headers are converted to environment variables in <module>mod_cgi
</module> and other modules: Previously any invalid characters
in header names were simply translated to underscores. This allowed
- for some potential cross-site-scripting attacks via header injection
- (see <a href="http://events.ccc.de/congress/2007/Fahrplan/events/2212.en.html">
- Unusual Web Bugs</a>, slide 19/20).</p>
+ for some potential cross-site-scripting attacks via header injection.</p>
<p>If you have to support a client which sends broken headers and
which can't be fixed, a simple workaround involving <module>mod_setenvif