Re: Fwd: [apache/httpd] don't forward invalid query strings (d78a166)

2023-05-18 Thread Eric Covener
> But r->args is encoded. Hence they need to decode anyway as there could be > other > encoded stuff in it or spaces that have not been taken decoded from the path. These are applications/configurations that were functional prior to the change though. I don't think the risk of differing spaces

Re: Fwd: [apache/httpd] don't forward invalid query strings (d78a166)

2023-05-18 Thread Ruediger Pluem
On 5/18/23 1:55 PM, Eric Covener wrote: > On Thu, May 18, 2023 at 6:40 AM Ruediger Pluem wrote: >> >> >> >> On 5/18/23 3:17 AM, Eric Covener wrote: >>> bump? Just was reminded by a thread on reddit (config unclear but >>> probably not non-cfgi proxy as it's a PHP app) >>> >>> If the proxy

Re: Fwd: [apache/httpd] don't forward invalid query strings (d78a166)

2023-05-18 Thread Eric Covener
On Thu, May 18, 2023 at 6:40 AM Ruediger Pluem wrote: > > > > On 5/18/23 3:17 AM, Eric Covener wrote: > > bump? Just was reminded by a thread on reddit (config unclear but > > probably not non-cfgi proxy as it's a PHP app) > > > > If the proxy modules would trap it, and the encoded spaces were >

Re: Fwd: [apache/httpd] don't forward invalid query strings (d78a166)

2023-05-18 Thread Ruediger Pluem
On 5/18/23 3:17 AM, Eric Covener wrote: > bump? Just was reminded by a thread on reddit (config unclear but > probably not non-cfgi proxy as it's a PHP app) > > If the proxy modules would trap it, and the encoded spaces were > happily accepted by other modules before the fix, can we let

Re: Fwd: [apache/httpd] don't forward invalid query strings (d78a166)

2023-05-17 Thread Eric Covener
bump? Just was reminded by a thread on reddit (config unclear but probably not non-cfgi proxy as it's a PHP app) If the proxy modules would trap it, and the encoded spaces were happily accepted by other modules before the fix, can we let spaces through mod_rewrite? On Tue, May 9, 2023 at 6:18 

Re: Fwd: [apache/httpd] don't forward invalid query strings (d78a166)

2023-05-09 Thread Eric Covener
On Tue, May 9, 2023 at 3:14 PM Ruediger Pluem wrote: > > > > On 5/9/23 8:01 PM, Eric Covener wrote: > > On Tue, May 9, 2023 at 11:51 AM Ruediger Pluem wrote: > >> > >> > >> > >> On 5/9/23 4:33 PM, Yann Ylavic wrote: > >>> On Tue, May 9, 2023 at 2:10 PM Yann Ylavic wrote: > > On Tue,

Re: Fwd: [apache/httpd] don't forward invalid query strings (d78a166)

2023-05-09 Thread Ruediger Pluem
On 5/9/23 8:01 PM, Eric Covener wrote: > On Tue, May 9, 2023 at 11:51 AM Ruediger Pluem wrote: >> >> >> >> On 5/9/23 4:33 PM, Yann Ylavic wrote: >>> On Tue, May 9, 2023 at 2:10 PM Yann Ylavic wrote: On Tue, May 9, 2023 at 12:55 PM Ruediger Pluem wrote: > > On 5/9/23 12:16

Re: Fwd: [apache/httpd] don't forward invalid query strings (d78a166)

2023-05-09 Thread Eric Covener
On Tue, May 9, 2023 at 11:51 AM Ruediger Pluem wrote: > > > > On 5/9/23 4:33 PM, Yann Ylavic wrote: > > On Tue, May 9, 2023 at 2:10 PM Yann Ylavic wrote: > >> > >> On Tue, May 9, 2023 at 12:55 PM Ruediger Pluem wrote: > >>> > >>> On 5/9/23 12:16 PM, Eric Covener wrote: > Still getting

Re: Fwd: [apache/httpd] don't forward invalid query strings (d78a166)

2023-05-09 Thread Ruediger Pluem
On 5/9/23 4:33 PM, Yann Ylavic wrote: > On Tue, May 9, 2023 at 2:10 PM Yann Ylavic wrote: >> >> On Tue, May 9, 2023 at 12:55 PM Ruediger Pluem wrote: >>> >>> On 5/9/23 12:16 PM, Eric Covener wrote: Still getting feedback in the PR about breakage. Any thoughts on options here, like

Re: Fwd: [apache/httpd] don't forward invalid query strings (d78a166)

2023-05-09 Thread Yann Ylavic
On Tue, May 9, 2023 at 2:10 PM Yann Ylavic wrote: > > On Tue, May 9, 2023 at 12:55 PM Ruediger Pluem wrote: > > > > On 5/9/23 12:16 PM, Eric Covener wrote: > > > Still getting feedback in the PR about breakage. Any thoughts on options > > > here, like allowing spaces or encoding rather than

Re: Fwd: [apache/httpd] don't forward invalid query strings (d78a166)

2023-05-09 Thread Yann Ylavic
On Tue, May 9, 2023 at 12:55 PM Ruediger Pluem wrote: > > On 5/9/23 12:16 PM, Eric Covener wrote: > > Still getting feedback in the PR about breakage. Any thoughts on options > > here, like allowing spaces or encoding rather than failing? > > Allowing spaces is out of question for me as it

Re: Fwd: [apache/httpd] don't forward invalid query strings (d78a166)

2023-05-09 Thread Ruediger Pluem
On 5/9/23 12:16 PM, Eric Covener wrote: > Still getting feedback in the PR about breakage. Any thoughts on options > here, like allowing spaces or encoding rather than failing? Allowing spaces is out of question for me as it creates an invalid request and opens the door to response