svn commit: r1936256 - in httpd/httpd/branches/2.4.x: . docs/manual/rewrite

[co...@apache.org]

Author: covener
Date: Fri Jul 17 11:34:53 2026
New Revision: 1936256

Log:
Merge r1936255 from trunk:

add caution about client influence and delims

Modified:
   httpd/httpd/branches/2.4.x/   (props changed)
   httpd/httpd/branches/2.4.x/docs/manual/rewrite/flags.xml

Modified: httpd/httpd/branches/2.4.x/docs/manual/rewrite/flags.xml
==============================================================================
--- httpd/httpd/branches/2.4.x/docs/manual/rewrite/flags.xml	Fri Jul 17 11:34:20 2026	(r1936255)
+++ httpd/httpd/branches/2.4.x/docs/manual/rewrite/flags.xml	Fri Jul 17 11:34:53 2026	(r1936256)
@@ -350,6 +350,13 @@ follows:</p>
 [CO=NAME:VALUE:DOMAIN:lifetime:path:secure:httponly:samesite]
 </example>
 
+<note type="warning">
+<title>Security Warning</title>
+<p>Exercise care when constructing the argument from backreferences or other
+variable expansion.  If any part of the argument is derived from user input,
+a malicious request may include delimeters or other unexpected values.</p>
+</note>
+
 <p>If a literal ':' character is needed in any of the cookie fields, an 
 alternate syntax is available.  To opt-in to the alternate syntax, the cookie 
 "Name" should be preceded with a ';' character, and field separators should be