|
|
0de8c9 |
diff --git a/docs/manual/rewrite/flags.html.en b/docs/manual/rewrite/flags.html.en
|
|
|
5f2ef4 |
index fbeeb7b..3c575d5 100644
|
|
|
0de8c9 |
--- a/docs/manual/rewrite/flags.html.en
|
|
|
0de8c9 |
+++ b/docs/manual/rewrite/flags.html.en
|
|
|
0de8c9 |
@@ -85,10 +85,6 @@ of how you might use them.
|
|
|
0de8c9 |
|
|
|
0de8c9 |
The [B] flag instructs RewriteRule to escape non-alphanumeric
|
|
|
0de8c9 |
characters before applying the transformation.
|
|
|
0de8c9 |
-In 2.4.26 and later, you can limit the escaping to specific characters
|
|
|
0de8c9 |
-in backreferences by listing them: [B=#?;] . Note: The space
|
|
|
0de8c9 |
-character can be used in the list of characters to escape, but it cannot be
|
|
|
0de8c9 |
-the last character in the list.
|
|
|
0de8c9 |
|
|
|
0de8c9 |
mod_rewrite has to unescape URLs before mapping them,
|
|
|
0de8c9 |
so backreferences are unescaped at the time they are applied.
|
|
|
0de8c9 |
@@ -120,6 +116,16 @@ when the backend may break if presented with an unescaped URL.
|
|
|
0de8c9 |
|
|
|
0de8c9 |
An alternative to this flag is using a RewriteCond to capture against %{THE_REQUEST} which will capture
|
|
|
0de8c9 |
strings in the encoded form.
|
|
|
0de8c9 |
+
|
|
|
0de8c9 |
+In 2.4.26 and later, you can limit the escaping to specific characters
|
|
|
0de8c9 |
+in backreferences by listing them: [B=#?;] . Note: The space
|
|
|
0de8c9 |
+character can be used in the list of characters to escape, but you must quote
|
|
|
0de8c9 |
+the entire third argument of RewriteRule
|
|
|
0de8c9 |
+and the space must not be the last character in the list.
|
|
|
0de8c9 |
+
|
|
|
0de8c9 |
+# Escape spaces and question marks.
|
|
|
0de8c9 |
+RewriteRule "^search/(.*)$" "/search.php?term=$1" "[B= ?]"
|
|
|
0de8c9 |
+
|
|
|
0de8c9 |
|
|
|
0de8c9 |
|
|
|
0de8c9 |
|
|
|
0de8c9 |
diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
|
|
|
5f2ef4 |
index 80fbc9e..6bd8f02 100644
|
|
|
0de8c9 |
--- a/modules/mappers/mod_rewrite.c
|
|
|
0de8c9 |
+++ b/modules/mappers/mod_rewrite.c
|
|
|
5f2ef4 |
@@ -100,6 +100,8 @@
|
|
|
5f2ef4 |
#include "mod_rewrite.h"
|
|
|
5f2ef4 |
#include "ap_expr.h"
|
|
|
5f2ef4 |
|
|
|
5f2ef4 |
+#include "test_char.h"
|
|
|
5f2ef4 |
+
|
|
|
5f2ef4 |
static ap_dbd_t *(*dbd_acquire)(request_rec*) = NULL;
|
|
|
5f2ef4 |
static void (*dbd_prepare)(server_rec*, const char*, const char*) = NULL;
|
|
|
5f2ef4 |
static const char* really_last_key = "rewrite_really_last";
|
|
|
5f2ef4 |
@@ -167,6 +169,8 @@ static const char* really_last_key = "rewrite_really_last";
|
|
|
0de8c9 |
#define RULEFLAG_END (1<<17)
|
|
|
0de8c9 |
#define RULEFLAG_ESCAPENOPLUS (1<<18)
|
|
|
0de8c9 |
#define RULEFLAG_QSLAST (1<<19)
|
|
|
0de8c9 |
+#define RULEFLAG_QSNONE (1<<20) /* programattic only */
|
|
|
5f2ef4 |
+#define RULEFLAG_ESCAPECTLS (1<<21)
|
|
|
0de8c9 |
|
|
|
0de8c9 |
/* return code of the rewrite rule
|
|
|
0de8c9 |
* the result may be escaped - or not
|
|
|
5f2ef4 |
@@ -320,7 +324,8 @@ typedef struct {
|
|
|
5f2ef4 |
data_item *cookie; /* added cookies */
|
|
|
5f2ef4 |
int skip; /* number of next rules to skip */
|
|
|
5f2ef4 |
int maxrounds; /* limit on number of loops with N flag */
|
|
|
5f2ef4 |
- char *escapes; /* specific backref escapes */
|
|
|
5f2ef4 |
+ const char *escapes; /* specific backref escapes */
|
|
|
5f2ef4 |
+ const char *noescapes; /* specific backref chars not to escape */
|
|
|
5f2ef4 |
} rewriterule_entry;
|
|
|
5f2ef4 |
|
|
|
5f2ef4 |
typedef struct {
|
|
|
5f2ef4 |
@@ -420,7 +425,9 @@ static apr_global_mutex_t *rewrite_mapr_lock_acquire = NULL;
|
|
|
5f2ef4 |
static const char *rewritemap_mutex_type = "rewrite-map";
|
|
|
5f2ef4 |
|
|
|
5f2ef4 |
/* Optional functions imported from mod_ssl when loaded: */
|
|
|
5f2ef4 |
-static char *escape_backref(apr_pool_t *p, const char *path, const char *escapeme, int noplus);
|
|
|
5f2ef4 |
+static char *escape_backref(apr_pool_t *p, const char *path,
|
|
|
5f2ef4 |
+ const char *escapeme, const char *noescapeme,
|
|
|
5f2ef4 |
+ int flags);
|
|
|
5f2ef4 |
|
|
|
5f2ef4 |
/*
|
|
|
5f2ef4 |
* +-------------------------------------------------------+
|
|
|
5f2ef4 |
@@ -647,14 +654,21 @@ static APR_INLINE unsigned char *c2x(unsigned what, unsigned char prefix,
|
|
|
5f2ef4 |
* Escapes a backreference in a similar way as php's urlencode does.
