Why does RewriteRule [P] fully qualifies the URI?

[Yann Ylavic <yl...@gmail.com>]

Helo,

when handling a RewriteRule with the [P] flag, mod_rewrite always call
fully_qualify_uri() on the rewritten URL before returning.

This does nothing if the URL is already absolute, otherwise this will
result in :

ap_http_scheme(r)://ap_get_server_name_for_url(r):ap_get_server_port(r)/<non-full-URL>

mod_proxy will then (likely) issue a request to itself (since the URL above
is the one requested by the client, modulo path change, to reach httpd),
leading to an infinite (network, resources exhausting) loop.

Wouldn't it be safer to return an error instead if the final URL is not
absolute?

Regards,
Yann.

Re: Why does RewriteRule [P] fully qualifies the URI?

[Eric Covener <co...@gmail.com>]

On Wed, Feb 26, 2014 at 12:06 PM, Yann Ylavic <yl...@gmail.com> wrote:
> On Wed, Feb 26, 2014 at 5:54 PM, Eric Covener <co...@gmail.com> wrote:
>>
>> On Wed, Feb 26, 2014 at 11:37 AM, Yann Ylavic <yl...@gmail.com>
>> wrote:
>> > Helo,
>> >
>> > when handling a RewriteRule with the [P] flag, mod_rewrite always call
>> > fully_qualify_uri() on the rewritten URL before returning.
>> >
>> > This does nothing if the URL is already absolute, otherwise this will
>> > result
>> > in :
>> >
>> >
>> > ap_http_scheme(r)://ap_get_server_name_for_url(r):ap_get_server_port(r)/<non-full-URL>
>> >
>> > mod_proxy will then (likely) issue a request to itself (since the URL
>> > above
>> > is the one requested by the client, modulo path change, to reach httpd),
>> > leading to an infinite (network, resources exhausting) loop.
>> >
>> > Wouldn't it be safer to return an error instead if the final URL is not
>> > absolute?
>> >
>>
>> I agree, it does seem silly, especially in that it happens explicitly
>> in a proxy-only block of code.
>>
>> But it would not necessarily loop, presumably something has changed
>> that might not be matchable the 2nd time through.
>
>
> Yes of course, that's what I meant with "modulo path change", I should have
> say "possibly leading to infinite loop"...
>
> Do you think it can be removed (safely)?
> I don't see how an admin can rely on that, but I may be missing something.
> That would quite simplify the patch about UDS with mod_rewrite (at least).

I guess it does permit you to change a working [R] rule to a [P] rule
without changing the substitution.

I think it would break people. On the bright side, we are not yet out
of letters to use for Flags!




-- 
Eric Covener
covener@gmail.com

Re: Why does RewriteRule [P] fully qualifies the URI?

[Yann Ylavic <yl...@gmail.com>]

On Wed, Feb 26, 2014 at 5:54 PM, Eric Covener <co...@gmail.com> wrote:

> On Wed, Feb 26, 2014 at 11:37 AM, Yann Ylavic <yl...@gmail.com>
> wrote:
> > Helo,
> >
> > when handling a RewriteRule with the [P] flag, mod_rewrite always call
> > fully_qualify_uri() on the rewritten URL before returning.
> >
> > This does nothing if the URL is already absolute, otherwise this will
> result
> > in :
> >
> >
> ap_http_scheme(r)://ap_get_server_name_for_url(r):ap_get_server_port(r)/<non-full-URL>
> >
> > mod_proxy will then (likely) issue a request to itself (since the URL
> above
> > is the one requested by the client, modulo path change, to reach httpd),
> > leading to an infinite (network, resources exhausting) loop.
> >
> > Wouldn't it be safer to return an error instead if the final URL is not
> > absolute?
> >
>
> I agree, it does seem silly, especially in that it happens explicitly
> in a proxy-only block of code.
>
> But it would not necessarily loop, presumably something has changed
> that might not be matchable the 2nd time through.
>

Yes of course, that's what I meant with "modulo path change", I should
have say "possibly leading to infinite loop"...

Do you think it can be removed (safely)?
I don't see how an admin can rely on that, but I may be missing something.
That would quite simplify the patch about UDS with mod_rewrite (at least).

Re: Why does RewriteRule [P] fully qualifies the URI?

[Eric Covener <co...@gmail.com>]

On Wed, Feb 26, 2014 at 11:37 AM, Yann Ylavic <yl...@gmail.com> wrote:
> Helo,
>
> when handling a RewriteRule with the [P] flag, mod_rewrite always call
> fully_qualify_uri() on the rewritten URL before returning.
>
> This does nothing if the URL is already absolute, otherwise this will result
> in :
>
> ap_http_scheme(r)://ap_get_server_name_for_url(r):ap_get_server_port(r)/<non-full-URL>
>
> mod_proxy will then (likely) issue a request to itself (since the URL above
> is the one requested by the client, modulo path change, to reach httpd),
> leading to an infinite (network, resources exhausting) loop.
>
> Wouldn't it be safer to return an error instead if the final URL is not
> absolute?
>

I agree, it does seem silly, especially in that it happens explicitly
in a proxy-only block of code.

But it would not necessarily loop, presumably something has changed
that might not be matchable the 2nd time through.