测试 REST 路径中的服务器端参数污染
（Testing for server-side parameter pollution in REST paths）
RESTful API 可能会将参数名称和值放在 URL 路径中，而不是放在查询字符串中。例如，请考虑以下路径：
（A RESTful API may place parameter names and values in the URL path, rather than the query string. For example, consider the following path:）
/api/users/123
URL 路径可能按如下方式细分：（The URL path might be broken down as follows:）
/api是根 API 端点。（api is the root API endpoint.）
/users在本例中表示资源。users（users represents a resource, in this case users.）
/123表示一个参数，这里是特定用户的标识符。（123represents a parameter, here an identifier for the specific user.）
考虑一个应用程序，它使您能够根据用户的用户名编辑用户配置文件。请求将发送到以下终结点：（Consider an application that enables you to edit user profiles based on their username. Requests are sent to the following endpoint:）
GET /edit_profile.php?name=peter
这将导致以下服务器端请求：（This results in the following server-side request:）
GET /api/private/users/peter
攻击者可能能够操纵服务器端 URL 路径参数来利用 API。若要测试此漏洞，请添加路径遍历序列以修改参数并观察应用程序的响应方式。
(An attacker may be able to manipulate server-side URL path parameters to exploit the API. To test for this vulnerability, add path traversal sequences to modify parameters and observe how the application responds.)
您可以提交 URL 编码作为参数的值：peter/../adminname
(You could submit URL-encoded peter/../admin as the value of the name parameter:)
GET /edit_profile.php?name=peter%2f..%2fadmin
这可能会导致以下服务器端请求：
(This may result in the following server-side request:)
GET /api/private/users/peter/../admin
如果服务器端客户端或后端 API 对此路径进行规范化，则可能会将其解析为 /api/private/users/admin。
(If the server-side client or back-end API normalize this path, it may be resolved to /api/private/users/admin.)
测试结构化数据格式中的服务器端参数污染
Testing for server-side parameter pollution in structured data formats
攻击者可能能够操纵参数，以利用服务器处理其他结构化数据格式（如 JSON 或 XML）时的漏洞。为了测试这一点，将意外的结构化数据注入到用户输入中，并查看服务器如何响应。
(An attacker may be able to manipulate parameters to exploit vulnerabilities in the server's processing of other structured data formats, such as a JSON or XML. To test for this, inject unexpected structured data into user inputs and see how the server responds.)
考虑一个应用程序，该应用程序使用户能够编辑其配置文件，然后将他们的更改与请求一起应用于服务器端 API。当您编辑姓名时，您的浏览器会发出以下请求：
(Consider an application that enables users to edit their profile, then applies their changes with a request to a server-side API. When you edit your name, your browser makes the following request:)
POST /myaccount
name=peter
这将导致以下服务器端请求：
(This results in the following server-side request:)
PATCH /users/7312/update
{"name":"peter"}
您可以尝试将参数access_level添加到请求中，如下所示：
(You can attempt to add the access_level parameter to the request as follows:)
POST /myaccount
name=peter","access_level":"administrator
如果在未进行充分验证或审查的情况下将用户输入添加到服务器端 JSON 数据中，则会导致以下服务器端请求：
(If the user input is added to the server-side JSON data without adequate validation or sanitization, this results in the following server-side request:)
PATCH /users/7312/update
{name="peter","access_level":"administrator"}
这可能会导致用户peter被授予管理员访问权限。
(This may result in the user peter being given administrator access.)
相关页面
有关如何识别可以注入到查询字符串中的参数的信息，请参阅查找隐藏的参数 parameters 部分。
Related pages
For information on how to identify parameters that you can inject into the query string, see the Finding hidden parameters section.
考虑一个类似的示例，但客户端用户输入是 JSON 数据。当您编辑姓名时，您的浏览器会发出以下请求：
(Consider a similar example, but where the client-side user input is in JSON data. When you edit your name, your browser makes the following request:)
POST /myaccount
{"name": "peter"}
这将导致以下服务器端请求：
(This results in the following server-side request:)
PATCH /users/7312/update
{"name":"peter"}
您可以尝试将参数access_level添加到请求中，如下所示：
(You can attempt to add the access_level parameter to the request as follows:)
POST /myaccount
{"name": "peter\",\"access_level\":\"administrator"}
如果用户输入被解码，然后在没有适当编码的情况下添加到服务器端 JSON 数据中，则会导致以下服务器端请求：
(If the user input is decoded, then added to the server-side JSON data without adequate encoding, this results in the following server-side request:)
PATCH /users/7312/update
{"name":"peter","access_level":"administrator"}
同样，这可能会导致用户peter被授予管理员访问权限。
(Again, this may result in the user peter being given administrator access.)
结构化格式注入也可能发生在响应中。例如，如果用户输入安全地存储在数据库中，然后嵌入到来自后端 API 的 JSON 响应中，而没有进行足够的编码，则可能会发生这种情况。通常，您可以像在请求中一样检测和利用响应中的结构化格式注入。
(Structured format injection can also occur in responses. For example, this can occur if user input is stored securely in a database, then embedded into a JSON response from a back-end API without adequate encoding. You can usually detect and exploit structured format injection in responses in the same way you can in requests.)
Note
This example below is in JSON, but server-side parameter pollution can occur in any structured data format. For an example in XML, see the XInclude attacks section in the XML external entity (XXE) injection topic.
注意
下面的示例是 JSON 格式，但服务器端参数污染可能以任何结构化数据格式发生。有关 XML 中的示例，请参阅 XML 外部实体 （XXE） 注入主题中的 XInclude 攻击部分。
使用自动化工具进行测试
Testing with automated tools
Burp 包含自动化工具，可以帮助您检测服务器端参数污染漏洞。
(Burp includes automated tools that can help you detect server-side parameter pollution vulnerabilities.)
Burp Scanner 在执行审计时会自动检测可疑的输入转换。当应用程序接收到用户输入，以某种方式转换它，然后对结果执行进一步处理时，就会发生这种情况。此行为不一定构成漏洞，因此您需要使用上述手动技术进行进一步测试。有关详细信息，请参阅可疑 输入转换问题定义。
(Burp Scanner automatically detects suspicious input transformations when performing an audit. These occur when an application receives user input, transforms it in some way, then performs further processing on the result. This behavior doesn't necessarily constitute a vulnerability, so you'll need to do further testing using the manual techniques outlined above. For more information, see the Suspicious input transformation issue definition.)
您还可以使用 Backslash Powered Scanner BApp 来识别服务器端注入漏洞。扫描器将输入分类为无聊、有趣或易受攻击。您需要使用上述手动技术来调查有趣的输入。有关详细信息，请参阅反斜杠 《Powered Scanning： Hunting unknown vulnerability classes》白皮书。
(You can also use the Backslash Powered Scanner BApp to identify server-side injection vulnerabilities. The scanner classifies inputs as boring, interesting, or vulnerable. You'll need to investigate interesting inputs using the manual techniques outlined above. For more information, see the Backslash Powered Scanning: hunting unknown vulnerability classes whitepaper.)
防止服务器端参数污染
Preventing server-side parameter pollution
为防止服务器端参数污染，请使用允许列表来定义不需要编码的字符，并确保所有其他用户输入在包含在服务器端请求中之前都已编码。您还应该确保所有输入都遵循预期的格式和结构。
(To prevent server-side parameter pollution, use an allowlist to define characters that don't need encoding, and make sure all other user input is encoded before it's included in a server-side request. You should also make sure that all input adheres to the expected format and structure.)