|
|
|
5f2ef4 |
* Based on ap_os_escape_path in server/util.c
|
|
|
5f2ef4 |
*/
|
|
|
5f2ef4 |
-static char *escape_backref(apr_pool_t *p, const char *path, const char *escapeme, int noplus) {
|
|
|
5f2ef4 |
- char *copy = apr_palloc(p, 3 * strlen(path) + 3);
|
|
|
5f2ef4 |
+static char *escape_backref(apr_pool_t *p, const char *path,
|
|
|
5f2ef4 |
+ const char *escapeme, const char *noescapeme,
|
|
|
5f2ef4 |
+ int flags)
|
|
|
5f2ef4 |
+{
|
|
|
5f2ef4 |
+ char *copy = apr_palloc(p, 3 * strlen(path) + 1);
|
|
|
5f2ef4 |
const unsigned char *s = (const unsigned char *)path;
|
|
|
5f2ef4 |
unsigned char *d = (unsigned char *)copy;
|
|
|
5f2ef4 |
- unsigned c;
|
|
|
5f2ef4 |
+ int noplus = (flags & RULEFLAG_ESCAPENOPLUS) != 0;
|
|
|
5f2ef4 |
+ int ctls = (flags & RULEFLAG_ESCAPECTLS) != 0;
|
|
|
5f2ef4 |
+ unsigned char c;
|
|
|
5f2ef4 |
|
|
|
5f2ef4 |
while ((c = *s)) {
|
|
|
5f2ef4 |
- if (!escapeme) {
|
|
|
5f2ef4 |
+ if (((ctls ? !TEST_CHAR(c, T_VCHAR_OBSTEXT) : !escapeme)
|
|
|
5f2ef4 |
+ || (escapeme && ap_strchr_c(escapeme, c)))
|
|
|
5f2ef4 |
+ && (!noescapeme || !ap_strchr_c(noescapeme, c))) {
|
|
|
5f2ef4 |
if (apr_isalnum(c) || c == '_') {
|
|
|
5f2ef4 |
*d++ = c;
|
|
|
5f2ef4 |
}
|
|
|
5f2ef4 |
@@ -665,23 +679,8 @@ static char *escape_backref(apr_pool_t *p, const char *path, const char *escapem
|
|
|
5f2ef4 |
d = c2x(c, '%', d);
|
|
|
5f2ef4 |
}
|
|
|
5f2ef4 |
}
|
|
|
5f2ef4 |
- else {
|
|
|
5f2ef4 |
- const char *esc = escapeme;
|
|
|
5f2ef4 |
- while (*esc) {
|
|
|
5f2ef4 |
- if (c == *esc) {
|
|
|
5f2ef4 |
- if (c == ' ' && !noplus) {
|
|
|
5f2ef4 |
- *d++ = '+';
|
|
|
5f2ef4 |
- }
|
|
|
5f2ef4 |
- else {
|
|
|
5f2ef4 |
- d = c2x(c, '%', d);
|
|
|
5f2ef4 |
- }
|
|
|
5f2ef4 |
- break;
|
|
|
5f2ef4 |
- }
|
|
|
5f2ef4 |
- ++esc;
|
|
|
5f2ef4 |
- }
|
|
|
5f2ef4 |
- if (!*esc) {
|
|
|
5f2ef4 |
- *d++ = c;
|
|
|
5f2ef4 |
- }
|
|
|
5f2ef4 |
+ else {
|
|
|
5f2ef4 |
+ *d++ = c;
|
|
|
5f2ef4 |
}
|
|
|
5f2ef4 |
++s;
|
|
|
5f2ef4 |
}
|
|
|
5f2ef4 |
@@ -763,11 +762,19 @@ static char *escape_absolute_uri(apr_pool_t *p, char *uri, unsigned scheme)
|
|
|
0de8c9 |
* split out a QUERY_STRING part from
|
|
|
0de8c9 |
* the current URI string
|
|
|
0de8c9 |
*/
|
|
|
0de8c9 |
-static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard,
|
|
|
0de8c9 |
- int qslast)
|
|
|
0de8c9 |
+static void splitout_queryargs(request_rec *r, int flags)
|
|
|
0de8c9 |
{
|
|
|
0de8c9 |
char *q;
|
|
|
0de8c9 |
int split, skip;
|
|
|
0de8c9 |
+ int qsappend = flags & RULEFLAG_QSAPPEND;
|
|
|
0de8c9 |
+ int qsdiscard = flags & RULEFLAG_QSDISCARD;
|
|
|
0de8c9 |
+ int qslast = flags & RULEFLAG_QSLAST;
|
|
|
0de8c9 |
+
|
|
|
0de8c9 |
+ if (flags & RULEFLAG_QSNONE) {
|
|
|
0de8c9 |
+ rewritelog((r, 2, NULL, "discarding query string, no parse from substitution"));
|
|
|
0de8c9 |
+ r->args = NULL;
|
|
|
0de8c9 |
+ return;
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
|
|
|
0de8c9 |
/* don't touch, unless it's a scheme for which a query string makes sense.
