commit
1ec166eeba
@ -0,0 +1,20 @@
|
|||||||
|
diff --git a/modules/dav/main/util.c b/modules/dav/main/util.c
|
||||||
|
index 1ae5914027c..3f7822fc931 100644
|
||||||
|
--- a/modules/dav/main/util.c
|
||||||
|
+++ b/modules/dav/main/util.c
|
||||||
|
@@ -801,8 +801,14 @@ static dav_error * dav_process_if_header(request_rec *r, dav_if_header **p_ih)
|
||||||
|
"for the same state.");
|
||||||
|
}
|
||||||
|
condition = DAV_IF_COND_NOT;
|
||||||
|
+ list += 2;
|
||||||
|
+ }
|
||||||
|
+ else {
|
||||||
|
+ return dav_new_error(r->pool, HTTP_BAD_REQUEST,
|
||||||
|
+ DAV_ERR_IF_UNK_CHAR, 0,
|
||||||
|
+ "Invalid \"If:\" header: "
|
||||||
|
+ "Unexpected character in List");
|
||||||
|
}
|
||||||
|
- list += 2;
|
||||||
|
break;
|
||||||
|
|
||||||
|
case ' ':
|
||||||
@ -0,0 +1,23 @@
|
|||||||
|
From 5efc9507c487c37dfe2a279a4a0335cad701cd5f Mon Sep 17 00:00:00 2001
|
||||||
|
From: Eric Covener <covener@apache.org>
|
||||||
|
Date: Tue, 10 Jan 2023 13:19:07 +0000
|
||||||
|
Subject: [PATCH] cleanup on error
|
||||||
|
|
||||||
|
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1906540 13f79535-47bb-0310-9956-ffa450edef68
|
||||||
|
---
|
||||||
|
modules/proxy/mod_proxy_ajp.c | 2 ++
|
||||||
|
1 file changed, 2 insertions(+)
|
||||||
|
|
||||||
|
diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
|
||||||
|
index 9cd7adbcbbf..07f37392d88 100644
|
||||||
|
--- a/modules/proxy/mod_proxy_ajp.c
|
||||||
|
+++ b/modules/proxy/mod_proxy_ajp.c
|
||||||
|
@@ -255,6 +255,8 @@ static int ap_proxy_ajp_request(apr_pool_t *p, request_rec *r,
|
||||||
|
ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10396)
|
||||||
|
"%s Transfer-Encoding is not supported",
|
||||||
|
tenc);
|
||||||
|
+ /* We had a failure: Close connection to backend */
|
||||||
|
+ conn->close = 1;
|
||||||
|
return HTTP_INTERNAL_SERVER_ERROR;
|
||||||
|
}
|
||||||
|
} else {
|
||||||
@ -0,0 +1,129 @@
|
|||||||
|
From 8b6d55f6a047acf62675e32606b037f5eea8ccc7 Mon Sep 17 00:00:00 2001
|
||||||
|
From: Eric Covener <covener@apache.org>
|
||||||
|
Date: Tue, 10 Jan 2023 13:20:09 +0000
|
||||||
|
Subject: [PATCH] Merge r1906539 from trunk:
|
||||||
|
|
||||||
|
fail on bad header
|
||||||
|
|
||||||
|
Submitted By: covener
|
||||||
|
Reviewed By: covener, rpluem, gbechis
|
||||||
|
|
||||||
|
|
||||||
|
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1906541 13f79535-47bb-0310-9956-ffa450edef68
|
||||||
|
---
|
||||||
|
modules/proxy/mod_proxy_http.c | 46 ++++++++++++++++++++--------------
|
||||||
|
server/protocol.c | 2 ++
|
||||||
|
2 files changed, 29 insertions(+), 19 deletions(-)
|
||||||
|
|
||||||
|
diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
|
||||||
|
index d74ae054ac9..ec4e7fb06b5 100644
|
||||||
|
--- a/modules/proxy/mod_proxy_http.c
|
||||||
|
+++ b/modules/proxy/mod_proxy_http.c
|
||||||
|
@@ -788,7 +788,7 @@ static void process_proxy_header(request_rec *r, proxy_dir_conf *c,
|
||||||
|
* any sense at all, since we depend on buffer still containing
|
||||||
|
* what was read by ap_getline() upon return.
