Commit 05946434 authored by Daniel Earl Poirier's avatar Daniel Earl Poirier
Browse files

Backport r1082196 from trunk: 

core: AllowEncodedSlashes new option NoDecode to allow encoded slashes
in request URL path info but not decode them. 

PR: 35256, 46830
Reviewed by: jim, covener



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1082630 13f79535-47bb-0310-9956-ffa450edef68
parent ec44a647

CHANGES

+4 −0
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.2.18



  *) core: AllowEncodedSlashes new option NoDecode to allow encoded slashes

     in request URL path info but not decode them. PR 35256,

     PR 46830.  [Dan Poirier]



  *) mod_rewrite: Allow to unset environment variables. PR 50746.

     [Rainer Jung]

STATUS

+0 −14
Original line number Diff line number Diff line
@@ -90,20 +90,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



  * core: Add NoDecode option to AllowEncodedSlashes to turn off decoding

    of encoded slashes in path info.  (This is already the behavior of

    AllowEncodedSlashes On in trunk.)

      Trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1082196

      Backport version for 2.2.x of patch:

         http://people.apache.org/~poirier/AllowEncodedSlashes.22.patch

      +1 poirier, jim, covener

      +.1 wrowe; this essentially causes "%2F" -> "%2F" -> "%252F" to any backend,

                 as mentioned previously trunk is broken and decoding to 'something'

                 is necessary for routing such.  %2F cannot be distinguished from

                 %252F on the front end, adding risks.  All this said, not against 

                 an optional broken feature if this warning is placed in the docs.

                 Non-optional broken features are worse :)

                 Trunk must be patched identically.



PATCHES PROPOSED TO BACKPORT FROM TRUNK:

  [ New proposals should be added at the end of the list ]

docs/manual/mod/core.xml

+16 −7
Original line number Diff line number Diff line
@@ -307,26 +307,35 @@ content-type is <code>text/plain</code> or <code>text/html</code></description> 
<name>AllowEncodedSlashes</name>

<description>Determines whether encoded path separators in URLs are allowed to

be passed through</description>

<syntax>AllowEncodedSlashes On|Off</syntax>

<syntax>AllowEncodedSlashes On|Off|NoDecode</syntax>

<default>AllowEncodedSlashes Off</default>

<contextlist><context>server config</context><context>virtual host</context>

</contextlist>

<compatibility>Available in Apache 2.0.46 and later</compatibility>

<compatibility>Available in Apache httpd 2.0.46 and later.

NoDecode option available in 2.2.18 and later.</compatibility>



<usage>

    <p>The <directive>AllowEncodedSlashes</directive> directive allows URLs

    which contain encoded path separators (<code>%2F</code> for <code>/</code>

    and additionally <code>%5C</code> for <code>\</code> on according systems)

    to be used. Normally such URLs are refused with a 404 (Not found) error.</p>

    to be used in the path info.</p>



    <p>With the default value, <code>Off</code>, such URLs are refused

    with a 404 (Not found) error.</p>



    <p>With the value <code>On</code>, such URLs are accepted, and encoded

      slashes are decoded like all other encoded characters.</p>



    <p>With the value <code>NoDecode</code>, such URLs are accepted, but

      encoded slashes are not decoded but left in their encoded state.</p>



    <p>Turning <directive>AllowEncodedSlashes</directive> <code>On</code> is

    mostly useful when used in conjunction with <code>PATH_INFO</code>.</p>



    <note><title>Note</title>

      <p>Allowing encoded slashes does <em>not</em> imply <em>decoding</em>.

      Occurrences of <code>%2F</code> or <code>%5C</code> (<em>only</em> on

      according systems) will be left as such in the otherwise decoded URL

      string.</p>

      <p>If encoded slashes are needed in path info, use of <code>NoDecode</code> is

      strongly recommended as a security measure.  Allowing slashes

      to be decoded could potentially allow unsafe paths.</p>

    </note>

</usage>

<seealso><directive module="core">AcceptPathInfo</directive></seealso>

include/ap_mmn.h

+2 −1
Original line number Diff line number Diff line
@@ -141,6 +141,7 @@ 
 * 20051115.24 (2.2.15) Add forward member to proxy_conn_rec

 * 20051115.25 (2.2.17) Add errstatuses member to proxy_balancer

 * 20051115.26 (2.2.18) Add ap_cache_check_allowed()

 * 20051115.27 (2.2.18) Add core_dir_config.decode_encoded_slashes.

 */



#define MODULE_MAGIC_COOKIE 0x41503232UL /* "AP22" */
@@ -148,7 +149,7 @@ 
#ifndef MODULE_MAGIC_NUMBER_MAJOR

#define MODULE_MAGIC_NUMBER_MAJOR 20051115

#endif

#define MODULE_MAGIC_NUMBER_MINOR 26                    /* 0...n */

#define MODULE_MAGIC_NUMBER_MINOR 27                    /* 0...n */



/**

 * Determine if the server's current MODULE_MAGIC_NUMBER is at least a

include/http_core.h

+2 −0
Original line number Diff line number Diff line
@@ -568,6 +568,8 @@ typedef struct { 
#define USE_CANONICAL_PHYS_PORT_UNSET (2)

    unsigned use_canonical_phys_port : 2;





    unsigned int decode_encoded_slashes : 1; /* whether to decode encoded slashes in URLs */

} core_dir_config;



/* Per-server core configuration */