URL Parsing Full Guide: scheme, host, query and abnormal links

1. Standard parts contrast

An example (the example of a URL in the tool) is given:

https://www.example.com:8080/path/to/resource?id=123&category=web&utm_source=google#details

The tool is analyzed and displayed:

• Visualization of StructuresColour Session
• Foundation componentCards (href, protocol, hostname, port, pathname, origin, Hash), copyable
• Query Parameter TableKey pairing (passing) URLSearchParams) and can copy a single value

Achieve a browser-based approach URL Construct functions; None :// It automatically presets http:// Re-deconcile.

2. Analysis of the vs code: When and by whom

PUT:(b) The use of a solver for structural problems; character escapes the encoder.

3. Unusual and "can read but not be correct"

Example of intentional unlawful (do not expect stable resolution):

https://exa mple.com/path
http://[断掉It's...IPv6
not a url at all%%%

Should be completed as a valid absolute URL or clearly as a relative path (relative path pairs) URL There is a constant need for a base, which is mainly oriented towards complete absolute form).

4. Phased operation

1. Open /tools/dev/url-parser。
2. Paste complete URLs into text boxes; Support oninput Instant Parsing- I can do it. Parsing Now。
3. See if the structure is consistent with expectations (agreement/ host/ port/ path/ query/ Hash).
4. Confirm hostname, port (default display) and pathname in widget cards.
5. Check UTM, id, etc. on the parameter table line by line; Points Copy Take the single value.
6. Points Example URL (b) The possibility of including examples of learning;Empty End debugging.
7. If a parameter value is still %E4%B8%AD... Or you need to recode it to URL encoding。

Capacity boundaries

• Support: Parsing displays, adding http, argument tables, copying, examples, themes when protocols are missing.
• The title contains "Construction": The project is based on a process of analysis and presentation. Complex interactive re-entry is based on the actual control of the page (the current main path is the resolution).
• No substitute: Full text of catch-up tools, service-end truth, open-directed security audits.

Common intercommation error tables

6. Real work scene

Scenario A: Market Department UTM Long Chain

Check in argument table after pasting utm_source / utm_campaign Whether to be cut by the mail client. The chain is regenerated with a 2-D code.

Scenario B: Open Redirection Suspect

Parsing redirect Parameter values are absolute URLs in the outer field. The security strategy should verify the list of permitted items; The tools only help you.Yeah.Target, do not make a list of permissions for you.

C: Controversy over path

Front Path /app/users/1 With API https://api.example.com/v1/users/1 Mix in the log. Read hostname and pathname separately after parsing, avoiding spelling the front base into API host.

scene D: Gateway 400

Copy "failed request URL" from browser, parse Query; It's often found multiple encoded %2520 or the required key is missing. Use the encoding tool to decode the suspicious value.

scene E: MoveendDeep Link

myapp://product/5?ref=xx Class custom scheme: Modern URL Probably solves protocol with path, but the end of WebView acts differently. is the document on the end, and the tool is structured.

Scenario F: Documentation and teaching

(a) Generate structured presentations using example buttons; Replaces it with a false domain name and avoids writing real sessions query (including token) into open documents.

7. Security attention

• Query access_token、code、email You can play Header without URLs.
• The results of the analysis are copied to the pre-worksheet dissensitisation.
• The userrinfo password is considered leaked and rotated.
• The blogger says that the "URL" is not a "unsettled" security issue. Encoding is not encrypted.

8. How to select the tools

9. Collaboration agreement proposal

• API documents state whether array parameters are linked by a repeat key or a comma.
• (b) Prohibit the transmission of long-term keys to query; - Ow, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh, oh.
• Logs are used to unplug out known sensitive keys when printing URLs.
• Short-chain service maintains the original test example for query.
• A copy of the "standard model URL" is stored back and forth and is being taught in a parser.

FAQ

How the results are resolved into business code

Each part of the solver displays should be mapped to a clear field: protocol determines the transfer policy, host and port determines the connection target, path determines the resource, query parameters determines the screening conditions, and the clips are usually used only at the browser end. Do not type the whole URL directly into SQL, command line or HTML; Checks the permitted characters and lengths by field, and then hands them to the corresponding encoder. When you redirect, Webbook or return your address, you also need to verify the protocol white list, host white list and port range, avoiding using a " desolved " string as the " securely accessible " address.

If input may be a relative path, the business code must provide a credible base URL and check the final origin again after the resolution. Internationalized domain names, IPv6 addresses and duplicate parameters should also be included in the test sample, whether the full value is to be retained, the first value is to be taken or the request is to be refused. The tool is used for rapid dismantling and review, and the final rules should be deposited in the service-end validation and automation tests.

Cache and Audit After Dissolved

If the resolution results are to be entered into a cache, log or database, it is recommended that the original input, the standardized URL and the split fields be retained together and that the time and source of the resolution be recorded. No unauthorized deletion of repeat parameters, tail slash or case-writing information is allowed in the regularization unless the business has identified these differences as equivalent. Proxy, re-direction and signature processes may all rely on original bytes, and early regularization may make it difficult to repeat problems.

An authorized list of protocols, hosts and ports is also set for external jump addresses, and a user name, password or segment is de-referral or dissensitization is to be determined in accordance with the security strategy. Logs can record the host and the path for the barrier, but do not complete the search string for Token. This will preserve the structure needed to place errors and reduce the leakage of URLs after they enter the search index, monitor the platform or worksheet system.

Continue reading

Point "For example" URL moves through visualization and parameter tables, and then removes a link to a location that is dissensitized from the job; Opens the URL encoding tool when you need to change the encoding.