|
||||||
|
*/
|
||||||
|
-static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
|
||||||
|
+static apr_status_t ap_proxy_read_headers(request_rec *r, request_rec *rr,
|
||||||
|
char *buffer, int size,
|
||||||
|
conn_rec *c, int *pread_len)
|
||||||
|
{
|
||||||
|
@@ -820,19 +820,26 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
|
||||||
|
rc = ap_proxygetline(tmp_bb, buffer, size, rr,
|
||||||
|
AP_GETLINE_FOLD | AP_GETLINE_NOSPC_EOL, &len);
|
||||||
|
|
||||||
|
- if (len <= 0)
|
||||||
|
- break;
|
||||||
|
|
||||||
|
- if (APR_STATUS_IS_ENOSPC(rc)) {
|
||||||
|
- /* The header could not fit in the provided buffer, warn.
|
||||||
|
- * XXX: falls through with the truncated header, 5xx instead?
|
||||||
|
- */
|
||||||
|
- int trunc = (len > 128 ? 128 : len) / 2;
|
||||||
|
- ap_log_rerror(APLOG_MARK, APLOG_WARNING, rc, r, APLOGNO(10124)
|
||||||
|
- "header size is over the limit allowed by "
|
||||||
|
- "ResponseFieldSize (%d bytes). "
|
||||||
|
- "Bad response header: '%.*s[...]%s'",
|
||||||
|
- size, trunc, buffer, buffer + len - trunc);
|
||||||
|
+ if (rc != APR_SUCCESS) {
|
||||||
|
+ if (APR_STATUS_IS_ENOSPC(rc)) {
|
||||||
|
+ int trunc = (len > 128 ? 128 : len) / 2;
|
||||||
|
+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, rc, r, APLOGNO(10124)
|
||||||
|
+ "header size is over the limit allowed by "
|
||||||
|
+ "ResponseFieldSize (%d bytes). "
|
||||||
|
+ "Bad response header: '%.*s[...]%s'",
|
||||||
|
+ size, trunc, buffer, buffer + len - trunc);
|
||||||
|
+ }
|
||||||
|
+ else {
|
||||||
|
+ ap_log_rerror(APLOG_MARK, APLOG_WARNING, rc, r, APLOGNO(10404)
|
||||||
|
+ "Error reading headers from backend");
|
||||||
|
+ }
|
||||||
|
+ r->headers_out = NULL;
|
||||||
|
+ return rc;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
+ if (len <= 0) {
|
||||||
|
+ break;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
ap_log_rerror(APLOG_MARK, APLOG_TRACE4, 0, r, "%s", buffer);
|
||||||
|
@@ -855,7 +862,7 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
|
||||||
|
if (psc->badopt == bad_error) {
|
||||||
|
/* Nope, it wasn't even an extra HTTP header. Give up. */
|
||||||
|
r->headers_out = NULL;
|
||||||
|
- return;
|
||||||
|
+ return APR_EINVAL;
|
||||||
|
}
|
||||||
|
else if (psc->badopt == bad_body) {
|
||||||
|
/* if we've already started loading headers_out, then
|
||||||
|
@@ -869,13 +876,13 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
|
||||||
|
"in headers returned by %s (%s)",
|
||||||
|
r->uri, r->method);
|
||||||
|
*pread_len = len;
|
||||||
|
- return;
|
||||||
|
+ return APR_SUCCESS;
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01099)
|
||||||
|
"No HTTP headers returned by %s (%s)",
|
||||||
|
r->uri, r->method);
|
||||||
|
- return;
|
||||||
|
+ return APR_SUCCESS;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
|
@@ -905,6 +912,7 @@ static void ap_proxy_read_headers(request_rec *r, request_rec *rr,
|
||||||
|
process_proxy_header(r, dconf, buffer, value);
|
||||||
|
saw_headers = 1;
|
||||||
|
}
|
||||||
|
+ return APR_SUCCESS;
|
||||||
|
}
|
||||||
|
|
||||||
|
|
||||||
|
@@ -1218,10 +1226,10 @@ int ap_proxy_http_process_response(proxy_http_req_t *req)
|
||||||
|
"Set-Cookie", NULL);
|
||||||
|
|
||||||
|
