You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by yl...@apache.org on 2021/09/29 12:35:25 UTC
svn commit: r1893724 - in /httpd/httpd/trunk:
changes-entries/normalize_unreserved.txt server/util.c
Author: ylavic
Date: Wed Sep 29 12:35:25 2021
New Revision: 1893724
URL: http://svn.apache.org/viewvc?rev=1893724&view=rev
Log:
core: AP_NORMALIZE_DECODE_UNRESERVED should normalize the second encoded dot.
Otherwise ap_normalize_path() can leave some "%2e" encoded.
Added:
httpd/httpd/trunk/changes-entries/normalize_unreserved.txt
Modified:
httpd/httpd/trunk/server/util.c
Added: httpd/httpd/trunk/changes-entries/normalize_unreserved.txt
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/changes-entries/normalize_unreserved.txt?rev=1893724&view=auto
==============================================================================
--- httpd/httpd/trunk/changes-entries/normalize_unreserved.txt (added)
+++ httpd/httpd/trunk/changes-entries/normalize_unreserved.txt Wed Sep 29 12:35:25 2021
@@ -0,0 +1,2 @@
+ *) core: AP_NORMALIZE_DECODE_UNRESERVED should normalize the second dot in
+ the uri-path when it's preceded by a dot. [Yann Ylavic]
\ No newline at end of file
Modified: httpd/httpd/trunk/server/util.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/server/util.c?rev=1893724&r1=1893723&r2=1893724&view=diff
==============================================================================
--- httpd/httpd/trunk/server/util.c (original)
+++ httpd/httpd/trunk/server/util.c Wed Sep 29 12:35:25 2021
@@ -503,7 +503,8 @@ static char x2c(const char *what);
AP_DECLARE(int) ap_normalize_path(char *path, unsigned int flags)
{
int ret = 1;
- apr_size_t l = 1, w = 1;
+ apr_size_t l = 1, w = 1, n;
+ int decode_unreserved = (flags & AP_NORMALIZE_DECODE_UNRESERVED) != 0;
if (!IS_SLASH(path[0])) {
/* Besides "OPTIONS *", a request-target should start with '/'
@@ -530,7 +531,7 @@ AP_DECLARE(int) ap_normalize_path(char *
* be decoded to their corresponding unreserved characters by
* URI normalizers.
*/
- if ((flags & AP_NORMALIZE_DECODE_UNRESERVED)
+ if (decode_unreserved
&& path[l] == '%' && apr_isxdigit(path[l + 1])
&& apr_isxdigit(path[l + 2])) {
const char c = x2c(&path[l + 1]);
@@ -568,8 +569,17 @@ AP_DECLARE(int) ap_normalize_path(char *
continue;
}
- /* Remove /xx/../ segments */
- if (path[l + 1] == '.' && IS_SLASH_OR_NUL(path[l + 2])) {
+ /* Remove /xx/../ segments (or /xx/.%2e/ when
+ * AP_NORMALIZE_DECODE_UNRESERVED is set since we
+ * decoded only the first dot above).
+ */
+ n = l + 1;
+ if ((path[n] == '.' || (decode_unreserved
+ && path[n] == '%'
+ && path[++n] == '2'
+ && (path[++n] == 'e'
+ || path[n] == 'E')))
+ && IS_SLASH_OR_NUL(path[n + 1])) {
/* Wind w back to remove the previous segment */
if (w > 1) {
do {
@@ -586,7 +596,7 @@ AP_DECLARE(int) ap_normalize_path(char *
}
/* Move l forward to the next segment */
- l += 2;
+ l = n + 1;
if (path[l]) {
l++;
}