From: Jim Jagielski Date: Tue, 20 Nov 2007 15:15:05 +0000 (+0000) Subject: latest docco xform updates X-Git-Tag: 2.3.0~1241 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=7c35c7a83638bad558f284fb76b392e53b48be4c;p=apache latest docco xform updates git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@596716 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/env.html.en b/docs/manual/env.html.en index 15c35b38b5..207c01816a 100644 --- a/docs/manual/env.html.en +++ b/docs/manual/env.html.en @@ -324,6 +324,19 @@ set for the redirection text, and these broken browsers will then correctly use that of the destination page.

+
+

Security note

+ +

Sending error pages without a specified character set may + allow a cross-site-scripting attack for existing browsers (MSIE) + which do not follow the HTTP/1.1 specification and attempt to + "guess" the character set from the content. Such browsers can + be easily fooled into using the UTF-7 character set, and UTF-7 + content from input data (such as the request-URI) will not be + escaped by the usual escaping mechanisms designed to prevent + cross-site-scripting attacks.

+
+

force-proxy-request-1.0, proxy-nokeepalive, proxy-sendchunked, proxy-sendcl

diff --git a/docs/manual/env.xml.ja b/docs/manual/env.xml.ja index c4357528af..7ef0630b03 100644 --- a/docs/manual/env.xml.ja +++ b/docs/manual/env.xml.ja @@ -1,7 +1,7 @@ - + +