diff --git a/include/http_protocol.h b/include/http_protocol.h

index 448ca53..8ed77ac 100644

--- a/include/http_protocol.h

+++ b/include/http_protocol.h

@@ -96,6 +96,13 @@ AP_DECLARE(void) ap_get_mime_headers(request_rec *r);

 AP_DECLARE(void) ap_get_mime_headers_core(request_rec *r,

                                           apr_bucket_brigade *bb);

+/**

+ * Run post_read_request hook and validate.

+ * @param r The current request

+ * @return OK or HTTP_...

+ */

+AP_DECLARE(int) ap_post_read_request(request_rec *r);

+

 /* Finish up stuff after a request */

 /**

diff --git a/modules/http/http_request.c b/modules/http/http_request.c

index 9e7c4db..e873aab 100644

--- a/modules/http/http_request.c

+++ b/modules/http/http_request.c

@@ -681,7 +681,7 @@ static request_rec *internal_internal_redirect(const char *new_uri,

      * to do their thing on internal redirects as well.  Perhaps this is a

      * misnamed function.

      */

-    if ((access_status = ap_run_post_read_request(new))) {

+    if ((access_status = ap_post_read_request(new))) {

         ap_die(access_status, new);

         return NULL;

     }

diff --git a/modules/http2/h2_request.c b/modules/http2/h2_request.c

index 8899c4f..03141d6 100644

--- a/modules/http2/h2_request.c

+++ b/modules/http2/h2_request.c

@@ -313,7 +313,7 @@ request_rec *h2_request_create_rec(const h2_request *req, conn_rec *c)

                                NULL, r, r->connection);

     if (access_status != HTTP_OK

-        || (access_status = ap_run_post_read_request(r))) {

+        || (access_status = ap_post_read_request(r))) {

         /* Request check post hooks failed. An example of this would be a

          * request for a vhost where h2 is disabled --> 421.

          */

diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c

index 9685e72..8bffc37 100644

--- a/modules/proxy/mod_proxy.c

+++ b/modules/proxy/mod_proxy.c

@@ -584,11 +584,12 @@ static int proxy_detect(request_rec *r)

     if (conf->req && r->parsed_uri.scheme) {

         /* but it might be something vhosted */

-        if (!(r->parsed_uri.hostname

-              && !strcasecmp(r->parsed_uri.scheme, ap_http_scheme(r))

-              && ap_matches_request_vhost(r, r->parsed_uri.hostname,

-                                          (apr_port_t)(r->parsed_uri.port_str ? r->parsed_uri.port

-                                                       : ap_default_port(r))))) {

+        if (!r->parsed_uri.hostname

+            || ap_cstr_casecmp(r->parsed_uri.scheme, ap_http_scheme(r)) != 0

+            || !ap_matches_request_vhost(r, r->parsed_uri.hostname,

+                                         (apr_port_t)(r->parsed_uri.port_str

+                                                      ? r->parsed_uri.port

+                                                      : ap_default_port(r)))) {

             r->proxyreq = PROXYREQ_PROXY;

             r->uri = r->unparsed_uri;

             r->filename = apr_pstrcat(r->pool, "proxy:", r->uri, NULL);

@@ -1743,6 +1744,7 @@ static const char *

     struct proxy_alias *new;

     char *f = cmd->path;

     char *r = NULL;

+    const char *real;

     char *word;

     apr_table_t *params = apr_table_make(cmd->pool, 5);

     const apr_array_header_t *arr;

@@ -1808,6 +1810,10 @@ static const char *

     if (r == NULL) {

         return "ProxyPass|ProxyPassMatch needs a path when not defined in a location";

     }

+    if (!(real = ap_proxy_de_socketfy(cmd->temp_pool, r))) {

+        return "ProxyPass|ProxyPassMatch uses an invalid \"unix:\" URL";

+    }

+

     /* if per directory, save away the single alias */

     if (cmd->path) {

@@ -1824,7 +1830,7 @@ static const char *

     }

     new->fake = apr_pstrdup(cmd->pool, f);

-    new->real = apr_pstrdup(cmd->pool, ap_proxy_de_socketfy(cmd->pool, r));

+    new->real = apr_pstrdup(cmd->pool, real);

     new->flags = flags;

     if (use_regex) {

         new->regex = ap_pregcomp(cmd->pool, f, AP_REG_EXTENDED);

@@ -2301,6 +2307,7 @@ static const char *add_member(cmd_parms *cmd, void *dummy, const char *arg)

     proxy_worker *worker;

     char *path = cmd->path;

     char *name = NULL;

+    const char *real;

     char *word;

     apr_table_t *params = apr_table_make(cmd->pool, 5);

     const apr_array_header_t *arr;