/* shove the headers direct into r->headers_out */
|
||||||
|
- ap_proxy_read_headers(r, backend->r, buffer, response_field_size,
|
||||||
|
- origin, &pread_len);
|
||||||
|
+ rc = ap_proxy_read_headers(r, backend->r, buffer, response_field_size,
|
||||||
|
+ origin, &pread_len);
|
||||||
|
|
||||||
|
- if (r->headers_out == NULL) {
|
||||||
|
+ if (rc != APR_SUCCESS || r->headers_out == NULL) {
|
||||||
|
ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, r, APLOGNO(01106)
|
||||||
|
"bad HTTP/%d.%d header returned by %s (%s)",
|
||||||
|
major, minor, r->uri, r->method);
|
||||||
|
diff --git a/server/protocol.c b/server/protocol.c
|
||||||
|
index 7adc7f75c10..6f9540ad1de 100644
|
||||||
|
--- a/server/protocol.c
|
||||||
|
+++ b/server/protocol.c
|
||||||
|
@@ -508,6 +508,8 @@ AP_DECLARE(apr_status_t) ap_rgetline_core(char **s, apr_size_t n,
|
||||||
|
/* PR#43039: We shouldn't accept NULL bytes within the line */
|
||||||
|
bytes_handled = strlen(*s);
|
||||||
|
if (bytes_handled < *read) {
|
||||||
|
+ ap_log_data(APLOG_MARK, APLOG_DEBUG, ap_server_conf,
|
||||||
|
+ "NULL bytes in header", *s, *read, 0);
|
||||||
|
*read = bytes_handled;
|
||||||
|
if (rv == APR_SUCCESS) {
|
||||||
|
rv = APR_EINVAL;
|
||||||
@ -0,0 +1,407 @@
|
|||||||
|
diff --git a/docs/manual/rewrite/flags.html.en b/docs/manual/rewrite/flags.html.en
|
||||||
|
index 7cd4990..2242312 100644
|
||||||
|
--- a/docs/manual/rewrite/flags.html.en
|
||||||
|
+++ b/docs/manual/rewrite/flags.html.en
|
||||||
|
@@ -85,10 +85,6 @@ of how you might use them.</p>
|
||||||
|
<h2><a name="flag_b" id="flag_b">B (escape backreferences)</a></h2>
|
||||||
|
<p>The [B] flag instructs <code class="directive"><a href="../mod/mod_rewrite.html#rewriterule">RewriteRule</a></code> to escape non-alphanumeric
|
||||||
|
characters before applying the transformation.</p>
|
||||||
|
-<p>In 2.4.26 and later, you can limit the escaping to specific characters
|
||||||
|
-in backreferences by listing them: <code>[B=#?;]</code>. Note: The space
|
||||||
|
-character can be used in the list of characters to escape, but it cannot be
|
||||||
|
-the last character in the list.</p>
|
||||||
|
|
||||||
|
<p><code>mod_rewrite</code> has to unescape URLs before mapping them,
|
||||||
|
so backreferences are unescaped at the time they are applied.
|
||||||
|
@@ -120,6 +116,16 @@ when the backend may break if presented with an unescaped URL.</p>
|
||||||
|
|
||||||
|
<p>An alternative to this flag is using a <code class="directive"><a href="../mod/mod_rewrite.html#rewritecond">RewriteCond</a></code> to capture against %{THE_REQUEST} which will capture
|
||||||
|
strings in the encoded form.</p>
|
||||||
|
+
|
||||||
|
+<p>In 2.4.26 and later, you can limit the escaping to specific characters
|
||||||
|
+in backreferences by listing them: <code>[B=#?;]</code>. Note: The space
|
||||||
|
+character can be used in the list of characters to escape, but you must quote
|
||||||
|
+the entire third argument of <code class="directive"><a href="../mod/mod_rewrite.html#rewriterule">RewriteRule</a></code>
|
||||||
|
+and the space must not be the last character in the list.</p>
|
||||||
|
+
|
||||||
|
+<pre class="prettyprint lang-config"># Escape spaces and question marks.
