Skip to main content

normalize_path

waf_normalizer::url

Function normalize_path 

Source 
pub fn normalize_path(raw: &str) -> (String, bool, bool)
Expand description

Normalize a URL path.

Steps:

  1. Percent-decode (detecting double-encoding).
  2. If double-encoded, decode the result a second time.
  3. NFKC Unicode normalization (fullwidth → ASCII, ligatures → components).
  4. Strip null bytes.
  5. Lowercase.
  6. Resolve . / .. segments and collapse consecutive slashes.

Returns (normalized_path, double_encoding_detected, null_byte_detected).

null_byte_detected is captured PRE-strip (F-1): a decoded NUL in the path is stripped here (so pt-null-byte, which pattern-matches the stripped output, is structurally blind to it), but the request is forwarded RAW to the backend where %2500-style double-encoded NULs still truncate a filename. The flag preserves the signal for the evasion module. Path-scoped only — query/cookie/body keep their NUL, so pt-null-byte already covers those (no double-counting).