From: Eric Covener <covener@apache.org>
Date: Fri, 17 Jul 2026 11:34:20 +0000 (+0000)
Subject: add caution about client influence and delims
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=ef39df872582e4607f83eb0554f4a35b29346f8c;p=thirdparty%2Fapache%2Fhttpd.git

add caution about client influence and delims


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1936255 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/docs/manual/rewrite/flags.xml b/docs/manual/rewrite/flags.xml
index 1b9dce0d7b..aa69daf326 100644
--- a/docs/manual/rewrite/flags.xml
+++ b/docs/manual/rewrite/flags.xml
@@ -350,6 +350,13 @@ follows:</p>
 [CO=NAME:VALUE:DOMAIN:lifetime:path:secure:httponly:samesite]
 </example>
 
+<note type="warning">
+<title>Security Warning</title>
+<p>Exercise care when constructing the argument from backreferences or other
+variable expansion.  If any part of the argument is derived from user input,
+a malicious request may include delimeters or other unexpected values.</p>
+</note>
+
 <p>If a literal ':' character is needed in any of the cookie fields, an 
 alternate syntax is available.  To opt-in to the alternate syntax, the cookie 
 "Name" should be preceded with a ';' character, and field separators should be