|
|
|
0de8c9 |
* See RFC 1738 and RFC 2368.
|
|
|
5f2ef4 |
@@ -792,7 +799,7 @@ static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard,
|
|
|
0de8c9 |
olduri = apr_pstrdup(r->pool, r->filename);
|
|
|
0de8c9 |
*q++ = '\0';
|
|
|
0de8c9 |
if (qsappend) {
|
|
|
0de8c9 |
- if (*q) {
|
|
|
0de8c9 |
+ if (*q) {
|
|
|
0de8c9 |
r->args = apr_pstrcat(r->pool, q, "&" , r->args, NULL);
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
}
|
|
|
5f2ef4 |
@@ -800,9 +807,9 @@ static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard,
|
|
|
0de8c9 |
r->args = apr_pstrdup(r->pool, q);
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
|
|
|
0de8c9 |
- if (r->args) {
|
|
|
0de8c9 |
+ if (r->args) {
|
|
|
0de8c9 |
len = strlen(r->args);
|
|
|
0de8c9 |
-
|
|
|
0de8c9 |
+
|
|
|
0de8c9 |
if (!len) {
|
|
|
0de8c9 |
r->args = NULL;
|
|
|
0de8c9 |
}
|
|
|
5f2ef4 |
@@ -2434,7 +2441,8 @@ static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry)
|
|
|
5f2ef4 |
/* escape the backreference */
|
|
|
5f2ef4 |
char *tmp2, *tmp;
|
|
|
5f2ef4 |
tmp = apr_pstrmemdup(pool, bri->source + bri->regmatch[n].rm_so, span);
|
|
|
5f2ef4 |
- tmp2 = escape_backref(pool, tmp, entry->escapes, entry->flags & RULEFLAG_ESCAPENOPLUS);
|
|
|
5f2ef4 |
+ tmp2 = escape_backref(pool, tmp, entry->escapes, entry->noescapes,
|
|
|
5f2ef4 |
+ entry->flags);
|
|
|
5f2ef4 |
rewritelog((ctx->r, 5, ctx->perdir, "escaping backreference '%s' to '%s'",
|
|
|
5f2ef4 |
tmp, tmp2));
|
|
|
5f2ef4 |
|
|
|
5f2ef4 |
@@ -2735,7 +2743,7 @@ static apr_status_t rewritelock_remove(void *data)
|
|
|
0de8c9 |
* XXX: what an inclined parser. Seems we have to leave it so
|
|
|
0de8c9 |
* for backwards compat. *sigh*
|
|
|
0de8c9 |
*/
|
|
|
0de8c9 |
-static int parseargline(char *str, char **a1, char **a2, char **a3)
|
|
|
0de8c9 |
+static int parseargline(char *str, char **a1, char **a2, char **a2_end, char **a3)
|
|
|
0de8c9 |
{
|
|
|
0de8c9 |
char quote;
|
|
|
0de8c9 |
|
|
|
5f2ef4 |
@@ -2786,8 +2794,10 @@ static int parseargline(char *str, char **a1, char **a2, char **a3)
|
|
|
0de8c9 |
|
|
|
0de8c9 |
if (!*str) {
|
|
|
0de8c9 |
*a3 = NULL; /* 3rd argument is optional */
|
|
|
0de8c9 |
+ *a2_end = str;
|
|
|
0de8c9 |
return 0;
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
+ *a2_end = str;
|
|
|
0de8c9 |
*str++ = '\0';
|
|
|
0de8c9 |
|
|
|
0de8c9 |
while (apr_isspace(*str)) {
|
|
|
5f2ef4 |
@@ -3327,7 +3337,7 @@ static const char *cmd_rewritecond(cmd_parms *cmd, void *in_dconf,
|
|
|
0de8c9 |
rewrite_server_conf *sconf;
|
|
|
0de8c9 |
rewritecond_entry *newcond;
|
|
|
0de8c9 |
ap_regex_t *regexp;
|
|
|
0de8c9 |
- char *a1 = NULL, *a2 = NULL, *a3 = NULL;
|
|
|
0de8c9 |
+ char *a1 = NULL, *a2 = NULL, *a2_end, *a3 = NULL;
|
|
|
0de8c9 |
const char *err;
|
|
|
0de8c9 |
|
|
|
0de8c9 |
sconf = ap_get_module_config(cmd->server->module_config, &rewrite_module);
|
|
|
5f2ef4 |
@@ -3345,7 +3355,7 @@ static const char *cmd_rewritecond(cmd_parms *cmd, void *in_dconf,
|
|
|
0de8c9 |
* of the argument line. So we can use a1 .. a3 without
|
|
|
0de8c9 |
* copying them again.
