From: Joe Orton <jorton@apache.org>
Date: Thu, 15 Nov 2007 12:25:14 +0000 (+0000)
Subject: - add note on security impact of suppress-error-charset for broken
X-Git-Tag: 2.3.0~1259
X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=f80837574692305870c8bdcd2b25f056e5ab2c48;p=apache

- add note on security impact of suppress-error-charset for broken
browsers


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@595288 13f79535-47bb-0310-9956-ffa450edef68
---

diff --git a/docs/manual/env.xml b/docs/manual/env.xml
index a57a6562b8..a5950db802 100644
--- a/docs/manual/env.xml
+++ b/docs/manual/env.xml
@@ -364,6 +364,19 @@
     set for the redirection text, and these broken browsers will then correctly
     use that of the destination page.</p>
 
+    <note type="warning">
+      <title>Security note</title> 
+
+      <p>Sending error pages without a specified character set may
+      allow a cross-site-scripting attack for existing browsers (MSIE)
+      which do not follow the HTTP/1.1 specification and attempt to
+      "guess" the character set from the content.  Such browsers can
+      be easily fooled into using the UTF-7 character set, and UTF-7
+      content from input data (such as the request-URI) will not be
+      escaped by the usual escaping mechanisms designed to prevent
+      cross-site-scripting attacks.</p>
+    </note>
+
    </section>
 
    <section id="proxy"><title>force-proxy-request-1.0, proxy-nokeepalive, proxy-sendchunked, proxy-sendcl</title>