Attachment 9857 Details for Bug 21779 – Patch to fix this bug (rejects requests with uri fragments)

[patch] Patch to fix this bug (rejects requests with uri fragments)

patch_PR21779 (text/plain), 1.21 KB, created by Amit Athavale on 2004-01-08 12:44:22 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Amit Athavale

Created: 2004-01-08 12:44:22 UTC

Size: 1.21 KB

patch

obsolete

>Index: mod_dav.c
>===================================================================
>RCS file: /home/cvspublic/httpd-2.0/modules/dav/main/mod_dav.c,v
>retrieving revision 1.101
>diff -u -r1.101 mod_dav.c
>--- mod_dav.c	25 Nov 2003 14:17:55 -0000	1.101
>+++ mod_dav.c	1 Jan 2004 09:22:41 -0000
>@@ -4563,6 +4563,20 @@
>     if (strcmp(r->handler, DAV_HANDLER_NAME) != 0)
>         return DECLINED;
> 
>+    /* At this point, we can safely assume that mod_dav is going to handle
>+     * this request. So we can check existence of un-escaped # by checking
>+     * URI fragment and reject requests with un-escaped # to avoid nasty results
>+     */
>+    if(r->parsed_uri.fragment != NULL){
>+        ap_log_error(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, NULL,
>+                   "Faulty client : Un-escaped '#' detected in request URI");
>+        ap_log_error(APLOG_MARK, APLOG_ERR|APLOG_NOERRNO, 0, NULL,
>+                   "Denying the request to avoid nasty results");
>+        return dav_error_response(r, HTTP_FORBIDDEN, "Faulty client : "
>+                                  "Un-escaped hash character detected in"
>+                                  "request URI");
>+    } 
>+
>     /* ### do we need to do anything with r->proxyreq ?? */
> 
>     /*

Actions: View | Diff

Attachments on bug 21779: 9857