If a request contains both a T-E and C-L, remove the C-L, stopping some HTTP Request...

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@191005 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index 672b804caaa09a8b5d10af8703d5b57bd392a7a1..519a79f6398e506a5d899d0ba1df375b7ae7e8ea 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,11 @@ Changes with Apache 2.1.5
 
   [Remove entries to the current 2.0 section below, when backported]
 
+  *) SECURITY: 
+     core: If a request contains both Transfer-Encoding and a Content-Length,
+     remove the Content-Length, stopping some HTTP Request smuggling attacks.
+     [Paul Querna]
+
   *) mod_ssl: Setting the Protocol to 'https' can replace the use of the 
      'SSLEngine on' command. [Paul Querna]
 

diff --git a/server/protocol.c b/server/protocol.c
index 8fa995d59a02a77b1454b37fdac5251a9b0c0a2c..7b0d15ff0f49a987b3b428fd11a63c306122df7f 100644 (file)
--- a/server/protocol.c
+++ b/server/protocol.c
@@ -898,6 +898,18 @@ request_rec *ap_read_request(conn_rec *conn)
             apr_brigade_destroy(tmp_bb);
             return r;
         }
+
+        if (apr_table_get(r->headers_in, "Content-Length")) {
+            const char* te = apr_table_get(r->headers_in, "Transfer-Encoding");
+            /*
+             * If the client sent any Transfer-Encoding besides "identity",
+             * the RFC says we MUST ignore the C-L header.  We kill it here
+             * to prevent more work later on in modules like mod_proxy.
+             */
+            if (te && !strcasecmp("identity", te)) {
+                apr_table_unset(r->headers_in, "Content-Length");
+            }
+        }
     }
     else {
         if (r->header_only) {