From: Eric Covener <covener@apache.org>
Date: Fri, 17 Jul 2026 11:34:53 +0000 (+0000)
Subject: Merge r1936255 from trunk:
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=fc388ec81da6775e8034a6aaffa24e0f0937ab37;p=thirdparty%2Fapache%2Fhttpd.git

Merge r1936255 from trunk:

add caution about client influence and delims



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1936256 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/docs/manual/rewrite/flags.xml b/docs/manual/rewrite/flags.xml
index bcc7f26871..e9a23fbebe 100644
--- a/docs/manual/rewrite/flags.xml
+++ b/docs/manual/rewrite/flags.xml
@@ -350,6 +350,13 @@ follows:</p>
 [CO=NAME:VALUE:DOMAIN:lifetime:path:secure:httponly:samesite]
 </example>
 
+<note type="warning">
+<title>Security Warning</title>
+<p>Exercise care when constructing the argument from backreferences or other
+variable expansion.  If any part of the argument is derived from user input,
+a malicious request may include delimeters or other unexpected values.</p>
+</note>
+
 <p>If a literal ':' character is needed in any of the cookie fields, an 
 alternate syntax is available.  To opt-in to the alternate syntax, the cookie 
 "Name" should be preceded with a ';' character, and field separators should be