[8094] in www-talk@info.cern.ch
Re: URI security
daemon@ATHENA.MIT.EDU (Larry Masinter)
Sat Apr 29 11:55:57 1995
Date: Sat, 29 Apr 1995 11:54:26 +0500
Errors-To: procmaster@www19.w3.org
Reply-To: masinter@parc.xerox.com
From: Larry Masinter <masinter@parc.xerox.com>
To: Multiple recipients of list <www-talk@www10.w3.org>
> Upon whom does the responsibility lie for avoiding ".." in request
> pathnames? Would a server that rejects any URL request with ".." in it be
> non-compliant?
. is interpreted by the CLIENT in relative URLs and by the SERVER in
absolute URLs. That is, if you say
<A HREF="../baz.html">Baz</A>
in a document whose base is "http://myserver/foo/bar.html", this is a
interpreted as "http://myserver/baz.html". However, if you say
<A HREF="http://myserver/../baz.html">Baz</A>
this is an absolute URL and the ".." gets sent to the server, which
can interpret it however it wants.
The relative URL document
<URL:ftp://ds.internic.net/internet-drafts/draft-ietf-uri-relative-url-06.txt>
is up for 'last call' before becoming a proposed standard RFC. Check
it out.
