diff --git a/backport-Check-before-forwarding-that-a-nocanon-path-has-not-been-rewritten.patch b/backport-Check-before-forwarding-that-a-nocanon-path-has-not-been-rewritten.patch new file mode 100644 index 0000000..78a1c93 --- /dev/null +++ b/backport-Check-before-forwarding-that-a-nocanon-path-has-not-been-rewritten.patch @@ -0,0 +1,288 @@ +From fd92481223a0d213f1dc2f96745f495efcf33eca Mon Sep 17 00:00:00 2001 +From: Ruediger Pluem +Date: Fri, 31 Mar 2023 10:37:34 PM GMT+0800 +Subject: [PATCH] mod_proxy:Check before forwarding that a nocanon path has not been + rewritten with spaces during processing + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/fd92481223a0d213f1dc2f96745f495efcf33eca + +--- + modules/http2/mod_proxy_http2.c | 31 +++++++++++++++++------------ + modules/proxy/mod_proxy_ajp.c | 19 ++++++++++++------ + modules/proxy/mod_proxy_balancer.c | 19 ++++++++++++------ + modules/proxy/mod_proxy_fcgi.c | 15 ++++++++++++-- + modules/proxy/mod_proxy_http.c | 32 ++++++++++++++++++------------ + modules/proxy/mod_proxy_uwsgi.c | 14 +++++++++++-- + modules/proxy/mod_proxy_wstunnel.c | 19 ++++++++++++------ + 7 files changed, 101 insertions(+), 48 deletions(-) + +diff --git a/modules/http2/mod_proxy_http2.c b/modules/http2/mod_proxy_http2.c +index 77e2641..957c7ba 100644 +--- a/modules/http2/mod_proxy_http2.c ++++ b/modules/http2/mod_proxy_http2.c +@@ -164,26 +164,31 @@ static int proxy_http2_canon(request_rec *r, char *url) + + path = ap_proxy_canonenc_ex(r->pool, url, (int)strlen(url), + enc_path, flags, r->proxyreq); ++ if (!path) { ++ return HTTP_BAD_REQUEST; ++ } + search = r->args; + } +- if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10412) +- "To be forwarded query string contains control " +- "characters or spaces"); +- return HTTP_FORBIDDEN; +- } + break; + case PROXYREQ_PROXY: + path = url; + break; + } +- +- if (path == NULL) { +- return HTTP_BAD_REQUEST; ++ /* ++ * If we have a raw control character or a ' ' in nocanon path or ++ * r->args, correct encoding was missed. ++ */ ++ if (path == url && *ap_scan_vchar_obstext(path)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10420) ++ "To be forwarded path contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; ++ } ++ if (search && *ap_scan_vchar_obstext(search)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10412) ++ "To be forwarded query string contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } + + if (port != def_port) { +diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c +index 747f928..4446c5e 100644 +--- a/modules/proxy/mod_proxy_ajp.c ++++ b/modules/proxy/mod_proxy_ajp.c +@@ -75,20 +75,27 @@ static int proxy_ajp_canon(request_rec *r, char *url) + + path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, + r->proxyreq); ++ if (!path) { ++ return HTTP_BAD_REQUEST; ++ } + search = r->args; + } ++ /* ++ * If we have a raw control character or a ' ' in nocanon path or ++ * r->args, correct encoding was missed. ++ */ ++ if (path == url && *ap_scan_vchar_obstext(path)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10418) ++ "To be forwarded path contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; ++ } + if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10406) + "To be forwarded query string contains control " + "characters or spaces"); + return HTTP_FORBIDDEN; + } +- if (path == NULL) +- return HTTP_BAD_REQUEST; + + if (port != def_port) + apr_snprintf(sport, sizeof(sport), ":%d", port); +diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c +index de31749..d175fcf 100644 +--- a/modules/proxy/mod_proxy_balancer.c ++++ b/modules/proxy/mod_proxy_balancer.c +@@ -112,20 +112,27 @@ static int proxy_balancer_canon(request_rec *r, char *url) + + path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, + r->proxyreq); ++ if (!path) { ++ return HTTP_BAD_REQUEST; ++ } + search = r->args; + } ++ /* ++ * If we have a raw control character or a ' ' in nocanon path or ++ * r->args, correct encoding was missed. ++ */ ++ if (path == url && *ap_scan_vchar_obstext(path)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10416) ++ "To be forwarded path contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; ++ } + if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10407) + "To be forwarded query string contains control " + "characters or spaces"); + return HTTP_FORBIDDEN; + } +- if (path == NULL) +- return HTTP_BAD_REQUEST; + + r->filename = apr_pstrcat(r->pool, "proxy:" BALANCER_PREFIX, host, + "/", path, (search) ? "?" : "", (search) ? search : "", NULL); +diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c +index a422b4e..831bd15 100644 +--- a/modules/proxy/mod_proxy_fcgi.c ++++ b/modules/proxy/mod_proxy_fcgi.c +@@ -102,9 +102,20 @@ static int proxy_fcgi_canon(request_rec *r, char *url) + + path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, + r->proxyreq); ++ if (!path) { ++ return HTTP_BAD_REQUEST; ++ } ++ } ++ /* ++ * If we have a raw control character or a ' ' in nocanon path, ++ * correct encoding was missed. ++ */ ++ if (path == url && *ap_scan_vchar_obstext(path)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10414) ++ "To be forwarded path contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } +- if (path == NULL) +- return HTTP_BAD_REQUEST; + + r->filename = apr_pstrcat(r->pool, "proxy:fcgi://", host, sport, "/", + path, NULL); +diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c +index fca8d5d..40f0787 100644 +--- a/modules/proxy/mod_proxy_http.c ++++ b/modules/proxy/mod_proxy_http.c +@@ -131,26 +131,32 @@ static int proxy_http_canon(request_rec *r, char *url) + + path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, + flags, r->proxyreq); ++ if (!path) { ++ return HTTP_BAD_REQUEST; ++ } + search = r->args; + } +- if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10408) +- "To be forwarded query string contains control " +- "characters or spaces"); +- return HTTP_FORBIDDEN; +- } + break; + case PROXYREQ_PROXY: + path = url; + break; + } +- +- if (path == NULL) +- return HTTP_BAD_REQUEST; ++ /* ++ * If we have a raw control character or a ' ' in nocanon path or ++ * r->args, correct encoding was missed. ++ */ ++ if (path == url && *ap_scan_vchar_obstext(path)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10415) ++ "To be forwarded path contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; ++ } ++ if (search && *ap_scan_vchar_obstext(search)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10408) ++ "To be forwarded query string contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; ++ } + + if (port != def_port) + apr_snprintf(sport, sizeof(sport), ":%d", port); +diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c +index 771fcea..f0cbb5d 100644 +--- a/modules/proxy/mod_proxy_uwsgi.c ++++ b/modules/proxy/mod_proxy_uwsgi.c +@@ -94,9 +94,19 @@ static int uwsgi_canon(request_rec *r, char *url) + + path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, + r->proxyreq); ++ if (!path) { ++ return HTTP_BAD_REQUEST; ++ } + } +- if (!path) { +- return HTTP_BAD_REQUEST; ++ /* ++ * If we have a raw control character or a ' ' in nocanon path, ++ * correct encoding was missed. ++ */ ++ if (path == url && *ap_scan_vchar_obstext(path)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10417) ++ "To be forwarded path contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } + + r->filename = +diff --git a/modules/proxy/mod_proxy_wstunnel.c b/modules/proxy/mod_proxy_wstunnel.c +index a44bb44..227dba4 100644 +--- a/modules/proxy/mod_proxy_wstunnel.c ++++ b/modules/proxy/mod_proxy_wstunnel.c +@@ -120,20 +120,27 @@ static int proxy_wstunnel_canon(request_rec *r, char *url) + + path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, + r->proxyreq); ++ if (!path) { ++ return HTTP_BAD_REQUEST; ++ } + search = r->args; + } ++ /* ++ * If we have a raw control character or a ' ' in nocanon path or ++ * r->args, correct encoding was missed. ++ */ ++ if (path == url && *ap_scan_vchar_obstext(path)) { ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10419) ++ "To be forwarded path contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; ++ } + if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ + ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10409) + "To be forwarded query string contains control " + "characters or spaces"); + return HTTP_FORBIDDEN; + } +- if (path == NULL) +- return HTTP_BAD_REQUEST; + + if (port != def_port) + apr_snprintf(sport, sizeof(sport), ":%d", port); +-- +2.27.0 + diff --git a/backport-Do-not-double-encode-encoded-slashes.patch b/backport-Do-not-double-encode-encoded-slashes.patch new file mode 100644 index 0000000..203c579 --- /dev/null +++ b/backport-Do-not-double-encode-encoded-slashes.patch @@ -0,0 +1,322 @@ +From 9b8cf1746bb004050b02a30bf0222479fbe405c2 Mon Sep 17 00:00:00 2001 +From: Ruediger Pluem +Date: Fri, 31 Mar 2023 10:33:47 PM GMT+0800 +Subject: [PATCH] mod_proxy:In case that AllowEncodedSlashes is set to NoDecode do not + double encode encoded slashes in the URL sent by the reverse proxy to the + backend + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/9b8cf1746bb004050b02a30bf0222479fbe405c2 + +--- + include/ap_mmn.h | 3 ++- + modules/http2/mod_proxy_http2.c | 7 ++++-- + modules/proxy/mod_proxy.h | 6 +++++ + modules/proxy/mod_proxy_ajp.c | 7 ++++-- + modules/proxy/mod_proxy_balancer.c | 7 ++++-- + modules/proxy/mod_proxy_fcgi.c | 7 ++++-- + modules/proxy/mod_proxy_ftp.c | 5 +++- + modules/proxy/mod_proxy_http.c | 7 ++++-- + modules/proxy/mod_proxy_scgi.c | 6 +++-- + modules/proxy/mod_proxy_uwsgi.c | 7 ++++-- + modules/proxy/mod_proxy_wstunnel.c | 7 ++++-- + modules/proxy/proxy_util.c | 39 ++++++++++++++++++++++++++---- + 12 files changed, 85 insertions(+), 23 deletions(-) + +diff --git a/include/ap_mmn.h b/include/ap_mmn.h +index a6d47a2..dd469f3 100644 +--- a/include/ap_mmn.h ++++ b/include/ap_mmn.h +@@ -582,6 +582,7 @@ + * 20120211.118 (2.4.51-dev) Add ap_unescape_url_ex() and deprecate + * AP_NORMALIZE_DROP_PARAMETERS + * 20120211.121 (2.4.51-dev) Add ap_post_read_request() ++ * 20120211.122 (2.4.51-dev) Add ap_proxy_canonenc_ex + * + */ + +@@ -590,7 +591,7 @@ + #ifndef MODULE_MAGIC_NUMBER_MAJOR + #define MODULE_MAGIC_NUMBER_MAJOR 20120211 + #endif +-#define MODULE_MAGIC_NUMBER_MINOR 118 /* 0...n */ ++#define MODULE_MAGIC_NUMBER_MINOR 122 /* 0...n */ + + /** + * Determine if the server's current MODULE_MAGIC_NUMBER is at least a +diff --git a/modules/http2/mod_proxy_http2.c b/modules/http2/mod_proxy_http2.c +index 9b741e1..77e2641 100644 +--- a/modules/http2/mod_proxy_http2.c ++++ b/modules/http2/mod_proxy_http2.c +@@ -159,8 +159,11 @@ static int proxy_http2_canon(request_rec *r, char *url) + search = r->args; + } + else { +- path = ap_proxy_canonenc(r->pool, url, (int)strlen(url), +- enc_path, 0, r->proxyreq); ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; ++ ++ path = ap_proxy_canonenc_ex(r->pool, url, (int)strlen(url), ++ enc_path, flags, r->proxyreq); + search = r->args; + } + if (search && *(ap_scan_vchar_obstext(search))) { +diff --git a/modules/proxy/mod_proxy.h b/modules/proxy/mod_proxy.h +index 47899d7..ce8183a 100644 +--- a/modules/proxy/mod_proxy.h ++++ b/modules/proxy/mod_proxy.h +@@ -76,6 +76,10 @@ enum enctype { + enc_path, enc_search, enc_user, enc_fpath, enc_parm + }; + ++/* Flags for ap_proxy_canonenc_ex */ ++#define PROXY_CANONENC_FORCEDEC 0x01 ++#define PROXY_CANONENC_NOENCODEDSLASHENCODING 0x02 ++ + typedef enum { + NONE, TCP, OPTIONS, HEAD, GET, CPING, PROVIDER, EOT + } hcmethod_t; +@@ -669,6 +673,8 @@ PROXY_DECLARE(apr_status_t) ap_proxy_strncpy(char *dst, const char *src, + apr_size_t dlen); + PROXY_DECLARE(int) ap_proxy_hex2c(const char *x); + PROXY_DECLARE(void) ap_proxy_c2hex(int ch, char *x); ++PROXY_DECLARE(char *)ap_proxy_canonenc_ex(apr_pool_t *p, const char *x, int len, enum enctype t, ++ int flags, int proxyreq); + PROXY_DECLARE(char *)ap_proxy_canonenc(apr_pool_t *p, const char *x, int len, enum enctype t, + int forcedec, int proxyreq); + PROXY_DECLARE(char *)ap_proxy_canon_netloc(apr_pool_t *p, char **const urlp, char **userp, +diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c +index 731e4ed..747f928 100644 +--- a/modules/proxy/mod_proxy_ajp.c ++++ b/modules/proxy/mod_proxy_ajp.c +@@ -70,8 +70,11 @@ static int proxy_ajp_canon(request_rec *r, char *url) + search = r->args; + } + else { +- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +- r->proxyreq); ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; ++ ++ path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, ++ r->proxyreq); + search = r->args; + } + if (search && *(ap_scan_vchar_obstext(search))) { +diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c +index 719a99e..de31749 100644 +--- a/modules/proxy/mod_proxy_balancer.c ++++ b/modules/proxy/mod_proxy_balancer.c +@@ -107,8 +107,11 @@ static int proxy_balancer_canon(request_rec *r, char *url) + search = r->args; + } + else { +- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +- r->proxyreq); ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; ++ ++ path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, ++ r->proxyreq); + search = r->args; + } + if (search && *(ap_scan_vchar_obstext(search))) { +diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c +index a89b9a9..a422b4e 100644 +--- a/modules/proxy/mod_proxy_fcgi.c ++++ b/modules/proxy/mod_proxy_fcgi.c +@@ -97,8 +97,11 @@ static int proxy_fcgi_canon(request_rec *r, char *url) + path = url; /* this is the raw/encoded path */ + } + else { +- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +- r->proxyreq); ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; ++ ++ path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, ++ r->proxyreq); + } + if (path == NULL) + return HTTP_BAD_REQUEST; +diff --git a/modules/proxy/mod_proxy_ftp.c b/modules/proxy/mod_proxy_ftp.c +index a559528..e40d17c 100644 +--- a/modules/proxy/mod_proxy_ftp.c ++++ b/modules/proxy/mod_proxy_ftp.c +@@ -294,6 +294,8 @@ static int proxy_ftp_canon(request_rec *r, char *url) + apr_pool_t *p = r->pool; + const char *err; + apr_port_t port, def_port; ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; + + /* */ + if (ap_cstr_casecmpn(url, "ftp:", 4) == 0) { +@@ -332,7 +334,8 @@ static int proxy_ftp_canon(request_rec *r, char *url) + else + parms = ""; + +- path = ap_proxy_canonenc(p, url, strlen(url), enc_path, 0, r->proxyreq); ++ path = ap_proxy_canonenc_ex(p, url, strlen(url), enc_path, flags, ++ r->proxyreq); + if (path == NULL) + return HTTP_BAD_REQUEST; + if (!ftp_check_string(path)) +diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c +index 4d0f8de..fca8d5d 100644 +--- a/modules/proxy/mod_proxy_http.c ++++ b/modules/proxy/mod_proxy_http.c +@@ -126,8 +126,11 @@ static int proxy_http_canon(request_rec *r, char *url) + search = r->args; + } + else { +- path = ap_proxy_canonenc(r->pool, url, strlen(url), +- enc_path, 0, r->proxyreq); ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; ++ ++ path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, ++ flags, r->proxyreq); + search = r->args; + } + if (search && *(ap_scan_vchar_obstext(search))) { +diff --git a/modules/proxy/mod_proxy_scgi.c b/modules/proxy/mod_proxy_scgi.c +index 493757d..5444a5c 100644 +--- a/modules/proxy/mod_proxy_scgi.c ++++ b/modules/proxy/mod_proxy_scgi.c +@@ -179,6 +179,8 @@ static int scgi_canon(request_rec *r, char *url) + char *host, sport[sizeof(":65535")]; + const char *err, *path; + apr_port_t port, def_port; ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; + + if (ap_cstr_casecmpn(url, SCHEME "://", sizeof(SCHEME) + 2)) { + return DECLINED; +@@ -205,8 +207,8 @@ static int scgi_canon(request_rec *r, char *url) + host = apr_pstrcat(r->pool, "[", host, "]", NULL); + } + +- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +- r->proxyreq); ++ path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, ++ r->proxyreq); + if (!path) { + return HTTP_BAD_REQUEST; + } +diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c +index 71c6ebb..771fcea 100644 +--- a/modules/proxy/mod_proxy_uwsgi.c ++++ b/modules/proxy/mod_proxy_uwsgi.c +@@ -89,8 +89,11 @@ static int uwsgi_canon(request_rec *r, char *url) + path = url; /* this is the raw/encoded path */ + } + else { +- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +- r->proxyreq); ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; ++ ++ path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, ++ r->proxyreq); + } + if (!path) { + return HTTP_BAD_REQUEST; +diff --git a/modules/proxy/mod_proxy_wstunnel.c b/modules/proxy/mod_proxy_wstunnel.c +index 3f8de25..a44bb44 100644 +--- a/modules/proxy/mod_proxy_wstunnel.c ++++ b/modules/proxy/mod_proxy_wstunnel.c +@@ -115,8 +115,11 @@ static int proxy_wstunnel_canon(request_rec *r, char *url) + search = r->args; + } + else { +- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +- r->proxyreq); ++ core_dir_config *d = ap_get_core_module_config(r->per_dir_config); ++ int flags = d->allow_encoded_slashes && !d->decode_encoded_slashes ? PROXY_CANONENC_NOENCODEDSLASHENCODING : 0; ++ ++ path = ap_proxy_canonenc_ex(r->pool, url, strlen(url), enc_path, flags, ++ r->proxyreq); + search = r->args; + } + if (search && *(ap_scan_vchar_obstext(search))) { +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index 669b672..2dee743 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -205,14 +205,16 @@ PROXY_DECLARE(void) ap_proxy_c2hex(int ch, char *x) + * and encodes those which must be encoded, and does not touch + * those which must not be touched. + */ +-PROXY_DECLARE(char *)ap_proxy_canonenc(apr_pool_t *p, const char *x, int len, +- enum enctype t, int forcedec, +- int proxyreq) ++PROXY_DECLARE(char *)ap_proxy_canonenc_ex(apr_pool_t *p, const char *x, int len, ++ enum enctype t, int flags, ++ int proxyreq) + { + int i, j, ch; + char *y; + char *allowed; /* characters which should not be encoded */ + char *reserved; /* characters which much not be en/de-coded */ ++ int forcedec = flags & PROXY_CANONENC_FORCEDEC; ++ int noencslashesenc = flags & PROXY_CANONENC_NOENCODEDSLASHENCODING; + + /* + * N.B. in addition to :@&=, this allows ';' in an http path +@@ -261,7 +263,8 @@ PROXY_DECLARE(char *)ap_proxy_canonenc(apr_pool_t *p, const char *x, int len, + * decode it if not already done. do not decode reverse proxied URLs + * unless specifically forced + */ +- if ((forcedec || (proxyreq && proxyreq != PROXYREQ_REVERSE)) && ch == '%') { ++ if ((forcedec || noencslashesenc ++ || (proxyreq && proxyreq != PROXYREQ_REVERSE)) && ch == '%') { + if (!apr_isxdigit(x[i + 1]) || !apr_isxdigit(x[i + 2])) { + return NULL; + } +@@ -272,7 +275,17 @@ PROXY_DECLARE(char *)ap_proxy_canonenc(apr_pool_t *p, const char *x, int len, + y[j] = x[i]; + continue; + } +- i += 2; ++ if (noencslashesenc && !forcedec && (proxyreq == PROXYREQ_REVERSE)) { ++ /* ++ * In the reverse proxy case when we only want to keep encoded ++ * slashes untouched revert back to '%' which will cause ++ * '%' to be encoded in the following. ++ */ ++ ch = '%'; ++ } ++ else { ++ i += 2; ++ } + } + /* recode it, if necessary */ + if (!apr_isalnum(ch) && !strchr(allowed, ch)) { +@@ -287,6 +300,22 @@ PROXY_DECLARE(char *)ap_proxy_canonenc(apr_pool_t *p, const char *x, int len, + return y; + } + ++/* ++ * Convert a URL-encoded string to canonical form. ++ * It decodes characters which need not be encoded, ++ * and encodes those which must be encoded, and does not touch ++ * those which must not be touched. ++ */ ++PROXY_DECLARE(char *)ap_proxy_canonenc(apr_pool_t *p, const char *x, int len, ++ enum enctype t, int forcedec, ++ int proxyreq) ++{ ++ int flags; ++ ++ flags = forcedec ? PROXY_CANONENC_FORCEDEC : 0; ++ return ap_proxy_canonenc_ex(p, x, len, t, flags, proxyreq); ++} ++ + /* + * Parses network-location. + * urlp on input the URL; on output the path, after the leading / +-- +2.27.0 + diff --git a/backport-Fix-double-encoding-of-the-uri-path-of-the-request.patch b/backport-Fix-double-encoding-of-the-uri-path-of-the-request.patch new file mode 100644 index 0000000..192c2e5 --- /dev/null +++ b/backport-Fix-double-encoding-of-the-uri-path-of-the-request.patch @@ -0,0 +1,258 @@ +From a356fdbfb93c59a4e359f0a81b38aef31ddd856e Mon Sep 17 00:00:00 2001 +From: Eric covener +Date: Mon, 20 Mar 2023 05:29:03 AM GMT+0800 +Subject: [PATCH] mod_proxy: Fix double encoding of the uri-path of the request forwarded + to the origin server, when using mapping=encoded|servlet + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/a356fdbfb93c59a4e359f0a81b38aef31ddd856e + +--- + modules/http2/mod_proxy_http2.c | 20 ++++++++++---------- + modules/proxy/mod_proxy.c | 17 +++++++++++------ + modules/proxy/mod_proxy_ajp.c | 20 ++++++++++---------- + modules/proxy/mod_proxy_balancer.c | 20 ++++++++++---------- + modules/proxy/mod_proxy_fcgi.c | 5 +++-- + modules/proxy/mod_proxy_http.c | 20 ++++++++++---------- + modules/proxy/mod_proxy_uwsgi.c | 10 ++++++++-- + modules/proxy/mod_proxy_wstunnel.c | 20 ++++++++++---------- + 8 files changed, 72 insertions(+), 60 deletions(-) + +diff --git a/modules/http2/mod_proxy_http2.c b/modules/http2/mod_proxy_http2.c +index 753f7f4..9b741e1 100644 +--- a/modules/http2/mod_proxy_http2.c ++++ b/modules/http2/mod_proxy_http2.c +@@ -162,16 +162,16 @@ static int proxy_http2_canon(request_rec *r, char *url) + path = ap_proxy_canonenc(r->pool, url, (int)strlen(url), + enc_path, 0, r->proxyreq); + search = r->args; +- if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10412) +- "To be forwarded query string contains control " +- "characters or spaces"); +- return HTTP_FORBIDDEN; +- } ++ } ++ if (search && *(ap_scan_vchar_obstext(search))) { ++ /* ++ * We have a raw control character or a ' ' in r->args. ++ * Correct encoding was missed. ++ */ ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10412) ++ "To be forwarded query string contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } + break; + case PROXYREQ_PROXY: +diff --git a/modules/proxy/mod_proxy.c b/modules/proxy/mod_proxy.c +index f8a4db6..6717782 100644 +--- a/modules/proxy/mod_proxy.c ++++ b/modules/proxy/mod_proxy.c +@@ -960,6 +960,8 @@ PROXY_DECLARE(int) ap_proxy_trans_match(request_rec *r, struct proxy_alias *ent, + } + + if (found) { ++ unsigned int encoded = ent->flags & PROXYPASS_MAP_ENCODED; ++ + /* A proxy module is assigned this URL, check whether it's interested + * in the request itself (e.g. proxy_wstunnel cares about Upgrade + * requests only, and could hand over to proxy_http otherwise). +@@ -979,6 +981,9 @@ PROXY_DECLARE(int) ap_proxy_trans_match(request_rec *r, struct proxy_alias *ent, + if (ent->flags & PROXYPASS_NOQUERY) { + apr_table_setn(r->notes, "proxy-noquery", "1"); + } ++ if (encoded) { ++ apr_table_setn(r->notes, "proxy-noencode", "1"); ++ } + + if (servlet_uri) { + ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, APLOGNO(10248) +@@ -992,13 +997,13 @@ PROXY_DECLARE(int) ap_proxy_trans_match(request_rec *r, struct proxy_alias *ent, + */ + AP_DEBUG_ASSERT(strlen(r->uri) >= strlen(servlet_uri)); + strcpy(r->uri, servlet_uri); +- return DONE; + } +- +- ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, APLOGNO(03464) +- "URI path '%s' matches proxy handler '%s'", r->uri, +- found); +- return OK; ++ else { ++ ap_log_rerror(APLOG_MARK, APLOG_TRACE1, 0, r, APLOGNO(03464) ++ "URI path '%s' matches proxy handler '%s'", r->uri, ++ found); ++ } ++ return (encoded) ? DONE : OK; + } + + return HTTP_CONTINUE; +diff --git a/modules/proxy/mod_proxy_ajp.c b/modules/proxy/mod_proxy_ajp.c +index ba41fbd..731e4ed 100644 +--- a/modules/proxy/mod_proxy_ajp.c ++++ b/modules/proxy/mod_proxy_ajp.c +@@ -73,16 +73,16 @@ static int proxy_ajp_canon(request_rec *r, char *url) + path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, + r->proxyreq); + search = r->args; +- if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10406) +- "To be forwarded query string contains control " +- "characters or spaces"); +- return HTTP_FORBIDDEN; +- } ++ } ++ if (search && *(ap_scan_vchar_obstext(search))) { ++ /* ++ * We have a raw control character or a ' ' in r->args. ++ * Correct encoding was missed. ++ */ ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10406) ++ "To be forwarded query string contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } + if (path == NULL) + return HTTP_BAD_REQUEST; +diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c +index c8bba0f..719a99e 100644 +--- a/modules/proxy/mod_proxy_balancer.c ++++ b/modules/proxy/mod_proxy_balancer.c +@@ -110,16 +110,16 @@ static int proxy_balancer_canon(request_rec *r, char *url) + path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, + r->proxyreq); + search = r->args; +- if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10407) +- "To be forwarded query string contains control " +- "characters or spaces"); +- return HTTP_FORBIDDEN; +- } ++ } ++ if (search && *(ap_scan_vchar_obstext(search))) { ++ /* ++ * We have a raw control character or a ' ' in r->args. ++ * Correct encoding was missed. ++ */ ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10407) ++ "To be forwarded query string contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } + if (path == NULL) + return HTTP_BAD_REQUEST; +diff --git a/modules/proxy/mod_proxy_fcgi.c b/modules/proxy/mod_proxy_fcgi.c +index 3382b9b..a89b9a9 100644 +--- a/modules/proxy/mod_proxy_fcgi.c ++++ b/modules/proxy/mod_proxy_fcgi.c +@@ -92,8 +92,9 @@ static int proxy_fcgi_canon(request_rec *r, char *url) + host = apr_pstrcat(r->pool, "[", host, "]", NULL); + } + +- if (apr_table_get(r->notes, "proxy-nocanon")) { +- path = url; /* this is the raw path */ ++ if (apr_table_get(r->notes, "proxy-nocanon") ++ || apr_table_get(r->notes, "proxy-noencode")) { ++ path = url; /* this is the raw/encoded path */ + } + else { + path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +diff --git a/modules/proxy/mod_proxy_http.c b/modules/proxy/mod_proxy_http.c +index 09269b2..4d0f8de 100644 +--- a/modules/proxy/mod_proxy_http.c ++++ b/modules/proxy/mod_proxy_http.c +@@ -129,16 +129,16 @@ static int proxy_http_canon(request_rec *r, char *url) + path = ap_proxy_canonenc(r->pool, url, strlen(url), + enc_path, 0, r->proxyreq); + search = r->args; +- if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10408) +- "To be forwarded query string contains control " +- "characters or spaces"); +- return HTTP_FORBIDDEN; +- } ++ } ++ if (search && *(ap_scan_vchar_obstext(search))) { ++ /* ++ * We have a raw control character or a ' ' in r->args. ++ * Correct encoding was missed. ++ */ ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10408) ++ "To be forwarded query string contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } + break; + case PROXYREQ_PROXY: +diff --git a/modules/proxy/mod_proxy_uwsgi.c b/modules/proxy/mod_proxy_uwsgi.c +index cc21e38..71c6ebb 100644 +--- a/modules/proxy/mod_proxy_uwsgi.c ++++ b/modules/proxy/mod_proxy_uwsgi.c +@@ -84,8 +84,14 @@ static int uwsgi_canon(request_rec *r, char *url) + host = apr_pstrcat(r->pool, "[", host, "]", NULL); + } + +- path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, +- r->proxyreq); ++ if (apr_table_get(r->notes, "proxy-nocanon") ++ || apr_table_get(r->notes, "proxy-noencode")) { ++ path = url; /* this is the raw/encoded path */ ++ } ++ else { ++ path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, ++ r->proxyreq); ++ } + if (!path) { + return HTTP_BAD_REQUEST; + } +diff --git a/modules/proxy/mod_proxy_wstunnel.c b/modules/proxy/mod_proxy_wstunnel.c +index e2fcba2..3f8de25 100644 +--- a/modules/proxy/mod_proxy_wstunnel.c ++++ b/modules/proxy/mod_proxy_wstunnel.c +@@ -118,16 +118,16 @@ static int proxy_wstunnel_canon(request_rec *r, char *url) + path = ap_proxy_canonenc(r->pool, url, strlen(url), enc_path, 0, + r->proxyreq); + search = r->args; +- if (search && *(ap_scan_vchar_obstext(search))) { +- /* +- * We have a raw control character or a ' ' in r->args. +- * Correct encoding was missed. +- */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10409) +- "To be forwarded query string contains control " +- "characters or spaces"); +- return HTTP_FORBIDDEN; +- } ++ } ++ if (search && *(ap_scan_vchar_obstext(search))) { ++ /* ++ * We have a raw control character or a ' ' in r->args. ++ * Correct encoding was missed. ++ */ ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10409) ++ "To be forwarded query string contains control " ++ "characters or spaces"); ++ return HTTP_FORBIDDEN; + } + if (path == NULL) + return HTTP_BAD_REQUEST; +-- +2.27.0 + diff --git a/backport-Report-an-error-if-the-AJP-backend-sends-an-invalid-number-of-headers.patch b/backport-Report-an-error-if-the-AJP-backend-sends-an-invalid-number-of-headers.patch new file mode 100644 index 0000000..fad6c64 --- /dev/null +++ b/backport-Report-an-error-if-the-AJP-backend-sends-an-invalid-number-of-headers.patch @@ -0,0 +1,36 @@ +From 296a99c3102e4dd91153a8fb732275b804f001fc Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 23 Jan 2023 04:59:22 PM GMT+0800 +Subject: [PATCH] Report an error if the AJP backend sends an invalid number of headers + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/296a99c3102e4dd91153a8fb732275b804f001fc + +--- + modules/proxy/ajp_header.c | 9 ++++++++- + 1 file changed, 8 insertions(+), 1 deletion(-) + +diff --git a/modules/proxy/ajp_header.c b/modules/proxy/ajp_header.c +index b4dc47c..a09a2e4 100644 +--- a/modules/proxy/ajp_header.c ++++ b/modules/proxy/ajp_header.c +@@ -584,8 +584,15 @@ static apr_status_t ajp_unmarshal_response(ajp_msg_t *msg, + r->headers_out = save_table; + } + else { +- r->headers_out = NULL; ++ /* ++ * Reset headers, but not to NULL because things below the chain expect ++ * this to be non NULL e.g. the ap_content_length_filter. ++ */ ++ r->headers_out = apr_table_make(r->pool, 1); + num_headers = 0; ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10405) ++ "ajp_unmarshal_response: Bad number of headers"); ++ return rc; + } + + ap_log_rerror(APLOG_MARK, APLOG_TRACE4, 0, r, +-- +2.27.0 + diff --git a/backport-avoid-delimiting-the-query-with-a-backreference.patch b/backport-avoid-delimiting-the-query-with-a-backreference.patch new file mode 100644 index 0000000..293efa9 --- /dev/null +++ b/backport-avoid-delimiting-the-query-with-a-backreference.patch @@ -0,0 +1,152 @@ +From 9282a06e55cb142666d6ed565c9031e728b7d537 Mon Sep 17 00:00:00 2001 +From: Eric Covener +Date: Mon, 6 Mar 2023 04:31:19 AM GMT+0800 +Subject: [PATCH] avoid delimiting the query with a backreference + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/9282a06e55cb142666d6ed565c9031e728b7d537 + +--- + modules/mappers/mod_rewrite.c | 44 +++++++++++++++++++++++++---------- + 1 file changed, 32 insertions(+), 12 deletions(-) + +diff --git a/modules/mappers/mod_rewrite.c b/modules/mappers/mod_rewrite.c +index 7faaeb7..e539a44 100644 +--- a/modules/mappers/mod_rewrite.c ++++ b/modules/mappers/mod_rewrite.c +@@ -167,6 +167,7 @@ static const char* really_last_key = "rewrite_really_last"; + #define RULEFLAG_END (1<<17) + #define RULEFLAG_ESCAPENOPLUS (1<<18) + #define RULEFLAG_QSLAST (1<<19) ++#define RULEFLAG_QSNONE (1<<20) /* programattic only */ + + /* return code of the rewrite rule + * the result may be escaped - or not +@@ -763,11 +764,19 @@ static char *escape_absolute_uri(apr_pool_t *p, char *uri, unsigned scheme) + * split out a QUERY_STRING part from + * the current URI string + */ +-static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard, +- int qslast) ++static void splitout_queryargs(request_rec *r, int flags) + { + char *q; + int split, skip; ++ int qsappend = flags & RULEFLAG_QSAPPEND; ++ int qsdiscard = flags & RULEFLAG_QSDISCARD; ++ int qslast = flags & RULEFLAG_QSLAST; ++ ++ if (flags & RULEFLAG_QSNONE) { ++ rewritelog((r, 2, NULL, "discarding query string, no parse from substitution")); ++ r->args = NULL; ++ return; ++ } + + /* don't touch, unless it's a scheme for which a query string makes sense. + * See RFC 1738 and RFC 2368. +@@ -792,7 +801,7 @@ static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard, + olduri = apr_pstrdup(r->pool, r->filename); + *q++ = '\0'; + if (qsappend) { +- if (*q) { ++ if (*q) { + r->args = apr_pstrcat(r->pool, q, "&" , r->args, NULL); + } + } +@@ -800,7 +809,7 @@ static void splitout_queryargs(request_rec *r, int qsappend, int qsdiscard, + r->args = apr_pstrdup(r->pool, q); + } + +- if (r->args) { ++ if (r->args) { + len = strlen(r->args); + + if (!len) { +@@ -2735,7 +2744,8 @@ static apr_status_t rewritelock_remove(void *data) + * XXX: what an inclined parser. Seems we have to leave it so + * for backwards compat. *sigh* + */ +-static int parseargline(char *str, char **a1, char **a2, char **a3) ++static char *parseargline(apr_pool_t *p, char *str, char **a1, ++ char **a2, char **a2_end, char **a3) + { + char quote; + +@@ -2786,8 +2796,10 @@ static int parseargline(char *str, char **a1, char **a2, char **a3) + + if (!*str) { + *a3 = NULL; /* 3rd argument is optional */ ++ *a2_end = str; + return 0; + } ++ *a2_end = str; + *str++ = '\0'; + + while (apr_isspace(*str)) { +@@ -3327,7 +3339,7 @@ static const char *cmd_rewritecond(cmd_parms *cmd, void *in_dconf, + rewrite_server_conf *sconf; + rewritecond_entry *newcond; + ap_regex_t *regexp; +- char *a1 = NULL, *a2 = NULL, *a3 = NULL; ++ char *a1 = NULL, *a2 = NULL, *a2_end, *a3 = NULL; + const char *err; + + sconf = ap_get_module_config(cmd->server->module_config, &rewrite_module); +@@ -3345,7 +3357,7 @@ static const char *cmd_rewritecond(cmd_parms *cmd, void *in_dconf, + * of the argument line. So we can use a1 .. a3 without + * copying them again. + */ +- if (parseargline(str, &a1, &a2, &a3)) { ++ if ((err = parseargline(cmd->pool, str, &a1, &a2, &a2_end, &a3))) { + return apr_pstrcat(cmd->pool, "RewriteCond: bad argument line '", str, + "'", NULL); + } +@@ -3753,7 +3765,7 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf, + rewrite_server_conf *sconf; + rewriterule_entry *newrule; + ap_regex_t *regexp; +- char *a1 = NULL, *a2 = NULL, *a3 = NULL; ++ char *a1 = NULL, *a2 = NULL, *a2_end, *a3 = NULL; + const char *err; + + sconf = ap_get_module_config(cmd->server->module_config, &rewrite_module); +@@ -3767,7 +3779,7 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf, + } + + /* parse the argument line ourself */ +- if (parseargline(str, &a1, &a2, &a3)) { ++ if ((err = parseargline(cmd->pool, str, &a1, &a2, &a2_end, &a3))) { + return apr_pstrcat(cmd->pool, "RewriteRule: bad argument line '", str, + "'", NULL); + } +@@ -3814,6 +3826,16 @@ static const char *cmd_rewriterule(cmd_parms *cmd, void *in_dconf, + newrule->flags |= RULEFLAG_NOSUB; + } + ++ if (*(a2_end-1) == '?') { ++ /* a literal ? at the end of the unsubstituted rewrite rule */ ++ newrule->flags |= RULEFLAG_QSNONE; ++ } ++ else if (newrule->flags & RULEFLAG_QSDISCARD) { ++ if (NULL == ap_strchr(newrule->output, '?')) { ++ newrule->flags |= RULEFLAG_QSNONE; ++ } ++ } ++ + /* now, if the server or per-dir config holds an + * array of RewriteCond entries, we take it for us + * and clear the array +@@ -4219,9 +4241,7 @@ static int apply_rewrite_rule(rewriterule_entry *p, rewrite_ctx *ctx) + r->path_info = NULL; + } + +- splitout_queryargs(r, p->flags & RULEFLAG_QSAPPEND, +- p->flags & RULEFLAG_QSDISCARD, +- p->flags & RULEFLAG_QSLAST); ++ splitout_queryargs(r, p->flags); + + /* Add the previously stripped per-directory location prefix, unless + * (1) it's an absolute URL path and +-- +2.27.0 + diff --git a/backport-do-not-match-the-extention-against-possible-query-string.patch b/backport-do-not-match-the-extention-against-possible-query-string.patch new file mode 100644 index 0000000..94309f7 --- /dev/null +++ b/backport-do-not-match-the-extention-against-possible-query-string.patch @@ -0,0 +1,72 @@ +From 