|
|
|
0de8c9 |
*/
|
|
|
0de8c9 |
- if (parseargline(str, &a1, &a2, &a3)) {
|
|
|
0de8c9 |
+ if (parseargline(str, &a1, &a2, &a2_end, &a3)) {
|
|
|
0de8c9 |
return apr_pstrcat(cmd->pool, "RewriteCond: bad argument line '", str,
|
|
|
0de8c9 |
"'", NULL);
|
|
|
0de8c9 |
}
|
|
|
5f2ef4 |
@@ -3504,13 +3514,24 @@ static const char *cmd_rewriterule_setflag(apr_pool_t *p, void *_cfg,
|
|
|
5f2ef4 |
case 'B':
|
|
|
5f2ef4 |
if (!*key || !strcasecmp(key, "ackrefescaping")) {
|
|
|
5f2ef4 |
cfg->flags |= RULEFLAG_ESCAPEBACKREF;
|
|
|
5f2ef4 |
- if (val && *val) {
|
|
|
5f2ef4 |
+ if (val && *val) {
|
|
|
5f2ef4 |
cfg->escapes = val;
|
|
|
5f2ef4 |
}
|
|
|
5f2ef4 |
}
|
|
|
5f2ef4 |
+ else if (!strcasecmp(key, "NE")) {
|
|
|
5f2ef4 |
+ if (val && *val) {
|
|
|
5f2ef4 |
+ cfg->noescapes = val;
|
|
|
5f2ef4 |
+ }
|
|
|
5f2ef4 |
+ else {
|
|
|
5f2ef4 |
+ return "flag 'BNE' wants a list of characters (i.e. [BNE=...])";
|
|
|
5f2ef4 |
+ }
|
|
|
5f2ef4 |
+ }
|
|
|
5f2ef4 |
else if (!strcasecmp(key, "NP") || !strcasecmp(key, "ackrefernoplus")) {
|
|
|
5f2ef4 |
cfg->flags |= RULEFLAG_ESCAPENOPLUS;
|
|
|
5f2ef4 |
}
|
|
|
5f2ef4 |
+ else if (!strcasecmp(key, "CTLS")) {
|
|
|
5f2ef4 |
+ cfg->flags |= RULEFLAG_ESCAPECTLS|RULEFLAG_ESCAPEBACKREF;
|
|
|
5f2ef4 |
+ }
|
|
|
5f2ef4 |
else {
|
|
|
5f2ef4 |
++error;
|
|
|
5f2ef4 |
}
|
|
|
5f2ef4 |
@@ -3753,7 +3774,7 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf,
|
|
|
0de8c9 |
rewrite_server_conf *sconf;
|
|
|
0de8c9 |
rewriterule_entry *newrule;
|
|
|
0de8c9 |
ap_regex_t *regexp;
|
|
|
0de8c9 |
- char *a1 = NULL, *a2 = NULL, *a3 = NULL;
|
|
|
0de8c9 |
+ char *a1 = NULL, *a2 = NULL, *a2_end, *a3 = NULL;
|
|
|
0de8c9 |
const char *err;
|
|
|
0de8c9 |
|
|
|
0de8c9 |
sconf = ap_get_module_config(cmd->server->module_config, &rewrite_module);
|
|
|
5f2ef4 |
@@ -3767,12 +3788,11 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf,
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
|
|
|
0de8c9 |
/* parse the argument line ourself */
|
|
|
0de8c9 |
- if (parseargline(str, &a1, &a2, &a3)) {
|
|
|
0de8c9 |
+ if (parseargline(str, &a1, &a2, &a2_end, &a3)) {
|
|
|
0de8c9 |
return apr_pstrcat(cmd->pool, "RewriteRule: bad argument line '", str,
|
|
|
0de8c9 |
"'", NULL);
|
|
|
0de8c9 |
}
|
|
|
5f2ef4 |
|
|
|
5f2ef4 |
- /* arg3: optional flags field */
|
|
|
5f2ef4 |
newrule->forced_mimetype = NULL;
|
|
|
5f2ef4 |
newrule->forced_handler = NULL;
|
|
|
5f2ef4 |
newrule->forced_responsecode = HTTP_MOVED_TEMPORARILY;
|
|
|
5f2ef4 |
@@ -3781,6 +3801,9 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf,
|
|
|
5f2ef4 |
newrule->cookie = NULL;
|
|
|
5f2ef4 |
newrule->skip = 0;
|
|
|
5f2ef4 |
newrule->maxrounds = REWRITE_MAX_ROUNDS;
|
|
|
5f2ef4 |
+ newrule->escapes = newrule->noescapes = NULL;
|
|
|
5f2ef4 |
+
|
|
|
5f2ef4 |
+ /* arg3: optional flags field */
|
|
|
5f2ef4 |
if (a3 != NULL) {
|
|
|
5f2ef4 |
if ((err = cmd_parseflagfield(cmd->pool, newrule, a3,
|
|
|
5f2ef4 |
cmd_rewriterule_setflag)) != NULL) {
|
|
|
5f2ef4 |
@@ -3814,6 +3837,17 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf,
|
|
|
0de8c9 |
newrule->flags |= RULEFLAG_NOSUB;
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
|
|
|
0de8c9 |
+ if (*(a2_end-1) == '?') {
|
|
|
0de8c9 |
+ /* a literal ? at the end of the unsubstituted rewrite rule */
|
|
|
0de8c9 |
+ newrule->flags |= RULEFLAG_QSNONE;
|
|
|
5f2ef4 |
+ *(a2_end-1) = '\0'; /* trailing ? has done its job */
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
+ else if (newrule->flags & RULEFLAG_QSDISCARD) {
|
|
|
0de8c9 |
+ if (NULL == ap_strchr(newrule->output, '?')) {
|
|
|
0de8c9 |
+ newrule->flags |= RULEFLAG_QSNONE;
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
+
|
|
|
0de8c9 |
/* now, if the server or per-dir config holds an
|
|
|
0de8c9 |
* array of RewriteCond entries, we take it for us
|
|
|
0de8c9 |
* and clear the array
|
|
|
5f2ef4 |
@@ -4219,9 +4253,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx)