@@ -2341,6 +2348,9 @@ static const char *add_member(cmd_parms *cmd, void *dummy, const char *arg)

         return "BalancerMember must define balancer name when outside <Proxy > section";

     if (!name)

         return "BalancerMember must define remote proxy server";

+    if (!(real = ap_proxy_de_socketfy(cmd->temp_pool, name))) {

+        return "BalancerMember uses an invalid \"unix:\" URL";

+    }

     ap_str_tolower(path);   /* lowercase scheme://hostname */

@@ -2353,7 +2363,7 @@ static const char *add_member(cmd_parms *cmd, void *dummy, const char *arg)

     }

     /* Try to find existing worker */

-    worker = ap_proxy_get_worker(cmd->temp_pool, balancer, conf, ap_proxy_de_socketfy(cmd->temp_pool, name));

+    worker = ap_proxy_get_worker(cmd->temp_pool, balancer, conf, real);

     if (!worker) {

         ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, cmd->server, APLOGNO(01147)

                      "Defining worker '%s' for balancer '%s'",

@@ -2442,7 +2452,13 @@ static const char *

         }

     }

     else {

-        worker = ap_proxy_get_worker(cmd->temp_pool, NULL, conf, ap_proxy_de_socketfy(cmd->temp_pool, name));

+        const char *real;

+

+        if (!(real = ap_proxy_de_socketfy(cmd->temp_pool, name))) {

+            return "ProxySet uses an invalid \"unix:\" URL";

+        }

+

+        worker = ap_proxy_get_worker(cmd->temp_pool, NULL, conf, real);

         if (!worker) {

             if (in_proxy_section) {

                 err = ap_proxy_define_worker(cmd->pool, &worker, NULL,

@@ -2584,8 +2600,14 @@ static const char *proxysection(cmd_parms *cmd, void *mconfig, const char *arg)

             }

         }

         else {

+            const char *real;

+

+            if (!(real = ap_proxy_de_socketfy(cmd->temp_pool, conf->p))) {

+                return "<Proxy/ProxyMatch > uses an invalid \"unix:\" URL";

+            }

+

             worker = ap_proxy_get_worker(cmd->temp_pool, NULL, sconf,

-                                         ap_proxy_de_socketfy(cmd->temp_pool, (char*)conf->p));

+                                         real);

             if (!worker) {

                 err = ap_proxy_define_worker(cmd->pool, &worker, NULL,

                                           sconf, conf->p, 0);

diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h

index 7141473..7164bfe 100644

--- a/modules/proxy/mod_proxy.h

+++ b/modules/proxy/mod_proxy.h

@@ -698,6 +698,8 @@ typedef __declspec(dllimport) const char *

                proxy_dir_conf *, const char *);

 #endif

+#define AP_PROXY_WORKER_NO_UDS      (1u << 3)

+

 /* Connection pool API */

 /**

@@ -710,6 +712,24 @@ typedef __declspec(dllimport) const char *

 PROXY_DECLARE(char *) ap_proxy_worker_name(apr_pool_t *p,

                                            proxy_worker *worker);

+

+/**

+ * Get the worker from proxy configuration, looking for either PREFIXED or

+ * MATCHED or both types of workers according to given mask

+ * @param p        memory pool used for finding worker

+ * @param balancer the balancer that the worker belongs to

+ * @param conf     current proxy server configuration

+ * @param url      url to find the worker from

+ * @param mask     bitmask of AP_PROXY_WORKER_IS_*

+ * @return         proxy_worker or NULL if not found

+ */

+PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker_ex(apr_pool_t *p,

+                                                     proxy_balancer *balancer,

+                                                     proxy_server_conf *conf,

+                                                     const char *url,

+                                                     unsigned int mask);

+

+

 /**

  * Get the worker from proxy configuration

  * @param p        memory pool used for finding worker

@@ -722,6 +742,8 @@ PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker(apr_pool_t *p,

                                                   proxy_balancer *balancer,

                                                   proxy_server_conf *conf,

                                                   const char *url);

+

+

 /**

  * Define and Allocate space for the worker to proxy configuration

  * @param p         memory pool to allocate worker from

diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c

index fdb3a6d..a0556dd 100644

--- a/modules/proxy/proxy_util.c

+++ b/modules/proxy/proxy_util.c

@@ -1626,10 +1626,11 @@ PROXY_DECLARE(char *) ap_proxy_worker_name(apr_pool_t *p,

     return apr_pstrcat(p, "unix:", worker->s->uds_path, "|", worker->s->name, NULL);

 }

-PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker(apr_pool_t *p,

-                                                  proxy_balancer *balancer,

-                                                  proxy_server_conf *conf,

-                                                  const char *url)

+PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker_ex(apr_pool_t *p,

+                                                     proxy_balancer *balancer,

+                                                     proxy_server_conf *conf,

+                                                     const char *url,

+                                                     unsigned int mask)

 {

     proxy_worker *worker;

     proxy_worker *max_worker = NULL;

@@ -1645,7 +1646,12 @@ PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker(apr_pool_t *p,

         return NULL;

     }

-    url = ap_proxy_de_socketfy(p, url);

+    if (!(mask & AP_PROXY_WORKER_NO_UDS)) {

+        url = ap_proxy_de_socketfy(p, url);

+        if (!url) {

+            return NULL;

+        }

+    }

     c = ap_strchr_c(url, ':');

     if (c == NULL || c[1] != '/' || c[2] != '/' || c[3] == '\0') {

@@ -1710,6 +1716,14 @@ PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker(apr_pool_t *p,

     return max_worker;

 }

+PROXY_DECLARE(proxy_worker *) ap_proxy_get_worker(apr_pool_t *p,

+                                                  proxy_balancer *balancer,

+                                                  proxy_server_conf *conf,

+                                                  const char *url)

+{

+    return ap_proxy_get_worker_ex(p, balancer, conf, url, 0);

+}

+

 /*

  * To create a worker from scratch first we define the

  * specifics of the worker; this is all local data.

@@ -2110,22 +2124,24 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,

     access_status = proxy_run_pre_request(worker, balancer, r, conf, url);

     if (access_status == DECLINED && *balancer == NULL) {

-        *worker = ap_proxy_get_worker(r->pool, NULL, conf, *url);

+        const int forward = (r->proxyreq == PROXYREQ_PROXY);

+        *worker = ap_proxy_get_worker_ex(r->pool, NULL, conf, *url,

+                                         forward ? AP_PROXY_WORKER_NO_UDS : 0);

         if (*worker) {

             ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,

                           "%s: found worker %s for %s",

                           (*worker)->s->scheme, (*worker)->s->name, *url);

-            *balancer = NULL;

-            if (!fix_uds_filename(r, url)) {

+

+            if (!forward && !fix_uds_filename(r, url)) {

                      return HTTP_INTERNAL_SERVER_ERROR;

             }

+

             access_status = OK;

         }

-        else if (r->proxyreq == PROXYREQ_PROXY) {

+        else if (forward) {

             if (conf->forward) {

                 ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,

                               "*: found forward proxy worker for %s", *url);

-                *balancer = NULL;

                 *worker = conf->forward;

                 access_status = OK;

                 /*

@@ -2139,8 +2155,8 @@ PROXY_DECLARE(int) ap_proxy_pre_request(proxy_worker **worker,

         else if (r->proxyreq == PROXYREQ_REVERSE) {

             if (conf->reverse) {

                 ap_log_rerror(APLOG_MARK, APLOG_TRACE2, 0, r,

-                              "*: using default reverse proxy worker for %s (no keepalive)", *url);

-                *balancer = NULL;

+                              "*: using default reverse proxy worker for %s "

+                              "(no keepalive)", *url);

                 *worker = conf->reverse;

                 access_status = OK;

                 /*

diff --git a/server/protocol.c b/server/protocol.c

index ab1e316..a78eff6 100644

--- a/server/protocol.c

+++ b/server/protocol.c

@@ -1525,7 +1525,7 @@ request_rec *ap_read_request(conn_rec *conn)

     /* we may have switched to another server */

     apply_server_config(r);

-    if ((access_status = ap_run_post_read_request(r))) {

+    if ((access_status = ap_post_read_request(r))) {

         goto die;

     }

@@ -1582,6 +1582,27 @@ ignore:

     return NULL;

 }

+AP_DECLARE(int) ap_post_read_request(request_rec *r)

+{

+    int status;

+

+    if ((status = ap_run_post_read_request(r))) {

+        return status;

+    }

+

+    /* Enforce http(s) only scheme for non-forward-proxy requests */

+    if (!r->proxyreq

+            && r->parsed_uri.scheme

+            && (ap_cstr_casecmpn(r->parsed_uri.scheme, "http", 4) != 0

+                || (r->parsed_uri.scheme[4] != '\0'

+                    && (apr_tolower(r->parsed_uri.scheme[4]) != 's'

+                        || r->parsed_uri.scheme[5] != '\0')))) {

+        return HTTP_BAD_REQUEST;

+    }

+

+    return OK;

+}

+

 /* if a request with a body creates a subrequest, remove original request's

  * input headers which pertain to the body which has already been read.

  * out-of-line helper function for ap_set_sub_req_protocol.