From: Stefan Fritsch Date: Tue, 28 Dec 2010 14:33:45 +0000 (+0000) Subject: update transforms X-Git-Tag: 2.3.11~331 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=e5ab01823ef2d4777ed62d3a32514fecd393a188;p=apache update transforms git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1053357 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/docs/manual/env.html.en b/docs/manual/env.html.en index 5e575e5cc2..8e8890ead1 100644 --- a/docs/manual/env.html.en +++ b/docs/manual/env.html.en @@ -126,6 +126,13 @@ not be a number. Characters which do not match this restriction will be replaced by an underscore when passed to CGI scripts and SSI pages. + +
  • A special case are HTTP headers which are passed to CGI + scripts and the like via environment variables (see below). + They are converted to uppercase and only dashes are replaced with + underscores; if the header contains any other (invalid) character, + the whole header is silently dropped. See + below for a workaround.
  • The SetEnv directive runs late during request processing meaning that directives such as @@ -382,6 +389,33 @@

    Examples

    +

    Passing broken headers to CGI scripts

    + + +

    Starting with version 2.4, Apache is more strict about how HTTP + headers are converted to environment variables in mod_cgi + and other modules: Previously any invalid characters + in header names were simply translated to underscores. This allowed + for some potential cross-site-scripting attacks via header injection + (see + Unusual Web Bugs, slide 19/20).

    + +

    If you have to support a client which sends broken headers and + which can't be fixed, a simple workaround involving mod_setenvif + and mod_header allows you to still accept + these headers:

    + +
    +# 
+# The following works around a client sending a broken Accept_Encoding
+# header.
+#
+SetEnvIfNoCase ^Accept.Encoding$ ^(.*)$ fix_accept_encoding=$1
+RequestHeader set Accept-Encoding %{fix_accept_encoding}e env=fix_accept_encoding
+
    + + +

    Changing protocol behavior with misbehaving clients

    diff --git a/docs/manual/env.xml.ja b/docs/manual/env.xml.ja index 52cea70a88..26c631f247 100644 --- a/docs/manual/env.xml.ja +++ b/docs/manual/env.xml.ja @@ -1,7 +1,7 @@ - + + + + + + + + - + + diff --git a/docs/manual/vhosts/details.xml.ko b/docs/manual/vhosts/details.xml.ko index 52905b029f..2c142deba8 100644 --- a/docs/manual/vhosts/details.xml.ko +++ b/docs/manual/vhosts/details.xml.ko @@ -1,7 +1,7 @@ - + + + diff --git a/docs/manual/vhosts/examples.xml.ja b/docs/manual/vhosts/examples.xml.ja index 641444f75a..df0a41a381 100644 --- a/docs/manual/vhosts/examples.xml.ja +++ b/docs/manual/vhosts/examples.xml.ja @@ -1,7 +1,7 @@ - + + + + + diff --git a/docs/manual/vhosts/index.xml.ja b/docs/manual/vhosts/index.xml.ja index 85673843e8..4c1367c951 100644 --- a/docs/manual/vhosts/index.xml.ja +++ b/docs/manual/vhosts/index.xml.ja @@ -1,7 +1,7 @@ - + + + + diff --git a/docs/manual/vhosts/ip-based.xml.ja b/docs/manual/vhosts/ip-based.xml.ja index 9d8df1851f..ffd864d104 100644 --- a/docs/manual/vhosts/ip-based.xml.ja +++ b/docs/manual/vhosts/ip-based.xml.ja @@ -1,7 +1,7 @@ - + + + + + + + diff --git a/docs/manual/vhosts/name-based.xml.ja b/docs/manual/vhosts/name-based.xml.ja index cb44129edc..dae592cbc7 100644 --- a/docs/manual/vhosts/name-based.xml.ja +++ b/docs/manual/vhosts/name-based.xml.ja @@ -1,7 +1,7 @@ - + + +