Apply a stricter check to the request line syntax, in order to prevent
arbitrary user input to end up (unescaped) in the access_log and error_log files. Until now, garbage could be injected to spoof accesses to nonexistent (or inaccessible) resources -- of course without the client actually getting access to them. Now anything but whitespace following the "<method> <url> HTTP/x.y" request line is disallowed, and special characters in the request are escaped in the log. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95205 13f79535-47bb-0310-9956-ffa450edef68
parent
331125c7
Please register or sign in to comment