On Wed, Feb 26, 2014 at 11:37 AM, Yann Ylavic <[email protected]> wrote: > Helo, > > when handling a RewriteRule with the [P] flag, mod_rewrite always call > fully_qualify_uri() on the rewritten URL before returning. > > This does nothing if the URL is already absolute, otherwise this will result > in : > > ap_http_scheme(r)://ap_get_server_name_for_url(r):ap_get_server_port(r)/<non-full-URL> > > mod_proxy will then (likely) issue a request to itself (since the URL above > is the one requested by the client, modulo path change, to reach httpd), > leading to an infinite (network, resources exhausting) loop. > > Wouldn't it be safer to return an error instead if the final URL is not > absolute? >
I agree, it does seem silly, especially in that it happens explicitly in a proxy-only block of code. But it would not necessarily loop, presumably something has changed that might not be matchable the 2nd time through.