|
|
|
0de8c9 |
r->path_info = NULL;
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
|
|
|
0de8c9 |
- splitout_queryargs(r, p->flags & RULEFLAG_QSAPPEND,
|
|
|
0de8c9 |
- p->flags & RULEFLAG_QSDISCARD,
|
|
|
0de8c9 |
- p->flags & RULEFLAG_QSLAST);
|
|
|
0de8c9 |
+ splitout_queryargs(r, p->flags);
|
|
|
0de8c9 |
|
|
|
0de8c9 |
/* Add the previously stripped per-directory location prefix, unless
|
|
|
0de8c9 |
* (1) it's an absolute URL path and
|
|
|
5f2ef4 |
@@ -4700,8 +4732,25 @@ static int hook_uri2file(request_rec *r)
|
|
|
5f2ef4 |
}
|
|
|
0de8c9 |
|
|
|
5f2ef4 |
if (rulestatus) {
|
|
|
5f2ef4 |
- unsigned skip;
|
|
|
5f2ef4 |
- apr_size_t flen;
|
|
|
5f2ef4 |
+ unsigned skip_absolute = is_absolute_uri(r->filename, NULL);
|
|
|
5f2ef4 |
+ apr_size_t flen = r->filename ? strlen(r->filename) : 0;
|
|
|
5f2ef4 |
+ int to_proxyreq = (flen > 6 && strncmp(r->filename, "proxy:", 6) == 0);
|
|
|
5f2ef4 |
+ int will_escape = skip_absolute && (rulestatus != ACTION_NOESCAPE);
|
|
|
5f2ef4 |
+
|
|
|
5f2ef4 |
+ if (r->args
|
|
|
5f2ef4 |
+ && !will_escape
|
|
|
5f2ef4 |
+ && *(ap_scan_vchar_obstext(r->args))) {
|
|
|
0de8c9 |
+ /*
|
|
|
0de8c9 |
+ * We have a raw control character or a ' ' in r->args.
|
|
|
0de8c9 |
+ * Correct encoding was missed.
|
|
|
5f2ef4 |
+ * Correct encoding was missed and we're not going to escape
|
|
|
5f2ef4 |
+ * it before returning.
|
|
|
0de8c9 |
+ */
|
|
|
0de8c9 |
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10410)
|
|
|
0de8c9 |
+ "Rewritten query string contains control "
|
|
|
0de8c9 |
+ "characters or spaces");
|
|
|
0de8c9 |
+ return HTTP_FORBIDDEN;
|
|
|
0de8c9 |
+ }
|
|
|
5f2ef4 |
|
|
|
0de8c9 |
if (ACTION_STATUS == rulestatus) {
|
|
|
0de8c9 |
int n = r->status;
|
|
|
5f2ef4 |
@@ -4710,8 +4759,7 @@ static int hook_uri2file(request_rec *r)
|
|
|
5f2ef4 |
return n;
|
|
|
5f2ef4 |
}
|
|
|
0de8c9 |
|
|
|
5f2ef4 |
- flen = r->filename ? strlen(r->filename) : 0;
|
|
|
5f2ef4 |
- if (flen > 6 && strncmp(r->filename, "proxy:", 6) == 0) {
|
|
|
5f2ef4 |
+ if (to_proxyreq) {
|
|
|
5f2ef4 |
/* it should be go on as an internal proxy request */
|
|
|
0de8c9 |
|
|
|
5f2ef4 |
/* check if the proxy module is enabled, so
|
|
|
5f2ef4 |
@@ -4753,7 +4801,7 @@ static int hook_uri2file(request_rec *r)
|
|
|
5f2ef4 |
r->filename));
|
|
|
5f2ef4 |
return OK;
|
|
|
5f2ef4 |
}
|
|
|
5f2ef4 |
- else if ((skip = is_absolute_uri(r->filename, NULL)) > 0) {
|
|
|
5f2ef4 |
+ else if (skip_absolute > 0) {
|
|
|
5f2ef4 |
int n;
|
|
|
5f2ef4 |
|
|
|
5f2ef4 |
/* it was finally rewritten to a remote URL */
|
|
|
5f2ef4 |
@@ -4761,7 +4809,7 @@ static int hook_uri2file(request_rec *r)
|
|
|
5f2ef4 |
if (rulestatus != ACTION_NOESCAPE) {
|
|
|
5f2ef4 |
rewritelog((r, 1, NULL, "escaping %s for redirect",
|
|
|
5f2ef4 |
r->filename));
|
|
|
5f2ef4 |
- r->filename = escape_absolute_uri(r->pool, r->filename, skip);
|
|
|
5f2ef4 |
+ r->filename = escape_absolute_uri(r->pool, r->filename, skip_absolute);
|
|
|
5f2ef4 |
}
|
|
|
5f2ef4 |
|
|
|
5f2ef4 |
/* append the QUERY_STRING part */
|
|
|
5f2ef4 |
@@ -4985,7 +5033,26 @@ static int hook_fixup(request_rec *r)
|
|
|
5f2ef4 |
*/
|
|
|
5f2ef4 |
rulestatus = apply_rewrite_list(r, dconf->rewriterules, dconf->directory);
|
|
|
5f2ef4 |
if (rulestatus) {
|
|
|
5f2ef4 |
- unsigned skip;
|
|
|
5f2ef4 |
+ unsigned skip_absolute = is_absolute_uri(r->filename, NULL);
|
|
|
5f2ef4 |
+ int to_proxyreq = 0;
|
|
|
5f2ef4 |
+ int will_escape = 0;
|
|
|
5f2ef4 |
+
|
|
|
5f2ef4 |
+ l = strlen(r->filename);
|
|
|
5f2ef4 |
+ to_proxyreq = l > 6 && strncmp(r->filename, "proxy:", 6) == 0;
|
|
|
5f2ef4 |
+ will_escape = skip_absolute && (rulestatus != ACTION_NOESCAPE);
|
|
|
5f2ef4 |
+
|
|
|
5f2ef4 |
+ if (r->args
|
|
|
5f2ef4 |
+ && !will_escape
|
|
|
5f2ef4 |
+ && *(ap_scan_vchar_obstext(r->args))) {
|
|
|
0de8c9 |
+ /*
|
|
|
0de8c9 |
+ * We have a raw control character or a ' ' in r->args.
