]> git.ipfire.org Git - thirdparty/squid.git/commitdiff
Do not escape malformed URI twice when sending ICP errors (#2374)
authorJoshua Rogers <megamansec@gmail.com>
Tue, 10 Feb 2026 19:58:49 +0000 (19:58 +0000)
committerSquid Anubis <squid-anubis@squid-cache.org>
Wed, 11 Feb 2026 01:37:01 +0000 (01:37 +0000)
In this context, escaping escaped URI always produces incorrect URI
because `%` character in the escaped URI gets escaped again. Feeding the
result of the first rfc1738_escape() call to the second call is also
dangerously wrong because the result of the first call gets invalidated
during the second call.

No other cases of such "chained" rfc1738_escape() calls were found.

Broken since 2002 commit e6ccf245.

src/icp_v2.cc

index 2a4ced3bfabc2697d22b57e9e1426309fe291453..25f7b71d25ef8566d71a41782c8ddfafdcf7c00d 100644 (file)
@@ -461,7 +461,6 @@ HttpRequest *
 icpGetRequest(char *url, int reqnum, int fd, Ip::Address &from)
 {
     if (strpbrk(url, w_space)) {
-        url = rfc1738_escape(url);
         icpCreateAndSend(ICP_ERR, 0, rfc1738_escape(url), reqnum, 0, fd, from, nullptr);
         return nullptr;
     }