|
||||||
|
+RewriteRule "^search/(.*)$" "/search.php?term=$1" "[B= ?]"</pre>
|
||||||
|
+
|
||||||
|
</div><div class="top"><a href="#page-header"><img alt="top" src="../images/up.gif" /></a></div>
|
||||||
|
<div class="section">
|
||||||
|
<h2><a name="flag_bnp" id="flag_bnp">BNP|backrefnoplus (don't escape space to +)</a></h2>
|
||||||
|
diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
|
||||||
|
index 9439965..5195cee 100644
|
||||||
|
--- a/modules/mappers/mod_rewrite.c
|
||||||
|
+++ b/modules/mappers/mod_rewrite.c
|
||||||
|
@@ -173,6 +173,7 @@ static const char* really_last_key = "rewrite_really_last";
|
||||||
|
#define RULEFLAG_END (1<<17)
|
||||||
|
#define RULEFLAG_ESCAPENOPLUS (1<<18)
|
||||||
|
#define RULEFLAG_QSLAST (1<<19)
|
||||||
|
+#define RULEFLAG_QSNONE (1<<20) /* programattic only */
|
||||||
|
|
||||||
|
/* return code of the rewrite rule
|
||||||
|
* the result may be escaped - or not
|
||||||
|
@@ -769,11 +770,19 @@ static char *escape_absolute_uri(apr_pool_t *p, char *uri, unsigned scheme)
|
||||||
|
* split out a QUERY_STRING part from
|
||||||
|
* the current URI string
|
||||||
|
*/
|
||||||
|
-static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard,
|
||||||
|
- int qslast)
|
||||||
|
+static void splitout_queryargs(request_rec *r, int flags)
|
||||||
|
{
|
||||||
|
char *q;
|
||||||
|
int split, skip;
|
||||||
|
+ int qsappend = flags & RULEFLAG_QSAPPEND;
|
||||||
|
+ int qsdiscard = flags & RULEFLAG_QSDISCARD;
|
||||||
|
+ int qslast = flags & RULEFLAG_QSLAST;
|
||||||
|
+
|
||||||
|
+ if (flags & RULEFLAG_QSNONE) {
|
||||||
|
+ rewritelog((r, 2, NULL, "discarding query string, no parse from substitution"));
|
||||||
|
+ r->args = NULL;
|
||||||
|
+ return;
|
||||||
|
+ }
|
||||||
|
|
||||||
|
/* don't touch, unless it's a scheme for which a query string makes sense.
|
||||||
|
* See RFC 1738 and RFC 2368.
|
||||||
|
@@ -798,7 +807,7 @@ static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard,
|
||||||
|
olduri = apr_pstrdup(r->pool, r->filename);
|
||||||
|
*q++ = '\0';
|
||||||
|
if (qsappend) {
|
||||||
|
- if (*q) {
|
||||||
|
+ if (*q) {
|
||||||
|
r->args = apr_pstrcat(r->pool, q, "&" , r->args, NULL);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
@@ -806,9 +815,9 @@ static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard,
|
||||||
|
r->args = apr_pstrdup(r->pool, q);
|
||||||
|
}
|
||||||
|
|
||||||
|
- if (r->args) {
|
||||||
|
+ if (r->args) {
|
||||||
|
len = strlen(r->args);
|
||||||
|
-
|
||||||
|
+
|
||||||
|
if (!len) {
|
||||||
|
r->args = NULL;
|
||||||
|
}
|
||||||
|
@@ -2761,7 +2770,7 @@ static apr_status_t rewritelock_remove(void *data)
|
||||||
|
* XXX: what an inclined parser. Seems we have to leave it so
|
||||||
|
* for backwards compat. *sigh*
|
||||||
|
*/
|
||||||
|
-static int parseargline(char *str, char **a1, char **a2, char **a3)
|
||||||
|
+static int parseargline(char *str, char **a1, char **a2, char **a2_end, char **a3)
|
||||||
|
{
|
||||||
|
char quote;
|
||||||
|
|
||||||
|
@@ -2812,8 +2821,10 @@ static int parseargline(char *str, char **a1, char **a2, char **a3)
|
||||||
|
|
||||||
|
if (!*str) {
|
||||||
|
*a3 = NULL; /* 3rd argument is optional */
|
||||||
|
+ *a2_end = str;
|
||||||
|
return 0;
|
||||||
|
}
|
||||||
|
+ *a2_end = str;
|
||||||
|
*str++ = '\0';
|
||||||
|
|
||||||
|
while (apr_isspace(*str)) {
|
||||||
|
@@ -3353,7 +3364,7 @@ static const char *cmd_rewritecond(cmd_parms *cmd, void *in_dconf,
|
||||||
|
rewrite_server_conf *sconf;
|
||||||
|
rewritecond_entry *newcond;
|
||||||
|
ap_regex_t *regexp;
|
||||||
|
- char *a1 = NULL, *a2 = NULL, *a3 = NULL;
|
||||||
|
+ char *a1 = NULL, *a2 = NULL, *a2_end, *a3 = NULL;
|
||||||
|
const char *err;
|
||||||
|
|
||||||
|
sconf = ap_get_module_config(cmd->server->module_config, &rewrite_module);
|
||||||
|
@@ -3371,7 +3382,7 @@ static const char *cmd_rewritecond(cmd_parms *cmd, void *in_dconf,
|
||||||
|
* of the argument line. So we can use a1 .. a3 without
|
||||||
|
* copying them again.
