Commit 57eb63b7 authored by Ruediger Pluem's avatar Ruediger Pluem
Browse files

Merge r682868 from trunk: 

* Prevent XSS attacks when using wildcards in the path of the FTP URL.
  Discovered by Marc Bevand of Rapid7.

CVE: CVE-2008-2939
Submitted by: rpluem
Reviewed by: rpluem, mjc, jim, jorton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@682871 13f79535-47bb-0310-9956-ffa450edef68
parent 34031900

CHANGES

+3 −0
Changes for CHANGES: 3 added lines, 0 removed lines.
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.0.64



  *) SECURITY: CVE-2008-2939 (cve.mitre.org)

     mod_proxy_ftp: Prevent XSS attacks when using wildcards in the path of

     the FTP URL. Discovered by Marc Bevand of Rapid7. [Ruediger Pluem]



Changes with Apache 2.0.63

modules/proxy/proxy_ftp.c

+1 −0
Changes for modules/proxy/proxy_ftp.c: 1 added line, 0 removed lines.
Original line number Diff line number Diff line
@@ -382,6 +382,7 @@ apr_status_t ap_proxy_send_dir_filter(ap_filter_t *f, apr_bucket_brigade *in) 
                                                           c->bucket_alloc));

        }

        if (wildcard != NULL) {

            wildcard = ap_escape_html(p, wildcard);

            APR_BRIGADE_INSERT_TAIL(out, apr_bucket_pool_create(wildcard,

                                                           strlen(wildcard), p,

                                                           c->bucket_alloc));