Commit 552edee8 authored by Paul Querna's avatar Paul Querna
Browse files

If a request contains both a T-E and C-L, remove the C-L, stopping some HTTP... 

If a request contains both a T-E and C-L, remove the C-L, stopping some HTTP Request Smuggling attacks exploited when using HTTPD as a forward or reverse proxy.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@191005 13f79535-47bb-0310-9956-ffa450edef68
parent b85a9fbe

CHANGES

+5 −0
Changes for CHANGES: 5 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -2,6 +2,11 @@ Changes with Apache 2.1.5 








  [Remove entries to the current 2.0 section below, when backported]

















  *) SECURITY: 









     core: If a request contains both Transfer-Encoding and a Content-Length,









     remove the Content-Length, stopping some HTTP Request smuggling attacks.









     [Paul Querna]

















  *) mod_ssl: Setting the Protocol to 'https' can replace the use of the 









     'SSLEngine on' command. [Paul Querna]










































server/protocol.c



+12
−0



























Changes for server/protocol.c: 12 added lines, 0 removed lines.



Original line number
Diff line number
Diff line







@@ -898,6 +898,18 @@ request_rec *ap_read_request(conn_rec *conn)







            apr_brigade_destroy(tmp_bb);









            return r;









        }



















        if (apr_table_get(r->headers_in, "Content-Length")) {









            const char* te = apr_table_get(r->headers_in, "Transfer-Encoding");









            /*









             * If the client sent any Transfer-Encoding besides "identity",









             * the RFC says we MUST ignore the C-L header.  We kill it here









             * to prevent more work later on in modules like mod_proxy.









             */









            if (te && !strcasecmp("identity", te)) {









                apr_table_unset(r->headers_in, "Content-Length");









            }









        }









    }









    else {









        if (r->header_only) {