Summary: | REQUEST_URI includes query string, contrary to documentation | ||
---|---|---|---|
Product: | Apache httpd-2 | Reporter: | felipe |
Component: | Core | Assignee: | Apache HTTPD Bugs Mailing List <bugs> |
Status: | NEW --- | ||
Severity: | normal | ||
Priority: | P2 | ||
Version: | 2.4.34 | ||
Target Milestone: | --- | ||
Hardware: | PC | ||
OS: | Linux |
Description
felipe
2018-08-30 15:48:43 UTC
It looks like REQUEST_URI the internal environment variable (which gets copied to the environment for a CGI or is accessible as 'reqenv' in expressions) is the actual URI, whereas REQUEST_URI is the path component only. e.g. these give different results: # not even in the env w/o CGI Header always set "X-URI" "expr=%{reqenv:REQUEST_URI}" # path only Header always set "X-URI2" "expr=%{REQUEST_URI}" I think it's worth a caveat a few places where directives can read "special" variables and similar "environment variables" (ap_expr, rewritecond, setenvif) Note that the CGI RFC doesn't define REQUEST_URI. This is what it does define, Script-URI; https://tools.ietf.org/html/rfc3875#section-3.3 This apparently includes path info and query string. The query string is also included when REQUEST_URI is used in a RewriteRule substitution parameter. The mod_rewrite documentation states that "The server-variables are the same as for the TestString of a RewriteCond directive" and the definitions of those variables under RewriteCond include the assertion that REQUEST_URI does not include QUERY_STRING. This seems unambiguously incorrect. We would like to know whether the documentation or the behavior of REQUEST_URI inside RewriteRule is going to be changed in future versions. |