ö½ÚµÄUTF-8×Ö·û£¬µ«ÎÒ°´ÕÕÏÂÃæµÄ·½·¨½øÐÐת»»£º
0x2E
µÄ¶þ½øÖÆÊÇ10 1110
£¬ÎÒ¸øÆäÇ°Ãæ²¹5¸ö0£¬±ä³É00000101110
00000
£¬101110
110
£¬10
£¬½á¹ûÊÇ11000000
£¬10101110
£¬¶ÔÓ¦µÄÊÇ\xC0AE
0xC0AE
²¢²»ÊÇÒ»¸öºÏ·¨µÄUTF-8×Ö·û£¬µ«ÎÒÃÇȷʵÊÇ°´ÕÕUTF-8±àÂ뷽ʽ½«Æäת»»³öÀ´µÄ£¬Õâ¾ÍÊÇUTF-8Éè¼ÆÖеÄÒ»¸öȱÏÝ¡£
°´ÕÕUTF-8µÄ¹æ·¶À´Ëµ£¬ÎÒÃÇÓ¦¸ÃʹÓÃ×Ö·û¿ÉÒÔ¶ÔÓ¦µÄ×îС×Ö½ÚÊýÀ´±íʾÕâ¸ö×Ö·û¡£ÄÇô¶ÔÓÚµãºÅÀ´Ëµ£¬¾ÍÓ¦¸ÃÊÇ0x2e¡£µ«UTF-8±àÂëת»»µÄ¹ý³ÌÖУ¬²¢Ã»ÓÐÏÞÖÆÍùÇ°²¹0£¬µ¼ÖÂת»»³öÁË·Ç·¨µÄUTF-8×Ö·û¡£
ÕâÖÖ¹¥»÷·½Ê½¾Í½Ð¡°Overlong Encoding¡±¡£
Overlong Encodingʵ¼ÊÉϺÜÔç¾Í±»Ìá³öÁË£¬Ôçµ½ÄÇʱºòÎÒ»¹Ã»¿ªÊ¼Ñ§°²È«¡£ºÜ¶àÓïÑÔÔÚʵÏÖUTF-8µÄת»»Ê±£¬»á¶ÔÕâ¸ö¹¥»÷·½Ê½×öÒ»¶¨¼ì²é¡£±ÈÈ磬PythonÖÐÈç¹ûÄãÏ뽫0xC0AE
ת»»³ÉµãºÅ£¬¾Í»áÅ׳öÒì³££º
b'\xC0\xAE'.decode()
µ«ÎÒÃÇÖÊÆÓ¸Õ½¡µÄJavaÉú̬£¬ÔںܶàµØ·½ÊÇûÓжÔÆä½øÐзÀÓùµÄ£¬Õâ¾Íµ¼ÖÂÁËһЩ°²È«ÎÊÌâ¡£
Èç¹û¶Ô°²È«ÊìϤµÄ¶ÁÕߣ¬¿´µ½Ç°ÃæµÄ0xC0AE
£¬ÆäʵӦ¸ÃºÜ¿ìÏëÆðÀ´Ò»¸ö¾µä©¶´¡ª¡ªGlassFish ÈÎÒâÎļþ¶Áȡ©¶´¡£
Õâ¸ö©¶´¾ÍÊÇÔÚURLÖÐʹÓÃ%C0%AE
À´´úÌæµãºÅ.
£¬ÈƹýĿ¼´©Ô½µÄÏÞÖÆ£¬µ¼ÖÂÈÎÒâÎļþ¶Áȡ©¶´£º
ÆäÔÀí¾ÍÊÇGlassFishÔÚ·¾¶½âÂëʱʹÓÃUTF-8±àÂ룬ºÜµäÐ͵ÄOverlong EncodingÀûÓá£
»Øµ½±¾ÎÄ¿ªÍ·µÄÎÄÕ£¬Æäʵ@1ue ÊÇÍêÈ«ÔÚ·ÖÎö·´ÐòÁл¯´úÂëµÄʱºò·¢ÏÖÁËÕâ¸öÎÊÌ⣬»»¾ä»°Ëµ£¬¾ÍµÈÓÚ°ÑOverlong Encoding¹¥»÷ÖØз¢ÏÖÁËÒ»±é£¬»¹ÊÇͦÀ÷º¦µÄ¡£
JavaÔÚ·´ÐòÁл¯Ê±Ê¹ÓÃObjectInputStream
À࣬Õâ¸öÀàʵÏÖÁËDataInput
½Ó¿Ú£¬Õâ¸ö½Ó¿Ú¶¨ÒåÁ˶ÁÈ¡×Ö·û´®µÄ·½·¨readUTF
¡£ÔÚ½âÂëÖУ¬Javaʵ¼ÊʵÏÖµÄÊÇÒ»¸öħ¸Ä¹ýµÄUTF-8±àÂ룬ÃûΪ¡°Modified UTF-8¡±¡£
²Î¿¼ÆäÎĵµ¿ÉÒÔ·¢ÏÖ£¬¡°Modified UTF-8¡±ÀàËÆÓÚMySQLÖеÄUTF8£¬Ö»Ê¹ÓÃÈý¸ö×Ö½ÚÀ´±íʾ£º
µ«ÆäÈý×Ö½ÚÒÔÄÚµÄת»»¹ý³ÌÊǺÍUTF-8ÏàͬµÄ£¬ËùÒÔÈÔÈ»¼Ì³ÐÁË¡°Overlong Encoding¡±È±ÏÝ¡£
¹¥»÷Õß¿ÉÒÔ½«·´ÐòÁл¯×Ö½ÚÁ÷ÀïһЩ×Ö·û°´ÕÕ¡°Overlong Encoding¡±µÄ·½·¨×ª»»³É·Ç·¨UTF-8×Ö·û£¬ÓÃÀ´ÈƹýһЩ»ùÓÚÁ÷Á¿µÄ·ÀÓù·½·¨¡£
ÎÒдÁËÒ»¸ö¼òµ¥µÄPythonº¯Êý£¬ÓÃÓÚ½«Ò»¸öASCII×Ö·û´®×ª»»³ÉOverlong EncodingµÄUTF-8±àÂ룺
def convert_int(i: int) -> bytes:
b1 = ((i >> 6) & 0b11111) | 0b11000000
b2 = (i & 0b1111111) | 0b10000000
return bytes([b1, b2])
def convert_str(s: str) -> bytes:
bs = b''
for ch in s.encode():
bs += convert_int(ch)
return bs
if __name__ == '__main__':
print(convert_str('.')) # b'\xc0\xae'
print(convert_str('org.example.Evil')) # b'\xc1\xef\xc1\xf2\xc1\xe7\xc0\xae\xc1\xe5\xc1\xf8\xc1\xe1\xc1\xed\xc1\xf0\xc1\xec\xc1\xe5\xc0\xae\xc1\xc5\xc1\xf6\xc1\xe9\xc1\xec'
²Î¿¼Á´½Ó£º
±¾ÎÄ·ÖÏí×Ô ×÷Õ߸öÈËÕ¾µã/²©¿Í?Ç°Íù²é¿´
ÈçÓÐÇÖȨ£¬ÇëÁªÏµ cloudcommunity@tencent.com ɾ³ý¡£
±¾ÎIJÎÓë?ÌÚѶÔÆ×ÔýÌå·ÖÏí¼Æ»®? £¬»¶ÓÈÈ°®Ð´×÷µÄÄãÒ»Æð²ÎÓ룡