|
||||||
|
*/
|
||||||
|
- if (parseargline(str, &a1, &a2, &a3)) {
|
||||||
|
+ if (parseargline(str, &a1, &a2, &a2_end, &a3)) {
|
||||||
|
return apr_pstrcat(cmd->pool, "RewriteCond: bad argument line '", str,
|
||||||
|
"'", NULL);
|
||||||
|
}
|
||||||
|
@@ -3779,7 +3790,7 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf,
|
||||||
|
rewrite_server_conf *sconf;
|
||||||
|
rewriterule_entry *newrule;
|
||||||
|
ap_regex_t *regexp;
|
||||||
|
- char *a1 = NULL, *a2 = NULL, *a3 = NULL;
|
||||||
|
+ char *a1 = NULL, *a2 = NULL, *a2_end, *a3 = NULL;
|
||||||
|
const char *err;
|
||||||
|
|
||||||
|
sconf = ap_get_module_config(cmd->server->module_config, &rewrite_module);
|
||||||
|
@@ -3793,7 +3804,7 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf,
|
||||||
|
}
|
||||||
|
|
||||||
|
/* parse the argument line ourself */
|
||||||
|
- if (parseargline(str, &a1, &a2, &a3)) {
|
||||||
|
+ if (parseargline(str, &a1, &a2, &a2_end, &a3)) {
|
||||||
|
return apr_pstrcat(cmd->pool, "RewriteRule: bad argument line '", str,
|
||||||
|
"'", NULL);
|
||||||
|
}
|
||||||
|
@@ -3840,6 +3851,16 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf,
|
||||||
|
newrule->flags |= RULEFLAG_NOSUB;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (*(a2_end-1) == '?') {
|
||||||
|
+ /* a literal ? at the end of the unsubstituted rewrite rule */
|
||||||
|
+ newrule->flags |= RULEFLAG_QSNONE;
|
||||||
|
+ }
|
||||||
|
+ else if (newrule->flags & RULEFLAG_QSDISCARD) {
|
||||||
|
+ if (NULL == ap_strchr(newrule->output, '?')) {
|
||||||
|
+ newrule->flags |= RULEFLAG_QSNONE;
|
||||||
|
+ }
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/* now, if the server or per-dir config holds an
|
||||||
|
* array of RewriteCond entries, we take it for us
|
||||||
|
* and clear the array
|
||||||
|
@@ -4245,9 +4266,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
|
||||||
|
r->path_info = NULL;
|
||||||
|
}
|
||||||
|
|
||||||
|
- splitout_queryargs(r, p->flags & RULEFLAG_QSAPPEND,
|
||||||
|
- p->flags & RULEFLAG_QSDISCARD,
|
||||||
|
- p->flags & RULEFLAG_QSLAST);
|
||||||
|
+ splitout_queryargs(r, p->flags);
|
||||||
|
|
||||||
|
/* Add the previously stripped per-directory location prefix, unless
|
||||||
|
* (1) it's an absolute URL path and
|
||||||
|
@@ -4729,6 +4748,17 @@ static int hook_uri2file(request_rec *r)
|
||||||
|
unsigned skip;
|
||||||
|
apr_size_t flen;
|
||||||
|
|
||||||
|
+ if (r->args && *(ap_scan_vchar_obstext(r->args))) {
|
||||||
|
+ /*
|
||||||
|
+ * We have a raw control character or a ' ' in r->args.
