Commit 47e15858 authored by Eric Covener's avatar Eric Covener
Browse files

Merge consecutive slashes in the URL by default 

opt-out w/ `MergeSlashes OFF`.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1855705 13f79535-47bb-0310-9956-ffa450edef68
parent 7b9155c8

CHANGES

+3 −0
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.5.1



  *) Merge consecutive slashes in URL's. Opt-out with `MergeSlashes OFF`. 

     [Eric Covener]



  *) mod_proxy/ssl: Cleanup per-request SSL configuration anytime a backend

     connection is recycled/reused to avoid a possible crash with some SSLProxy

     configurations in <Location> or <Proxy> context. PR 63256. [Yann Ylavic]

docs/manual/mod/core.xml

+26 −0
Original line number Diff line number Diff line
@@ -5332,4 +5332,30 @@ as if 'QualifyRedirectURL ON' was configured.</compatibility> 
</usage>

</directivesynopsis>



<directivesynopsis>

<name>MergeSlashes</name>

<description>Controls whether the server merges consecutive slashes in URLs.

</description>

<syntax>MergeSlashes ON|OFF</syntax>

<default>MergeSlashes ON</default>

<contextlist><context>server config</context><context>virtual host</context>

</contextlist>

<compatibility>Added in 2.5.1</compatibility>



<usage>

    <p>By default, the server merges (or collapses) multiple consecutive slash

    ('/') characters in the path component of the request URL.</p>



    <p>When mapping URL's to the filesystem, these multiple slashes are not 

    significant.  However, URL's handled other ways, such as by CGI or proxy,

    might prefer to retain the significance of multiple consecutive slashes. 

    In these cases <directive>MergeSlashes</directive> can be set to 

    <em>OFF</em> to retain the multiple consecutive slashes.  In these

    configurations, regular expressions used in the configuration file that match

    the path component of the URL (<directive>LocationMatch</directive>,

    <directive>RewriteRule</directive>, ...) need to take into account multiple 

    consecutive slashes.</p>

</usage>

</directivesynopsis>



</modulesynopsis>

include/ap_mmn.h

+3 −1
Original line number Diff line number Diff line
@@ -610,6 +610,8 @@ 
 * 20180906.2 (2.5.1-dev)  Add ap_state_dir_relative()

 * 20180906.3 (2.5.1-dev)  Add ap_dir_nofnmatch() and ap_dir_fnmatch().

 * 20191203.1 (2.5.1-dev)  Axe bucket number from struct process_score

 * 20191203.2 (2.5.1-dev)  Add ap_no2slash_ex() and merge_slashes to 

 *                         core_server_conf.

 */



#define MODULE_MAGIC_COOKIE 0x41503235UL /* "AP25" */
@@ -617,7 +619,7 @@ 
#ifndef MODULE_MAGIC_NUMBER_MAJOR

#define MODULE_MAGIC_NUMBER_MAJOR 20191203

#endif

#define MODULE_MAGIC_NUMBER_MINOR 1                 /* 0...n */

#define MODULE_MAGIC_NUMBER_MINOR 2                 /* 0...n */



/**

 * Determine if the server's current MODULE_MAGIC_NUMBER is at least a

include/http_core.h

+1 −0
Original line number Diff line number Diff line
@@ -771,6 +771,7 @@ typedef struct { 
    apr_size_t   flush_max_threshold;

    apr_int32_t  flush_max_pipelined;

    unsigned int strict_host_check;

    unsigned int merge_slashes;

} core_server_config;



/* for AddOutputFiltersByType in core.c */

include/httpd.h

+13 −2
Original line number Diff line number Diff line
@@ -1750,11 +1750,22 @@ AP_DECLARE(int) ap_unescape_url_keep2f(char *url, int decode_slashes); 
AP_DECLARE(int) ap_unescape_urlencoded(char *query);



/**

 * Convert all double slashes to single slashes

 * @param name The string to convert

 * Convert all double slashes to single slashes, except where significant

 * to the filesystem on the current platform.

 * @param name The string to convert, assumed to be a filesystem path

 */

AP_DECLARE(void) ap_no2slash(char *name)

                 AP_FN_ATTR_NONNULL_ALL;

/**

 * Convert all double slashes to single slashes, except where significant

 * to the filesystem on the current platform.

 * @param name The string to convert

 * @param is_fs_path if set to 0, the significance of any double-slashes is 

 *        ignored.

 */

AP_DECLARE(void) ap_no2slash_ex(char *name, int is_fs_path)

                 AP_FN_ATTR_NONNULL_ALL;





/**

 * Remove all ./ and xx/../ substrings from a file name. Also remove