Mailing List Archive

> Am 05.03.2023 um 02:30 schrieb Eric Covener <covener@gmail.com>:
>
>> Modified: httpd/httpd/trunk/modules/http2/mod_proxy_http2.c
>> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/modules/http2/mod_proxy_http2.c?rev=1907972&r1=1907971&r2=1907972&view=diff
>> ==============================================================================
>> --- httpd/httpd/trunk/modules/http2/mod_proxy_http2.c (original)
>> +++ httpd/httpd/trunk/modules/http2/mod_proxy_http2.c Thu Mar 2 14:30:20 2023
>> @@ -154,6 +154,10 @@ static int proxy_http2_canon(request_rec
>> if (apr_table_get(r->notes, "proxy-nocanon")) {
>> path = url; /* this is the raw path */
>> }
>> + else if (apr_table_get(r->notes, "proxy-noencode")) {
>> + path = url; /* this is the encoded path already */
>> + search = r->args;
>> + }
>> else {
>> path = ap_proxy_canonenc(r->pool, url, (int)strlen(url),
>> enc_path, 0, r->proxyreq);
>>
>
> I think we might need to get this changed in
> https://github.com/icing/mod_h2 or risk getting it backed out by
> accident in a big diff later

Thanks for the heads up. Just merged the recent changes in modules/http2 to my github.

Kind Regards,
Stefan

On 3/2/23 3:30 PM, ylavic@apache.org wrote:
> Author: ylavic
> Date: Thu Mar 2 14:30:20 2023
> New Revision: 1907972
>
> URL: http://svn.apache.org/viewvc?rev=1907972&view=rev
> Log:
> mod_proxy: Don't decode r->uri and reencode in r->filename for mapping=encoded.
>
> Decoding was not done for mapping=servlet only (a subset), but overlooked for
> mapping=encoded. To avoid double-encoding in the canon_handler hook, use a new
> "proxy-noencode" (similarly to "proxy-nocanon") entry in r->notes.
>
> * proxy/mod_proxy.c(ap_proxy_trans_match):
> Set "proxy-noencode" in r->notes for PROXYPASS_MAP_ENCODED, and return DONE
> to avoid decoding in ap_process_request_internal().
>
> * proxy/mod_proxy_http.c, proxy/mod_proxy_ajp.c, proxy/mod_proxy_wstunnel.c,
> proxy/mod_proxy_fcgi.c, proxy/mod_proxy_ajp.c, http2/mod_proxy_http2.c:
> Don't process the url through ap_proxy_canonenc() in canon_handler if
> "proxy-noencode" is set.
>

This solves the issue for mapping=encoded set with ProxyPass. It does not solve a similar problem
with RewriteRules using the P flag when AllowEncodedSlashes is set to NoDecode. In this case
potential %2F's in the URL will get encoded to %252F. I would like ap_proxy_canonenc to leave
%2F untouched (not encoding the '%') in case AllowEncodedSlashes is set to NoDecode. Opinions?


Regards

Rüdiger

On Wed, Mar 8, 2023 at 1:24 PM Ruediger Pluem <rpluem@apache.org> wrote:
>
> On 3/2/23 3:30 PM, ylavic@apache.org wrote:
> > Author: ylavic
> > Date: Thu Mar 2 14:30:20 2023
> > New Revision: 1907972
> >
> > URL: http://svn.apache.org/viewvc?rev=1907972&view=rev
> > Log:
> > mod_proxy: Don't decode r->uri and reencode in r->filename for mapping=encoded.
> >
> > Decoding was not done for mapping=servlet only (a subset), but overlooked for
> > mapping=encoded. To avoid double-encoding in the canon_handler hook, use a new
> > "proxy-noencode" (similarly to "proxy-nocanon") entry in r->notes.
> >
> > * proxy/mod_proxy.c(ap_proxy_trans_match):
> > Set "proxy-noencode" in r->notes for PROXYPASS_MAP_ENCODED, and return DONE
> > to avoid decoding in ap_process_request_internal().
> >
> > * proxy/mod_proxy_http.c, proxy/mod_proxy_ajp.c, proxy/mod_proxy_wstunnel.c,
> > proxy/mod_proxy_fcgi.c, proxy/mod_proxy_ajp.c, http2/mod_proxy_http2.c:
> > Don't process the url through ap_proxy_canonenc() in canon_handler if
> > "proxy-noencode" is set.
> >
>
> This solves the issue for mapping=encoded set with ProxyPass. It does not solve a similar problem
> with RewriteRules using the P flag when AllowEncodedSlashes is set to NoDecode. In this case
> potential %2F's in the URL will get encoded to %252F. I would like ap_proxy_canonenc to leave
> %2F untouched (not encoding the '%') in case AllowEncodedSlashes is set to NoDecode. Opinions?

Makes sense to me with NoDecode, +1


Regards;
Yann.