[tomcat] branch 8.5.x updated: Update security docs after addition of encodedSolidusHandling attribute

[ma...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

markt pushed a commit to branch 8.5.x
in repository https://gitbox.apache.org/repos/asf/tomcat.git


The following commit(s) were added to refs/heads/8.5.x by this push:
     new 9fa7de6  Update security docs after addition of encodedSolidusHandling attribute
9fa7de6 is described below

commit 9fa7de6be46c656472fefb84efe7557425753281
Author: Mark Thomas <ma...@apache.org>
AuthorDate: Wed Apr 1 11:56:06 2020 +0100

    Update security docs after addition of encodedSolidusHandling attribute
---
 webapps/docs/security-howto.xml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/webapps/docs/security-howto.xml b/webapps/docs/security-howto.xml
index d0c53ed..4a2de46 100644
--- a/webapps/docs/security-howto.xml
+++ b/webapps/docs/security-howto.xml
@@ -271,6 +271,11 @@
       reduces the chances of a bug in an application exposing data from one
       request to another.</p>
 
+      <p>The <strong>encodedSolidusHandling</strong> attribute allows
+      non-standard parsing of the request URI. Setting this attribute to a
+      non-default value when behind a reverse proxy may enable an attacker to
+      bypass any security constraints enforced by the proxy.</p>
+
       <p>The <strong>maxPostSize</strong> attribute controls the maximum size
       of a POST request that will be parsed for parameters. The parameters are
       cached for the duration of the request so this is limited to 2MB by


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org