svn commit: r1934244 - httpd/httpd/trunk/docs/manual/rewrite

[rb...@apache.org]

Author: rbowen
Date: Fri May 15 19:19:49 2026
New Revision: 1934244

Log:
flags.xml: Add example and security warning for UnsafeAllow3F

Show the common real-world trigger: a PHP front controller with a
query string in the substitution (index.php?route=\$1) that breaks
when a request contains %3F. Add a warning note linking to
CVE-2024-38474, advising users to prefer URL restructuring over
enabling the flag where possible.

Modified:
   httpd/httpd/trunk/docs/manual/rewrite/flags.xml

Modified: httpd/httpd/trunk/docs/manual/rewrite/flags.xml
==============================================================================
--- httpd/httpd/trunk/docs/manual/rewrite/flags.xml	Fri May 15 19:05:15 2026	(r1934243)
+++ httpd/httpd/trunk/docs/manual/rewrite/flags.xml	Fri May 15 19:19:49 2026	(r1934244)
@@ -1003,6 +1003,26 @@ The <code>L</code> flag can be useful in
     rewritten result has a '?' in the substitution.  This protects from a malicious
     URL taking advantage of a capture and re-substitution of the encoded
     question mark.</p>
+
+<highlight language="config">
+# A PHP front controller that routes all requests via a query parameter.
+# Without UnsafeAllow3F, a request like /page%3Fname=test would return
+# 403 Forbidden because the rewritten substitution contains '?' while
+# the original request contains an encoded '%3F'.
+RewriteCond "%{REQUEST_FILENAME}" !-f
+RewriteCond "%{REQUEST_FILENAME}" !-d
+RewriteRule "(.+)" "index.php?route=$1" [L,QSA,UnsafeAllow3F]
+</highlight>
+
+<note type="warning">
+This flag exists because of <a
+href="https://www.cve.org/CVERecord?id=CVE-2024-38474">CVE-2024-38474</a>.
+Use it only on rules where you are certain that user-supplied <code>%3F</code>
+in the request cannot be exploited to manipulate the query string of the
+substitution target. Prefer restructuring URLs to avoid encoded question
+marks where possible.
+</note>
+
 </section>
 <section id="flag_unsafe_prefix_stat"><title>UnsafePrefixStat</title>
     <p> Setting this flag is required in server-scoped substitutions