|
||||||
|
+ * Correct encoding was missed.
|
||||||
|
+ */
|
||||||
|
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10410)
|
||||||
|
+ "Rewritten query string contains control "
|
||||||
|
+ "characters or spaces");
|
||||||
|
+ return HTTP_FORBIDDEN;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (ACTION_STATUS == rulestatus) {
|
||||||
|
int n = r->status;
|
||||||
|
|
||||||
|
@@ -5013,6 +5043,17 @@ static int hook_fixup(request_rec *r)
|
||||||
|
if (rulestatus) {
|
||||||
|
unsigned skip;
|
||||||
|
|
||||||
|
+ if (r->args && *(ap_scan_vchar_obstext(r->args))) {
|
||||||
|
+ /*
|
||||||
|
+ * We have a raw control character or a ' ' in r->args.
|
||||||
|
+ * Correct encoding was missed.
|
||||||
|
+ */
|
||||||
|
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10411)
|
||||||
|
+ "Rewritten query string contains control "
|
||||||
|
+ "characters or spaces");
|
||||||
|
+ return HTTP_FORBIDDEN;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
if (ACTION_STATUS == rulestatus) {
|
||||||
|
int n = r->status;
|
||||||
|
|
||||||
|
diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
|
||||||
|
index 5759513..d64739b 100644
|
||||||
|
--- a/modules/proxy/mod_proxy.c
|
||||||
|
+++ b/modules/proxy/mod_proxy.c
|
||||||
|
@@ -960,6 +960,8 @@ PROXY_DECLARE(int) ap_proxy_trans_match(request_rec *r, struct proxy_alias *ent,
|
||||||
|
}
|
||||||
|
|
||||||
|
if (found) {
|
||||||
|
+ unsigned int encoded = ent->flags & PROXYPASS_MAP_ENCODED;
|
||||||
|
+
|
||||||
|
/* A proxy module is assigned this URL, check whether it's interested
|
||||||
|
* in the request itself (e.g. proxy_wstunnel cares about Upgrade
|
||||||
|
* requests only, and could hand over to proxy_http otherwise).
|
||||||
|
@@ -979,6 +981,9 @@ PROXY_DECLARE(int) ap_proxy_trans_match(request_rec *r, struct proxy_alias *ent,
|
||||||
|
if (ent->flags & PROXYPASS_NOQUERY) {
|
||||||
|
apr_table_setn(r->notes, "proxy-noquery", "1");
|
||||||
|
}
|
||||||
|
+ if (encoded) {
|
||||||
|
+ apr_table_setn(r->notes, "proxy-noencode", "1");
|
||||||
|
+ }
|
||||||
|
|
||||||
|
if (servlet_uri) {
|
||||||
|
ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, APLOGNO(10248)
|
||||||
|
@@ -992,13 +997,13 @@ PROXY_DECLARE(int) ap_proxy_trans_match(request_rec *r, struct proxy_alias *ent,
|
||||||
|
*/
|
||||||
|
AP_DEBUG_ASSERT(strlen(r->uri) >= strlen(servlet_uri));
|
||||||
|
strcpy(r->uri, servlet_uri);
|
||||||
|
- return DONE;
|
||||||
|
}
|
||||||
|
-
|
||||||
|
- ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, APLOGNO(03464)
|
||||||
|
- "URI path '%s' matches proxy handler '%s'", r->uri,
|
||||||
|
- found);
|
||||||
|
- return OK;
|
||||||
|
+ else {
|
||||||
|
+ ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, APLOGNO(03464)
|
||||||
|
+ "URI path '%s' matches proxy handler '%s'", r->uri,
|
||||||
|
+ found);
|
||||||
|
+ }
|
||||||
|
+ return (encoded) ? DONE : OK;
|
||||||
|
}
|
||||||
|
|
||||||
|
return HTTP_CONTINUE;
|
||||||
|
diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
|
||||||
|
index d34fc57..1978425 100644
|
||||||
|
--- a/modules/proxy/mod_proxy_ajp.c
|
||||||
|
+++ b/modules/proxy/mod_proxy_ajp.c
|
||||||
|
@@ -65,11 +65,25 @@ static int proxy_ajp_canon(request_rec *r, char *url)
|
||||||
|
if (apr_table_get(r->notes, "proxy-nocanon")) {
|
||||||
|
path = url; /* this is the raw path */
|
||||||
|
}
|
||||||
|
+ else if (apr_table_get(r->notes, "proxy-noencode")) {
|
||||||
|
+ path = url; /* this is the encoded path already */
|
||||||
|
+ search = r->args;
|
||||||
|
+ }
|
||||||
|
else {
|
||||||
|
path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
|
||||||
|
r->proxyreq);
|
||||||
|
search = r->args;
|
||||||
|
}
|
||||||
|
+ if (search && *ap_scan_vchar_obstext(search)) {
|
||||||
|
+ /*
|
||||||
|
+ * We have a raw control character or a ' ' in r->args.
