Commit eb1555b8 authored by Daniel Earl Poirier's avatar Daniel Earl Poirier
Browse files

core: AllowEncodedSlashes new option NoDecode to allow encoded slashes 

in request URL path info but not decode them. Change behavior of option
"On" to decode the encoded slashes as 2.0 and 2.2 do.  PR 35256,
PR 46830.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1082196 13f79535-47bb-0310-9956-ffa450edef68
parent 410720f8

CHANGES

+5 −0
Changes for CHANGES: 5 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -2,6 +2,11 @@ 


Changes with Apache 2.3.12



  *) core: AllowEncodedSlashes new option NoDecode to allow encoded slashes

     in request URL path info but not decode them. Change behavior of option

     "On" to decode the encoded slashes as 2.0 and 2.2 do.  PR 35256,

     PR 46830.  [Dan Poirier]



  *) mod_ssl: Check SNI hostname against Host header case-insensitively.

     PR 49491.  [Mayank Agrawal <magrawal.08 gmail.com>]

docs/manual/mod/core.xml

+16 −7
Changes for docs/manual/mod/core.xml: 16 added lines, 7 removed lines.
Original line number Diff line number Diff line
@@ -269,26 +269,35 @@ content-type is <code>text/plain</code> or <code>text/html</code></description> 
<name>AllowEncodedSlashes</name>

<description>Determines whether encoded path separators in URLs are allowed to

be passed through</description>

<syntax>AllowEncodedSlashes On|Off</syntax>

<syntax>AllowEncodedSlashes On|Off|NoDecode</syntax>

<default>AllowEncodedSlashes Off</default>

<contextlist><context>server config</context><context>virtual host</context>

</contextlist>

<compatibility>Available in Apache httpd 2.0.46 and later</compatibility>

<compatibility>Available in Apache httpd 2.0.46 and later.

NoDecode option available in 2.3.12 and later.</compatibility>



<usage>

    <p>The <directive>AllowEncodedSlashes</directive> directive allows URLs

    which contain encoded path separators (<code>%2F</code> for <code>/</code>

    and additionally <code>%5C</code> for <code>\</code> on according systems)

    to be used. Normally such URLs are refused with a 404 (Not found) error.</p>

    to be used in the path info.</p>



    <p>With the default value, <code>Off</code>, such URLs are refused

    with a 404 (Not found) error.</p>



    <p>With the value <code>On</code>, such URLs are accepted, and encoded

      slashes are decoded like all other encoded characters.</p>



    <p>With the value <code>NoDecode</code>, such URLs are accepted, but

      encoded slashes are not decoded but left in their encoded state.</p>



    <p>Turning <directive>AllowEncodedSlashes</directive> <code>On</code> is

    mostly useful when used in conjunction with <code>PATH_INFO</code>.</p>



    <note><title>Note</title>

      <p>Allowing encoded slashes does <em>not</em> imply <em>decoding</em>.

      Occurrences of <code>%2F</code> or <code>%5C</code> (<em>only</em> on

      according systems) will be left as such in the otherwise decoded URL

      string.</p>

      <p>If encoded slashes are needed in path info, use of <code>NoDecode</code> is

      strongly recommended as a security measure.  Allowing slashes

      to be decoded could potentially allow unsafe paths.</p>

    </note>

</usage>

<seealso><directive module="core">AcceptPathInfo</directive></seealso>

include/ap_mmn.h

+2 −1
Changes for include/ap_mmn.h: 2 added lines, 1 removed line.
Original line number Diff line number Diff line
@@ -306,6 +306,7 @@ 
                           util_ldap_state_t.connectionPoolTTL,

                           util_ldap_connection_t.freed, and

                           util_ldap_connection_t.rebind_pool. 

 * 20110312.1 (2.3.12-dev) Add core_dir_config.decode_encoded_slashes.

 */



#define MODULE_MAGIC_COOKIE 0x41503234UL /* "AP24" */
@@ -313,7 +314,7 @@ 
#ifndef MODULE_MAGIC_NUMBER_MAJOR

#define MODULE_MAGIC_NUMBER_MAJOR 20110312

#endif

#define MODULE_MAGIC_NUMBER_MINOR 0                     /* 0...n */

#define MODULE_MAGIC_NUMBER_MINOR 1                     /* 0...n */



/**

 * Determine if the server's current MODULE_MAGIC_NUMBER is at least a

include/http_core.h

+2 −0
Changes for include/http_core.h: 2 added lines, 0 removed lines.
Original line number Diff line number Diff line
@@ -540,6 +540,8 @@ typedef struct { 


    /** per-dir log config */

    struct ap_logconf *log;



    unsigned int decode_encoded_slashes : 1; /* whether to decode encoded slashes in URLs */

} core_dir_config;



/* macro to implement off by default behaviour */

include/httpd.h

+1 −1
Changes for include/httpd.h: 1 added line, 1 removed line.
Original line number Diff line number Diff line
@@ -1496,7 +1496,7 @@ AP_DECLARE(int) ap_unescape_url(char *url); 
 * @param url The url to unescape

 * @return 0 on success, non-zero otherwise

 */

AP_DECLARE(int) ap_unescape_url_keep2f(char *url);

AP_DECLARE(int) ap_unescape_url_keep2f(char *url, int decode_slashes);



/**

 * Convert all double slashes to single slashes