Reviewing the configuration CodeIgniter
I came across the following line:
$config['permitted_uri_chars'] = 'a-z 0-9~%.:_\-';
And the documentation for it says:
/*
|--------------------------------------------------------------------------
| Allowed URL Characters
|--------------------------------------------------------------------------
|
| This lets you specify which characters are permitted within your URLs.
| When someone tries to submit a URL with disallowed characters they will
| get a warning message.
|
| As a security measure you are STRONGLY encouraged to restrict URLs to
| as few characters as possible. By default only these are allowed: a-z 0-9~%.:_-
|
| Leave blank to allow all characters -- but only if you are insane.
|
| The configured value is actually a regular expression character group
| and it will be executed as: ! preg_match('/^[<permitted_uri_chars>]+$/i
|
| DO NOT CHANGE THIS UNLESS YOU FULLY UNDERSTAND THE REPERCUSSIONS!!
|
*/
/*
|--------------------------------------------------------------------------
| Caracteres URL permitidos
|----------------------------------------------------------------------
|
|Esto permite especificar qué caracteres están permitidas dentro de sus URL.
|Cuando alguien trata de enviar una URL con caracteres no permitidos se les
|dará un mensaje de advertencia.
|
|Como medida de seguridad, se recomienda enfáticamente restringir las direcciones
|URL a la menor cantidad de caracteres posible.
|Por defecto sólo se permiten éstos: a-z ~ 0-9%:. _-
|
|Dejar en blanco para permitir todos los caracteres -- pero sólo si estás loco.
|
|El valor configurado es actualmente una expresión regular de agrupamiento
|de caracteres y sera ejecutada como: ! preg_match('/^[<permitted_uri_chars>]+$/i
|
|NO CAMBIES ESTO HASTA QUE COMPRENDAS COMPLETAMENTE LAS REPERCUSIONES!!
|
*/
However, it is not entirely clear to me what repercussions or security problems may arise from allowing all characters in a url.
Regardless of the language used, what problems can this situation generate?