From: Joshua Rogers <megamansec@gmail.com>
Date: Tue, 10 Feb 2026 19:58:49 +0000 (+0000)
Subject: Do not escape malformed URI twice when sending ICP errors (#2374)
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=61268b075cdf193ed98a1742dffbf0773e4a4f08;p=thirdparty%2Fsquid.git

Do not escape malformed URI twice when sending ICP errors (#2374)

In this context, escaping escaped URI always produces incorrect URI
because `%` character in the escaped URI gets escaped again. Feeding the
result of the first rfc1738_escape() call to the second call is also
dangerously wrong because the result of the first call gets invalidated
during the second call.

No other cases of such "chained" rfc1738_escape() calls were found.

Broken since 2002 commit e6ccf245.
---

diff --git a/src/icp_v2.cc b/src/icp_v2.cc
index 2a4ced3bfa..25f7b71d25 100644
--- a/src/icp_v2.cc
+++ b/src/icp_v2.cc
@@ -461,7 +461,6 @@ HttpRequest *
 icpGetRequest(char *url, int reqnum, int fd, Ip::Address &from)
 {
     if (strpbrk(url, w_space)) {
-        url = rfc1738_escape(url);
         icpCreateAndSend(ICP_ERR, 0, rfc1738_escape(url), reqnum, 0, fd, from, nullptr);
         return nullptr;
     }