|
||||||
|
+ * Correct encoding was missed.
|
||||||
|
+ */
|
||||||
|
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10406)
|
||||||
|
+ "To be forwarded query string contains control "
|
||||||
|
+ "characters or spaces");
|
||||||
|
+ return HTTP_FORBIDDEN;
|
||||||
|
+ }
|
||||||
|
if (path == NULL)
|
||||||
|
return HTTP_BAD_REQUEST;
|
||||||
|
|
||||||
|
diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c
|
||||||
|
index 3304c93..f1a3c62 100644
|
||||||
|
--- a/modules/proxy/mod_proxy_balancer.c
|
||||||
|
+++ b/modules/proxy/mod_proxy_balancer.c
|
||||||
|
@@ -102,11 +102,25 @@ static int proxy_balancer_canon(request_rec *r, char *url)
|
||||||
|
if (apr_table_get(r->notes, "proxy-nocanon")) {
|
||||||
|
path = url; /* this is the raw path */
|
||||||
|
}
|
||||||
|
+ else if (apr_table_get(r->notes, "proxy-noencode")) {
|
||||||
|
+ path = url; /* this is the encoded path already */
|
||||||
|
+ search = r->args;
|
||||||
|
+ }
|
||||||
|
else {
|
||||||
|
path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
|
||||||
|
r->proxyreq);
|
||||||
|
search = r->args;
|
||||||
|
}
|
||||||
|
+ if (search && *ap_scan_vchar_obstext(search)) {
|
||||||
|
+ /*
|
||||||
|
+ * We have a raw control character or a ' ' in r->args.
|
||||||
|
+ * Correct encoding was missed.
|
||||||
|
+ */
|
||||||
|
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10407)
|
||||||
|
+ "To be forwarded query string contains control "
|
||||||
|
+ "characters or spaces");
|
||||||
|
+ return HTTP_FORBIDDEN;
|
||||||
|
+ }
|
||||||
|
if (path == NULL)
|
||||||
|
return HTTP_BAD_REQUEST;
|
||||||
|
|
||||||
|
diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c
|
||||||
|
index 3382b9b..a89b9a9 100644
|
||||||
|
--- a/modules/proxy/mod_proxy_fcgi.c
|
||||||
|
+++ b/modules/proxy/mod_proxy_fcgi.c
|
||||||
|
@@ -92,8 +92,9 @@ static int proxy_fcgi_canon(request_rec *r, char *url)
|
||||||
|
host = apr_pstrcat(r->pool, "[", host, "]", NULL);
|
||||||
|
}
|
||||||
|
|
||||||
|
- if (apr_table_get(r->notes, "proxy-nocanon")) {
|
||||||
|
- path = url; /* this is the raw path */
|
||||||
|
+ if (apr_table_get(r->notes, "proxy-nocanon")
|
||||||
|
+ || apr_table_get(r->notes, "proxy-noencode")) {
|
||||||
|
+ path = url; /* this is the raw/encoded path */
|
||||||
|
}
|
||||||
|
else {
|
||||||
|
path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
|
||||||
|
diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
|
||||||
|
index 0392ac7..c4d7db0 100644
|
||||||
|
--- a/modules/proxy/mod_proxy_http.c
|
||||||
|
+++ b/modules/proxy/mod_proxy_http.c
|
||||||
|
@@ -121,11 +121,25 @@ static int proxy_http_canon(request_rec *r, char *url)
|
||||||
|
if (apr_table_get(r->notes, "proxy-nocanon")) {
|
||||||
|
path = url; /* this is the raw path */
|
||||||
|
}
|
||||||
|
+ else if (apr_table_get(r->notes, "proxy-noencode")) {
|
||||||
|
+ path = url; /* this is the encoded path already */
|
||||||
|
+ search = r->args;
|
||||||
|
+ }
|
||||||
|
else {
|
||||||
|
path = ap_proxy_canonenc(r->pool, url, strlen(url),
|
||||||
|
enc_path, 0, r->proxyreq);
|
||||||
|
search = r->args;
|
||||||
|
}
|
||||||
|
+ if (search && *ap_scan_vchar_obstext(search)) {
|
||||||
|
+ /*
|
||||||
|
+ * We have a raw control character or a ' ' in r->args.
