From: Eric Covener <covener@apache.org>
Date: Fri, 14 Jul 2023 13:13:38 +0000 (+0000)
Subject: Backport rewrite changes 1910649:1910705 from trunk
X-Git-Tag: 2.4.58-rc1-candidate~77
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1c8c33076a8ff46bfa326c4244f00fa080615632;p=thirdparty%2Fapache%2Fhttpd.git

Backport rewrite changes 1910649:1910705 from trunk

PR66672 trailing ? and QSA together regression

Reviewed By: covener, gbechis, ylavic



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1910999 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/changes-entries/pr66672.txt b/changes-entries/pr66672.txt
new file mode 100644
index 00000000000..d4c9be3de65
--- /dev/null
+++ b/changes-entries/pr66672.txt
@@ -0,0 +1,2 @@
+  *) mod_rewrite: Fix a regression with both a trailing ? and [QSA].
+     in OCSP stapling. PR 66672. [Frank Meier <frank.meier ergon.ch>, covener]
diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c
index 4be51de1f4e..bbcc11b3c52 100644
--- a/modules/mappers/mod_rewrite.c
+++ b/modules/mappers/mod_rewrite.c
@@ -3865,8 +3865,16 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf,
 
     if (*(a2_end-1) == '?') {
         /* a literal ? at the end of the unsubstituted rewrite rule */
-        newrule->flags |= RULEFLAG_QSNONE;
-        *(a2_end-1) = '\0'; /* trailing ? has done its job */
+        if (newrule->flags & RULEFLAG_QSAPPEND) {
+           /* with QSA, splitout_queryargs will safely handle it if RULEFLAG_QSLAST is set */
+           newrule->flags |= RULEFLAG_QSLAST;
+        }
+        else {
+            /* avoid getting a query string via inadvertent capture */
+            newrule->flags |= RULEFLAG_QSNONE;
+            /* trailing ? has done its job, but splitout_queryargs will not chop it off */
+            *(a2_end-1) = '\0';
+       }
     }
     else if (newrule->flags & RULEFLAG_QSDISCARD) {
         if (NULL == ap_strchr(newrule->output, '?')) {