Re: hardening mod_write and mod_proxy like mod_jk with servletnormalize

2020-06-11 Thread jean-frederic clere
On 10/06/2020 11:53, Ruediger Pluem wrote: On 6/9/20 12:05 PM, jean-frederic clere wrote: Hi, Basically it adds servletnormalizecheck to mod_proxy for ProxyPass/ProxyPassMatch and mod_rewrite when using P I have tested the following uses: #ProxyPass  /docs ajp://localhost:8009/docs

Re: hardening mod_write and mod_proxy like mod_jk with servletnormalize

2020-06-11 Thread Yann Ylavic
On Thu, Jun 11, 2020 at 8:52 AM jean-frederic clere wrote: > > Should I commit my first proposal (it is easily backportable to 2.4.x) > and later work on the next one? How about something like the attached patch? It's a new single ap_normalize_path() helper with options (like

Re: hardening mod_write and mod_proxy like mod_jk with servletnormalize

2020-06-11 Thread Yann Ylavic
On Thu, Jun 11, 2020 at 9:50 AM Yann Ylavic wrote: > > We need a way to forward non %-decoded URLs upto mod_proxy (reverse) > if we want to normalize a second time.. IOW, this block in ap_process_request_internal(): /* Ignore URL unescaping for proxy requests */ if (!r->proxyreq &&

Re: hardening mod_write and mod_proxy like mod_jk with servletnormalize

2020-06-11 Thread Yann Ylavic
On Thu, Jun 11, 2020 at 9:57 AM Yann Ylavic wrote: > > On Thu, Jun 11, 2020 at 9:50 AM Yann Ylavic wrote: > > > > We need a way to forward non %-decoded URLs upto mod_proxy (reverse) > > if we want to normalize a second time.. > > IOW, this block in ap_process_request_internal(): [snip] > Should

Re: hardening mod_write and mod_proxy like mod_jk with servletnormalize

2020-06-11 Thread Yann Ylavic
On Thu, Jun 11, 2020 at 1:22 PM Yann Ylavic wrote: > > On Thu, Jun 11, 2020 at 9:57 AM Yann Ylavic wrote: > > > > On Thu, Jun 11, 2020 at 9:50 AM Yann Ylavic wrote: > > > > > > We need a way to forward non %-decoded URLs upto mod_proxy (reverse) > > > if we want to normalize a second time.. > >

Re: hardening mod_write and mod_proxy like mod_jk with servletnormalize

2020-06-11 Thread Mark Thomas
On 11/06/2020 07:51, jean-frederic clere wrote: > On 10/06/2020 11:53, Ruediger Pluem wrote: >> >> >> On 6/9/20 12:05 PM, jean-frederic clere wrote: >>> Hi, >>> >>> Basically it adds servletnormalizecheck to mod_proxy for >>> ProxyPass/ProxyPassMatch and mod_rewrite when using P >>> I have tested