[Bug 57999] New: ap_getparents() may remove start slash of uri

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=57999

            Bug ID: 57999
           Summary: ap_getparents() may remove start slash of uri
           Product: Apache httpd-2
           Version: 2.4.12
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P2
         Component: Core
          Assignee: bugs@httpd.apache.org
          Reporter: httpmonitor@sina.com

When I send a request like this:
GET /test/../../etc/passwd HTTP/1.0

Apache will report an error:
AH00126: Invalid URI in request GET /test/../../etc/passwd HTTP/1.0

Reason:
In file server/request.c line 154
ap_getparents() change r->uri from /test/../../etc/passwd to etc/passwd
and etc/passwd is an invalid uri.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org