Commit e97839d6 authored by Mark J. Cox's avatar Mark J. Cox
Browse files

Thiago Zaninotti reported to security@apache.org on 20060410 a possible 

cross-site scripting flaw because the Expect header error message isn't
escaped.  We couldn't find a way that this could be used by an attacker
however, as they can't influence the Expect header a victim will send to a
target site.  Thiago agreed and we're therefore not treating this as a
security flaw, but it is a bug that ought to get fixed.  I'll add to 
STATUS for 1.3/2.0/2.2 shortly for acks.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@394965 13f79535-47bb-0310-9956-ffa450edef68
parent 7b87b647

CHANGES

+5 −0
Changes for CHANGES: 5 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -2,6 +2,11 @@ 
Changes with Apache 2.3.0

  [Remove entries to the current 2.0 and 2.2 section below, when backported]









  *) HTML-escape the Expect error message.  Not classed as security as









     an attacker has no way to influence the Expect header a victim will









     send to a target site.  Reported by Thiago Zaninotti









     <thiango nstalker.com>. [Mark Cox]

















  *) mod_proxy_balancer: Initialize members of a balancer correctly.









     PR 38227. [James A. Robinson <jim.robinson stanford.edu>]










































modules/http/http_protocol.c



+1
−1



























Changes for modules/http/http_protocol.c: 1 added line, 1 removed line.



Original line number
Diff line number
Diff line







@@ -996,7 +996,7 @@ static const char *get_canned_error_string(int status,







                           "request-header"









                           "\nfield could not be met by this server.</p>\n"









                           "<p>The client sent<pre>\n    Expect: ",









                           apr_table_get(r->headers_in, "Expect"),









                           ap_escape_html(r->pool, apr_table_get(r->headers_in, "Expect")),









                           "\n</pre>\n"









                           "but we only allow the 100-continue "









                           "expectation.</p>\n",