[Bug 57832] Reduction of response splitting attacks consequences in mod_proxy

[bu...@apache.org]

https://bz.apache.org/bugzilla/show_bug.cgi?id=57832

--- Comment #4 from regilero <re...@makina-corpus.com> ---
I've tried to apply things from r1656259 and then your proposed patch. But
neither patch or myself are able to find where to apply theses changes in the
2.4 branch. I think you'll need to make a regular 2.4 patch version if you want
me to try it :-)

By the way I was thinking about the cleanup made on the connection level. There
are maybe some modules that would like to escape the 1 request/1 response mode
later and switch to an http tunnel mode. There is for example a websocket
mod_proxy module 2.5, or we could imagine that the mod_proxy_fcgi would evolve
to allow streamed inputs and/or outputs, unbuffered communications (on my last
tests using chunked inputs with this module to feed php-fpm with a POST was not
working). I do not know the internals as much as you do, but I wonder if
preventing any mod_proxy module to handle non-transactionnal communications is
a good move.

-- 
You are receiving this mail because:
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org