diff options
| author | Joe Orton <jorton@apache.org> | 2011-10-05 16:24:44 +0200 |
|---|---|---|
| committer | Joe Orton <jorton@apache.org> | 2011-10-05 16:24:44 +0200 |
| commit | 3371c662632f499a390317ec46f35abd7bb1f066 (patch) | |
| tree | f1aae69a2731d4264493a53b2f2acda3c9d3313a /server/protocol.c | |
| parent | Rebuild html. (diff) | |
| download | apache2-3371c662632f499a390317ec46f35abd7bb1f066.tar.xz apache2-3371c662632f499a390317ec46f35abd7bb1f066.zip | |
SECURITY (CVE-2011-3368): Prevent unintended pattern expansion in some
reverse proxy configurations by strictly validating the request-URI:
* server/protocol.c (read_request_line): Send a 400 response if the
request-URI does not match the grammar from RFC 2616. This ensures
the input string for RewriteRule et al really is an absolute path.
Reviewed by: rpluem, wrowe, covener, fielding
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1179239 13f79535-47bb-0310-9956-ffa450edef68
Diffstat (limited to 'server/protocol.c')
| -rw-r--r-- | server/protocol.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/server/protocol.c b/server/protocol.c index 896a8fd603..995ee50019 100644 --- a/server/protocol.c +++ b/server/protocol.c @@ -655,6 +655,25 @@ static int read_request_line(request_rec *r, apr_bucket_brigade *bb) ap_parse_uri(r, uri); + /* RFC 2616: + * Request-URI = "*" | absoluteURI | abs_path | authority + * + * authority is a special case for CONNECT. If the request is not + * using CONNECT, and the parsed URI does not have scheme, and + * it does not begin with '/', and it is not '*', then, fail + * and give a 400 response. */ + if (r->method_number != M_CONNECT + && !r->parsed_uri.scheme + && uri[0] != '/' + && !(uri[0] == '*' && uri[1] == '\0')) { + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, + "invalid request-URI %s", uri); + r->args = NULL; + r->hostname = NULL; + r->status = HTTP_BAD_REQUEST; + r->uri = apr_pstrdup(r->pool, uri); + } + if (ll[0]) { r->assbackwards = 0; pro = ll; |