]> git.ipfire.org Git - thirdparty/apache/httpd.git/commit
mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F. PR 69197.
authorYann Ylavic <ylavic@apache.org>
Wed, 17 Jul 2024 20:50:12 +0000 (20:50 +0000)
committerYann Ylavic <ylavic@apache.org>
Wed, 17 Jul 2024 20:50:12 +0000 (20:50 +0000)
commita1a93beb58b81f1de2b713ae5f96c41ed5952a74
treea60e5fbce1f5fc2604b3254f307d338d14ed2920
parent07c50195643ddb3ca8f58a010c7d6ff4645c5675
mod_rewrite: Better question mark tracking to avoid UnsafeAllow3F.  PR 69197.

Track in do_expand() whether a '?' in the uri-path comes from a literal in
the substitution string or from an expansion (variable, lookup, ...).
In the former case it's safe to assume that it's the query-string separator
but for the other case it's not (could be a decoded %3f from r->uri).

This allows to avoid [UnsafeAllow3F] for most cases.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1919325 13f79535-47bb-0310-9956-ffa450edef68
changes-entries/pr69197.txt [new file with mode: 0644]
modules/mappers/mod_rewrite.c