|
||||||
|
+ * Correct encoding was missed.
|
||||||
|
+ */
|
||||||
|
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10408)
|
||||||
|
+ "To be forwarded query string contains control "
|
||||||
|
+ "characters or spaces");
|
||||||
|
+ return HTTP_FORBIDDEN;
|
||||||
|
+ }
|
||||||
|
break;
|
||||||
|
case PROXYREQ_PROXY:
|
||||||
|
path = url;
|
||||||
|
diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c
|
||||||
|
index e02450e..1b23904 100644
|
||||||
|
--- a/modules/proxy/mod_proxy_uwsgi.c
|
||||||
|
+++ b/modules/proxy/mod_proxy_uwsgi.c
|
||||||
|
@@ -84,8 +84,14 @@ static int uwsgi_canon(request_rec *r, char *url)
|
||||||
|
host = apr_pstrcat(r->pool, "[", host, "]", NULL);
|
||||||
|
}
|
||||||
|
|
||||||
|
- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
|
||||||
|
- r->proxyreq);
|
||||||
|
+ if (apr_table_get(r->notes, "proxy-nocanon")
|
||||||
|
+ || apr_table_get(r->notes, "proxy-noencode")) {
|
||||||
|
+ path = url; /* this is the raw/encoded path */
|
||||||
|
+ }
|
||||||
|
+ else {
|
||||||
|
+ path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
|
||||||
|
+ r->proxyreq);
|
||||||
|
+ }
|
||||||
|
if (!path) {
|
||||||
|
return HTTP_BAD_REQUEST;
|
||||||
|
}
|
||||||
|
diff --git a/modules/proxy/mod_proxy_wstunnel.c b/modules/proxy/mod_proxy_wstunnel.c
|
||||||
|
index c29ded1..3a68b85 100644
|
||||||
|
--- a/modules/proxy/mod_proxy_wstunnel.c
|
||||||
|
+++ b/modules/proxy/mod_proxy_wstunnel.c
|
||||||
|
@@ -111,11 +111,25 @@ static int proxy_wstunnel_canon(request_rec *r, char *url)
|
||||||
|
if (apr_table_get(r->notes, "proxy-nocanon")) {
|
||||||
|
path = url; /* this is the raw path */
|
||||||
|
}
|
||||||
|
+ else if (apr_table_get(r->notes, "proxy-noencode")) {
|
||||||
|
+ path = url; /* this is the encoded path already */
|
||||||
|
+ search = r->args;
|
||||||
|
+ }
|
||||||
|
else {
|
||||||
|
path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
|
||||||
|
r->proxyreq);
|
||||||
|
search = r->args;
|
||||||
|
}
|
||||||
|
+ if (search && *ap_scan_vchar_obstext(search)) {
|
||||||
|
+ /*
|
||||||
|
+ * We have a raw control character or a ' ' in r->args.
|
||||||
|
+ * Correct encoding was missed.
|
||||||
|
+ */
|
||||||
|
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10409)
|
||||||
|
+ "To be forwarded query string contains control "
|
||||||
|
+ "characters or spaces");
|
||||||
|
+ return HTTP_FORBIDDEN;
|
||||||
|
+ }
|
||||||
|
if (path == NULL)
|
||||||
|
return HTTP_BAD_REQUEST;
|
||||||
|
|
||||||
Loading…
Reference in new issue