|
|
|
0de8c9 |
+ * Correct encoding was missed.
|
|
|
0de8c9 |
+ */
|
|
|
0de8c9 |
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10411)
|
|
|
0de8c9 |
+ "Rewritten query string contains control "
|
|
|
0de8c9 |
+ "characters or spaces");
|
|
|
0de8c9 |
+ return HTTP_FORBIDDEN;
|
|
|
0de8c9 |
+ }
|
|
|
5f2ef4 |
|
|
|
0de8c9 |
if (ACTION_STATUS == rulestatus) {
|
|
|
0de8c9 |
int n = r->status;
|
|
|
5f2ef4 |
@@ -4994,8 +5061,7 @@ static int hook_fixup(request_rec *r)
|
|
|
5f2ef4 |
return n;
|
|
|
5f2ef4 |
}
|
|
|
5f2ef4 |
|
|
|
5f2ef4 |
- l = strlen(r->filename);
|
|
|
5f2ef4 |
- if (l > 6 && strncmp(r->filename, "proxy:", 6) == 0) {
|
|
|
5f2ef4 |
+ if (to_proxyreq) {
|
|
|
5f2ef4 |
/* it should go on as an internal proxy request */
|
|
|
5f2ef4 |
|
|
|
5f2ef4 |
/* make sure the QUERY_STRING and
|
|
|
5f2ef4 |
@@ -5019,7 +5085,7 @@ static int hook_fixup(request_rec *r)
|
|
|
5f2ef4 |
"%s [OK]", r->filename));
|
|
|
5f2ef4 |
return OK;
|
|
|
5f2ef4 |
}
|
|
|
5f2ef4 |
- else if ((skip = is_absolute_uri(r->filename, NULL)) > 0) {
|
|
|
5f2ef4 |
+ else if (skip_absolute > 0) {
|
|
|
5f2ef4 |
/* it was finally rewritten to a remote URL */
|
|
|
5f2ef4 |
|
|
|
5f2ef4 |
/* because we are in a per-dir context
|
|
|
5f2ef4 |
@@ -5028,7 +5094,7 @@ static int hook_fixup(request_rec *r)
|
|
|
5f2ef4 |
*/
|
|
|
5f2ef4 |
if (dconf->baseurl != NULL) {
|
|
|
5f2ef4 |
/* skip 'scheme://' */
|
|
|
5f2ef4 |
- cp = r->filename + skip;
|
|
|
5f2ef4 |
+ cp = r->filename + skip_absolute;
|
|
|
5f2ef4 |
|
|
|
5f2ef4 |
if ((cp = ap_strchr(cp, '/')) != NULL && *(++cp)) {
|
|
|
5f2ef4 |
rewritelog((r, 2, dconf->directory,
|
|
|
5f2ef4 |
@@ -5073,7 +5139,7 @@ static int hook_fixup(request_rec *r)
|
|
|
5f2ef4 |
if (rulestatus != ACTION_NOESCAPE) {
|
|
|
5f2ef4 |
rewritelog((r, 1, dconf->directory, "escaping %s for redirect",
|
|
|
5f2ef4 |
r->filename));
|
|
|
5f2ef4 |
- r->filename = escape_absolute_uri(r->pool, r->filename, skip);
|
|
|
5f2ef4 |
+ r->filename = escape_absolute_uri(r->pool, r->filename, skip_absolute);
|
|
|
5f2ef4 |
}
|
|
|
0de8c9 |
|
|
|
5f2ef4 |
/* append the QUERY_STRING part */
|
|
|
0de8c9 |
diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c
|
|
|
5f2ef4 |
index ff9f81d..b6e11c1 100644
|
|
|
0de8c9 |
--- a/modules/proxy/mod_proxy.c
|
|
|
0de8c9 |
+++ b/modules/proxy/mod_proxy.c
|
|
|
0de8c9 |
@@ -960,6 +960,8 @@ PROXY_DECLARE(int) ap_proxy_trans_match(request_rec *r, struct proxy_alias *ent,
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
|
|
|
0de8c9 |
if (found) {
|
|
|
0de8c9 |
+ unsigned int encoded = ent->flags & PROXYPASS_MAP_ENCODED;
|
|
|
0de8c9 |
+
|
|
|
0de8c9 |
/* A proxy module is assigned this URL, check whether it's interested
|
|
|
0de8c9 |
* in the request itself (e.g. proxy_wstunnel cares about Upgrade
|
|
|
0de8c9 |
* requests only, and could hand over to proxy_http otherwise).
