在网站中使用相对链接是否安全？

Question

In building a website, I am referencing files (assets, js, css) from a parent folder via relative links. Is this safe practice? Or am I opening the site up to security issues/risks such as a Directory Traversal Attack? Would absolute links be safer or would this cause many more HTTP requests? What's the best practice?

Answer 1

You should be fine. Either way, if the files get moved they won't be found. As far as security, I'm not 100% sure, but I'd doubt the type of link in HTML would cause a security issue. That would be something I might wait to get another answer for.

Answer 2

There is no security risk. Directory Traversal happens when a buggy web server implementation or a buggy script incorrectly allows path characters to be entered in the URL and the server directory structure is traversed. For example, " .. " or " / " characters (or their encoded versions).

An example is If you had the URL https//www.example.com/readFile.php?file=readme.txt and a malicious user could change this to https//www.example.com/readFile.php?file=/etc/passwd then if it this worked it would be vulnerable.

A link in an HTML page is the same as the user directly entering that URL in the address bar in this case, so no extra risk is introduced. Relative links are probably more secure in that there is less risk for bugs to be introduced to any URL parsing code that would generate absolute links. The latest versions of popular web servers are secure against this attack, and if you haven't introduced your own scripts that contain the vulnerability you should be safe.