Commit 276ddee9 authored by Martin Kraemer's avatar Martin Kraemer
Browse files

Apply a stricter check to the request line syntax, in order to prevent

arbitrary user input to end up (unescaped) in the access_log and error_log
files. Until now, garbage could be injected to spoof accesses to nonexistent
(or inaccessible) resources -- of course without the client actually
getting access to them.
Now anything but whitespace following the "<method> <url> HTTP/x.y" request
line is disallowed, and special characters in the request are escaped
in the log.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/1.3.x@95205 13f79535-47bb-0310-9956-ffa450edef68
parent 331125c7
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment