Re: svn commit: r1908827 - in /httpd/httpd/trunk/modules: http2/mod_proxy_http2.c proxy/mod_proxy_ajp.c proxy/mod_proxy_balancer.c proxy/mod_proxy_fcgi.c proxy/mod_proxy_http.c proxy/mod_proxy_uwsgi.c proxy/mod_proxy_wstunnel.c

[Yann Ylavic]

On Fri, Mar 31, 2023 at 8:28 AM Ruediger Pluem <rpl...@apache.org> wrote:
>
> On 3/31/23 2:11 AM, yla...@apache.org wrote:
> > Author: ylavic
> > Date: Fri Mar 31 00:11:02 2023
> > New Revision: 1908827
> >
> > URL: http://svn.apache.org/viewvc?rev=1908827&view=rev
> > Log:
> > mod_proxy: Check for space/ctrls in nocanon path/urls before forwarding.
>
> Can this really happen? Wouldn't this path be rejected during request line 
> parsing?

This is on the suspenders plus belt side (check what we send), but I
suppose that an unfortunate NE[,P] rule could cause it.

Regards;
Yann.