Commit 01fce1ed authored by Jeff Trawick's avatar Jeff Trawick
Browse files

proxy HTTP: If a response contains both Transfer-Encoding and a 

Content-Length, remove the Content-Length and don't reuse the
connection, stopping some HTTP Request smuggling attacks.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@193205 13f79535-47bb-0310-9956-ffa450edef68
parent 9876e528

CHANGES

+6 −0
Changes for CHANGES: 6 added lines, 0 removed lines.
Original line number Diff line number Diff line 
Changes with Apache 2.1.6

  [Remove entries to the current 2.0 section below, when backported]









  *) SECURITY: 









     proxy HTTP: If a response contains both Transfer-Encoding and a 









     Content-Length, remove the Content-Length and don't reuse the









     connection, stopping some HTTP Request smuggling attacks.









     [Jeff Trawick]

















  *) mod_cgid: Fix buffer overflow processing ScriptSock directive.









     [Steve Kemp <steve steve.org.uk>]










































modules/proxy/mod_proxy_http.c



+15
−0



























Changes for modules/proxy/mod_proxy_http.c: 15 added lines, 0 removed lines.



Original line number
Diff line number
Diff line







@@ -1129,6 +1129,21 @@ apr_status_t ap_proxy_http_process_response(apr_pool_t * p, request_rec *r,







                                                       save_table);









                }



















                /* can't have both Content-Length and Transfer-Encoding */









                if (apr_table_get(r->headers_out, "Transfer-Encoding")









                    && apr_table_get(r->headers_out, "Content-Length")) {









                    /* 2616 section 4.4, point 3: "if both Transfer-Encoding









                     * and Content-Length are received, the latter MUST be









                     * ignored"; so unset it here to prevent any confusion









                     * later. */









                    apr_table_unset(r->headers_out, "Content-Length");









                    ap_log_error(APLOG_MARK, APLOG_DEBUG, 0,









                                 r->server,









                                 "proxy: server %s returned Transfer-Encoding and Content-Length",









                                 backend->hostname);









                    backend->close += 1;









                }



















                /* strip connection listed hop-by-hop headers from response */









                backend->close += ap_proxy_liststr(apr_table_get(r->headers_out,









                                                                 "Connection"),