Rewrite guide: merge duplicate SSRF warning in flags.xml [P] section

The [P] flag section had two nearly identical security warnings.
Merge into a single comprehensive warning that names the SSRF
vulnerability explicitly and includes the mitigation advice from
both.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1934111 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/docs/manual/rewrite/TODO.md b/docs/manual/rewrite/TODO.md
index 338e2dbce38648124437ea56a1f074fe1289b06d..8cc356cffdee105c7239ade29b44bb55b3ccaa52 100644 (file)
--- a/docs/manual/rewrite/TODO.md
+++ b/docs/manual/rewrite/TODO.md
@@ -5,7 +5,7 @@ result in one file "owning" the content and others cross-referencing it.
 
 ## HIGH Priority
 
-- [ ] **Per-directory path stripping** explained in full across three files
+- [x] **Per-directory path stripping** explained in full across three files
       (intro.xml, tech.xml, htaccess.xml) with near-identical comparison
       tables in tech.xml and htaccess.xml.
       → htaccess.xml owns it; others get a brief mention + xref.
@@ -24,7 +24,7 @@ result in one file "owning" the content and others cross-referencing it.
       description and complexity warnings from intro.xml.
       → Rewritten as concise intro + structured guide overview.
 
-- [ ] **Duplicate SSRF warning in flags.xml** — two nearly identical
+- [x] **Duplicate SSRF warning in flags.xml** — two nearly identical
       warning boxes within the [P] flag section.
       → Remove the literal duplicate.
 

diff --git a/docs/manual/rewrite/flags.xml b/docs/manual/rewrite/flags.xml
index 96f03a2f5f98c6ccd5092768856504a22bfd676f..f810d98dc03f4576a1cd3f9a9fcf4293c72bd33d 100644 (file)
--- a/docs/manual/rewrite/flags.xml
+++ b/docs/manual/rewrite/flags.xml
@@ -633,10 +633,14 @@ to map remote content into the namespace of the local server.</p>
 <note type="warning">
 <title>Security Warning</title>
 <p>Take care when constructing the target URL of the rule, considering
-the security impact from allowing the client influence over the set of
-URLs to which your server will act as a proxy.  Ensure that the scheme
-and hostname part of the URL is either fixed, or does not allow the
-client undue influence.</p>
+the security impact of allowing the client influence over the set of
+URLs to which your server will act as a proxy. If any part of the
+target URL is derived from user input (backreferences, query strings,
+etc.), an attacker may be able to cause your server to make requests
+to arbitrary internal or external hosts. This is known as a
+Server-Side Request Forgery (SSRF) vulnerability. Ensure that the
+scheme and hostname part of the URL is either fixed, or does not allow
+the client undue influence.</p>
 </note>
 
 <note type="warning">
@@ -657,16 +661,6 @@ will be used automatically.</p>
 <p>Note: <module>mod_proxy</module> must be enabled in order
 to use this flag.</p>
 
-<note type="warning"><title>Security warning</title>
-<p>Take care when constructing the target URL of the rule, considering
-the security impact of allowing the client influence over the set of
-URLs to which your server will act as a proxy. If any part of the
-target URL is derived from user input (backreferences, query strings,
-etc.), an attacker may be able to cause your server to make requests
-to arbitrary internal or external hosts. This is known as a
-Server-Side Request Forgery (SSRF) vulnerability.</p>
-</note>
-
 </section>
 
 <section id="flag_pt"><title>PT|passthrough</title>

diff --git a/docs/manual/rewrite/index.xml b/docs/manual/rewrite/index.xml
index c5c8fee244daf1c31954f9742ce7a7a294e33ba1..9b7dd148bdc391174f189ce9de692dacd3654ceb 100644 (file)
--- a/docs/manual/rewrite/index.xml
+++ b/docs/manual/rewrite/index.xml
@@ -85,7 +85,7 @@ and the order in which rules and conditions are evaluated.</dd>
 </dl>
 </summary>
 
-<seealso><a href="../mod/mod_rewrite.html">The Reference Manual</a></seealso>
+<seealso><a href="../mod/mod_rewrite.html">mod_rewrite Reference Documentation</a></seealso>
 <seealso><a href="../urlmapping.html">Mapping URLs to the Filesystem</a></seealso>
 <seealso><a href="https://cwiki.apache.org/confluence/display/httpd/Rewrite">mod_rewrite
 wiki</a></seealso>