eveniota commented on PR #13708:
URL: https://github.com/apache/trafficserver/pull/13708#issuecomment-6186910784
@cmcfarlen Thanks for the review. In this update:
1. Path parameters and double-encoding:
- Updated normalizePath() to inspect the segment substring before the
first semicolon against "." and "..".
- Reject percent-escapes that decode to "%" (0x25), blocking
double-encoded traversal like "%252e%252e".
- Reject raw control characters (< 0x20 and 0x7F).
- This successfully closes bypasses such as "..;", ".;", "%2e%2e%3b",
and "%252e%252e".
2. Unit tests:
- Added test cases in test_access_control.cc for all four bypass
vectors:
- /reports/..;/hr/payroll
- /reports/.;/x
- /reports/%2e%2e%3b/hr
- /reports/%252e%252e/hr
- All 18 test cases (131 assertions) pass.
3. Documentation:
- Updated access_control.en.rst to explicitly state which request paths
are rejected outright (dot segments,
matrix parameters, backslashes, encoded slashes, %25, and control
characters).
- Clarified that --invalid-scope-status-code applies when
--reject-invalid-token-requests=true is enabled;
otherwise, the request is forwarded without the extracted subject header.
4. AuTest:
- Isolated the replay transactions into separate sessions in
access_control.replay.yaml to prevent the 403
response on transaction 4 from closing the connection before transaction 5
runs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