|
|
|
0de8c9 |
@@ -979,6 +981,9 @@ PROXY_DECLARE(int) ap_proxy_trans_match(request_rec *r, struct proxy_alias *ent,
|
|
|
0de8c9 |
if (ent->flags & PROXYPASS_NOQUERY) {
|
|
|
0de8c9 |
apr_table_setn(r->notes, "proxy-noquery", "1");
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
+ if (encoded) {
|
|
|
0de8c9 |
+ apr_table_setn(r->notes, "proxy-noencode", "1");
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
|
|
|
0de8c9 |
if (servlet_uri) {
|
|
|
0de8c9 |
ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, APLOGNO(10248)
|
|
|
0de8c9 |
@@ -992,13 +997,13 @@ PROXY_DECLARE(int) ap_proxy_trans_match(request_rec *r, struct proxy_alias *ent,
|
|
|
0de8c9 |
*/
|
|
|
0de8c9 |
AP_DEBUG_ASSERT(strlen(r->uri) >= strlen(servlet_uri));
|
|
|
0de8c9 |
strcpy(r->uri, servlet_uri);
|
|
|
0de8c9 |
- return DONE;
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
-
|
|
|
0de8c9 |
- ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, APLOGNO(03464)
|
|
|
0de8c9 |
- "URI path '%s' matches proxy handler '%s'", r->uri,
|
|
|
0de8c9 |
- found);
|
|
|
0de8c9 |
- return OK;
|
|
|
0de8c9 |
+ else {
|
|
|
0de8c9 |
+ ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, APLOGNO(03464)
|
|
|
0de8c9 |
+ "URI path '%s' matches proxy handler '%s'", r->uri,
|
|
|
0de8c9 |
+ found);
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
+ return (encoded) ? DONE : OK;
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
|
|
|
0de8c9 |
return HTTP_CONTINUE;
|
|
|
0de8c9 |
diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c
|
|
|
5f2ef4 |
index e2992fc..fdccb86 100644
|
|
|
0de8c9 |
--- a/modules/proxy/mod_proxy_ajp.c
|
|
|
0de8c9 |
+++ b/modules/proxy/mod_proxy_ajp.c
|
|
|
0de8c9 |
@@ -65,11 +65,25 @@ static int proxy_ajp_canon(request_rec *r, char *url)
|
|
|
0de8c9 |
if (apr_table_get(r->notes, "proxy-nocanon")) {
|
|
|
0de8c9 |
path = url; /* this is the raw path */
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
+ else if (apr_table_get(r->notes, "proxy-noencode")) {
|
|
|
0de8c9 |
+ path = url; /* this is the encoded path already */
|
|
|
0de8c9 |
+ search = r->args;
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
else {
|
|
|
0de8c9 |
path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
|
|
|
0de8c9 |
r->proxyreq);
|
|
|
0de8c9 |
search = r->args;
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
+ if (search && *ap_scan_vchar_obstext(search)) {
|
|
|
0de8c9 |
+ /*
|
|
|
0de8c9 |
+ * We have a raw control character or a ' ' in r->args.
|
|
|
0de8c9 |
+ * Correct encoding was missed.
|
|
|
0de8c9 |
+ */
|
|
|
0de8c9 |
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10406)
|
|
|
0de8c9 |
+ "To be forwarded query string contains control "
|
|
|
0de8c9 |
+ "characters or spaces");
|
|
|
0de8c9 |
+ return HTTP_FORBIDDEN;
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
if (path == NULL)
|
|
|
0de8c9 |
return HTTP_BAD_REQUEST;
|
|
|
0de8c9 |
|
|
|
0de8c9 |
diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c
|
|
|
5f2ef4 |
index db46952..8927d7b 100644
|
|
|
0de8c9 |
--- a/modules/proxy/mod_proxy_balancer.c
|
|
|
0de8c9 |
+++ b/modules/proxy/mod_proxy_balancer.c
|
|
|
0de8c9 |
@@ -102,11 +102,25 @@ static int proxy_balancer_canon(request_rec *r, char *url)
|
|
|
0de8c9 |
if (apr_table_get(r->notes, "proxy-nocanon")) {
|
|
|
0de8c9 |
path = url; /* this is the raw path */
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
+ else if (apr_table_get(r->notes, "proxy-noencode")) {
|
|
|
0de8c9 |
+ path = url; /* this is the encoded path already */
|
|
|
0de8c9 |
+ search = r->args;
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
else {
|
|
|
0de8c9 |
path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
|
|
|
0de8c9 |
r->proxyreq);
|
|
|
0de8c9 |
search = r->args;
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
+ if (search && *ap_scan_vchar_obstext(search)) {
|
|
|
0de8c9 |
+ /*
|
|
|
0de8c9 |
+ * We have a raw control character or a ' ' in r->args.
|
|
|
0de8c9 |
+ * Correct encoding was missed.
|
|
|
0de8c9 |
+ */
|
|
|
0de8c9 |
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10407)
|
|
|
0de8c9 |
+ "To be forwarded query string contains control "
|
|
|
0de8c9 |
+ "characters or spaces");
|
|
|
0de8c9 |
+ return HTTP_FORBIDDEN;
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
if (path == NULL)
|
|
|
0de8c9 |
return HTTP_BAD_REQUEST;
|
|
|
0de8c9 |
|
|
|
0de8c9 |
diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c
|
|
|
0de8c9 |
index 3382b9b..a89b9a9 100644
|
|
|
0de8c9 |
--- a/modules/proxy/mod_proxy_fcgi.c
|
|
|
0de8c9 |
+++ b/modules/proxy/mod_proxy_fcgi.c
|
|
|
0de8c9 |
@@ -92,8 +92,9 @@ static int proxy_fcgi_canon(request_rec *r, char *url)
|
|
|
0de8c9 |
host = apr_pstrcat(r->pool, "[", host, "]", NULL);
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
|
|
|
0de8c9 |
- if (apr_table_get(r->notes, "proxy-nocanon")) {
|
|
|
0de8c9 |
- path = url; /* this is the raw path */
|
|
|
0de8c9 |
+ if (apr_table_get(r->notes, "proxy-nocanon")
|
|
|
0de8c9 |
+ || apr_table_get(r->notes, "proxy-noencode")) {
|
|
|
0de8c9 |
+ path = url; /* this is the raw/encoded path */
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
else {
|
|
|
0de8c9 |
path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
|
|
|
0de8c9 |
diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c
|
|
|
5f2ef4 |
index 3e5c056..9da15e4 100644
|
|
|
0de8c9 |
--- a/modules/proxy/mod_proxy_http.c
|
|
|
0de8c9 |
+++ b/modules/proxy/mod_proxy_http.c
|
|
|
0de8c9 |
@@ -121,11 +121,25 @@ static int proxy_http_canon(request_rec *r, char *url)
|
|
|
0de8c9 |
if (apr_table_get(r->notes, "proxy-nocanon")) {
|
|
|
0de8c9 |
path = url; /* this is the raw path */
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
+ else if (apr_table_get(r->notes, "proxy-noencode")) {
|
|
|
0de8c9 |
+ path = url; /* this is the encoded path already */
|
|
|
0de8c9 |
+ search = r->args;
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
else {
|
|
|
0de8c9 |
path = ap_proxy_canonenc(r->pool, url, strlen(url),
|
|
|
0de8c9 |
enc_path, 0, r->proxyreq);
|
|
|
0de8c9 |
search = r->args;
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
+ if (search && *ap_scan_vchar_obstext(search)) {
|
|
|
0de8c9 |
+ /*
|
|
|
0de8c9 |
+ * We have a raw control character or a ' ' in r->args.
|
|
|
0de8c9 |
+ * Correct encoding was missed.
|
|
|
0de8c9 |
+ */
|
|
|
0de8c9 |
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10408)
|
|
|
0de8c9 |
+ "To be forwarded query string contains control "
|
|
|
0de8c9 |
+ "characters or spaces");
|
|
|
0de8c9 |
+ return HTTP_FORBIDDEN;
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
break;
|
|
|
0de8c9 |
case PROXYREQ_PROXY:
|
|
|
0de8c9 |
path = url;
|
|
|
0de8c9 |
diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c
|
|
|
5f2ef4 |
index 4d7589c..877e7eb 100644
|
|
|
0de8c9 |
--- a/modules/proxy/mod_proxy_uwsgi.c
|
|
|
0de8c9 |
+++ b/modules/proxy/mod_proxy_uwsgi.c
|
|
|
0de8c9 |
@@ -84,8 +84,14 @@ static int uwsgi_canon(request_rec *r, char *url)
|
|
|
0de8c9 |
host = apr_pstrcat(r->pool, "[", host, "]", NULL);
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
|
|
|
0de8c9 |
- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
|
|
|
0de8c9 |
- r->proxyreq);
|
|
|
0de8c9 |
+ if (apr_table_get(r->notes, "proxy-nocanon")
|
|
|
0de8c9 |
+ || apr_table_get(r->notes, "proxy-noencode")) {
|
|
|
0de8c9 |
+ path = url; /* this is the raw/encoded path */
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
+ else {
|
|
|
0de8c9 |
+ path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
|
|
|
0de8c9 |
+ r->proxyreq);
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
if (!path) {
|
|
|
0de8c9 |
return HTTP_BAD_REQUEST;
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
diff --git a/modules/proxy/mod_proxy_wstunnel.c b/modules/proxy/mod_proxy_wstunnel.c
|
|
|
0de8c9 |
index c29ded1..3a68b85 100644
|
|
|
0de8c9 |
--- a/modules/proxy/mod_proxy_wstunnel.c
|
|
|
0de8c9 |
+++ b/modules/proxy/mod_proxy_wstunnel.c
|
|
|
0de8c9 |
@@ -111,11 +111,25 @@ static int proxy_wstunnel_canon(request_rec *r, char *url)
|
|
|
0de8c9 |
if (apr_table_get(r->notes, "proxy-nocanon")) {
|
|
|
0de8c9 |
path = url; /* this is the raw path */
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
+ else if (apr_table_get(r->notes, "proxy-noencode")) {
|
|
|
0de8c9 |
+ path = url; /* this is the encoded path already */
|
|
|
0de8c9 |
+ search = r->args;
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
else {
|
|
|
0de8c9 |
path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0,
|
|
|
0de8c9 |
r->proxyreq);
|
|
|
0de8c9 |
search = r->args;
|
|
|
0de8c9 |
}
|
|
|
0de8c9 |
+ if (search && *ap_scan_vchar_obstext(search)) {
|
|
|
0de8c9 |
+ /*
|
|
|
0de8c9 |
+ * We have a raw control character or a ' ' in r->args.
|
|
|
0de8c9 |
+ * Correct encoding was missed.
|
|
|
0de8c9 |
+ */
|
|
|
0de8c9 |
+ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10409)
|
|
|
0de8c9 |
+ "To be forwarded query string contains control "
|
|
|
0de8c9 |
+ "characters or spaces");
|
|
|
0de8c9 |
+ return HTTP_FORBIDDEN;
|
|
|
0de8c9 |
+ }
|
|
|
0de8c9 |
if (path == NULL)
|
|
|
0de8c9 |
return HTTP_BAD_REQUEST;
|
|
|
0de8c9 |
|