11d58d4a43939ccd6f0ab3e4bf762c6a9bc8e0a7 Mon Sep 17 00:00:00 2001 +From: Eric covener +Date: Mon, 20 Mar 2023 05:33:57 AM GMT+0800 +Subject: [PATCH] mod_mime: Do not match the extention against possible query string + parameters in case ProxyPass was used with the nocanon option. + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/11d58d4a43939ccd6f0ab3e4bf762c6a9bc8e0a7 + +--- + modules/http/mod_mime.c | 15 ++++++++++++++- + modules/proxy/proxy_util.c | 7 ++++--- + 2 files changed, 18 insertions(+), 4 deletions(-) + +diff --git a/modules/http/mod_mime.c b/modules/http/mod_mime.c +index 03d1c41..700f824 100644 +--- a/modules/http/mod_mime.c ++++ b/modules/http/mod_mime.c +@@ -755,7 +755,7 @@ static int find_ct(request_rec *r) + mime_dir_config *conf; + apr_array_header_t *exception_list; + char *ext; +- const char *fn, *fntmp, *type, *charset = NULL, *resource_name; ++ const char *fn, *fntmp, *type, *charset = NULL, *resource_name, *qm; + int found_metadata = 0; + + if (r->finfo.filetype == APR_DIR) { +@@ -775,6 +775,19 @@ static int find_ct(request_rec *r) + if (conf->use_path_info & 1) { + resource_name = apr_pstrcat(r->pool, r->filename, r->path_info, NULL); + } ++ /* ++ * In the reverse proxy case r->filename might contain a query string if ++ * the nocanon option was used with ProxyPass. ++ * If this is the case cut off the query string as the last parameter in ++ * this query string might end up on an extension we take care about, but ++ * we only want to match against path components not against query ++ * parameters. ++ */ ++ else if ((r->proxyreq == PROXYREQ_REVERSE) ++ && (apr_table_get(r->notes, "proxy-nocanon")) ++ && ((qm = ap_strchr_c(r->filename, '?')) != NULL)) { ++ resource_name = apr_pstrmemdup(r->pool, r->filename, qm - r->filename); ++ } + else { + resource_name = r->filename; + } +diff --git a/modules/proxy/proxy_util.c b/modules/proxy/proxy_util.c +index 3d324cb..d824fb0 100644 +--- a/modules/proxy/proxy_util.c ++++ b/modules/proxy/proxy_util.c +@@ -266,12 +266,13 @@ PROXY_DECLARE(char *)ap_proxy_canonenc(apr_pool_t *p, const char *x, int len, + return NULL; + } + ch = ap_proxy_hex2c(&x[i + 1]); +- i += 2; + if (ch != 0 && strchr(reserved, ch)) { /* keep it encoded */ +- ap_proxy_c2hex(ch, &y[j]); +- j += 2; ++ y[j++] = x[i++]; ++ y[j++] = x[i++]; ++ y[j] = x[i]; + continue; + } ++ i += 2; + } + /* recode it, if necessary */ + if (!apr_isalnum(ch) && !strchr(allowed, ch)) { +-- +2.33.0 + + diff --git a/backport-fix-missing-APLOGNO.patch b/backport-fix-missing-APLOGNO.patch new file mode 100644 index 0000000..24e03b6 --- /dev/null +++ b/backport-fix-missing-APLOGNO.patch @@ -0,0 +1,28 @@ +From 1061b64bb7da5339b037f936169a088150427bd1 Mon Sep 17 00:00:00 2001 +From: Ruediger Pluem +Date: Mon, 6 Mar 2023 05:25:17 PM GMT+0800 +Subject: [PATCH] modules/http2/mod_proxy_http2.c: Fix missing APLOGNO + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/1061b64bb7da5339b037f936169a088150427bd1 + +--- + modules/http2/mod_proxy_http2.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/modules/http2/mod_proxy_http2.c b/modules/http2/mod_proxy_http2.c +index d8a77c8..753f7f4 100644 +--- a/modules/http2/mod_proxy_http2.c ++++ b/modules/http2/mod_proxy_http2.c +@@ -167,7 +167,7 @@ static int proxy_http2_canon(request_rec *r, char *url) + * We have a raw control character or a ' ' in r->args. + * Correct encoding was missed. + */ +- ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO() ++ ap_log_rerror(APLOG_MARK, APLOG_ERR, 0, r, APLOGNO(10412) + "To be forwarded query string contains control " + "characters or spaces"); + return HTTP_FORBIDDEN; +-- +2.27.0 + diff --git a/backport-handled-a-negative-value-when-parsing-the-config.patch b/backport-handled-a-negative-value-when-parsing-the-config.patch new file mode 100644 index 0000000..2558dec --- /dev/null +++ b/backport-handled-a-negative-value-when-parsing-the-config.patch @@ -0,0 +1,38 @@ +From b2d18fb704c64ce7767e07fe546eecec98c91b50 Mon Sep 17 00:00:00 2001 +From: Eirc Covener +Date: Fri, 27 Jan 2023 08:58:03 PM GMT+0800 +Subject: [PATCH] mod_ldap: LDAPConnectionPoolTTL should accept negative values in order to + allow connections of any age to be reused. Up to now, a negative value + was handled as an error when parsing the configuration file + +Conflict:NA +Reference:https://github.com/apache/httpd/commit/b2d18fb704c64ce7767e07fe546eecec98c91b50 + +--- + modules/ldap/util_ldap.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/modules/ldap/util_ldap.c b/modules/ldap/util_ldap.c +index 4d92ec9..14b774a 100644 +--- a/modules/ldap/util_ldap.c ++++ b/modules/ldap/util_ldap.c +@@ -2752,12 +2752,14 @@ static const char *util_ldap_set_conn_ttl(cmd_parms *cmd, + void *dummy, + const char *val) + { +- apr_interval_time_t timeout; ++ apr_interval_time_t timeout = -1; + util_ldap_state_t *st = + (util_ldap_state_t *)ap_get_module_config(cmd->server->module_config, + &ldap_module); + +- if (ap_timeout_parameter_parse(val, &timeout, "s") != APR_SUCCESS) { ++ /* Negative values mean AP_LDAP_CONNPOOL_INFINITE */ ++ if (val[0] != '-' && ++ ap_timeout_parameter_parse(val, &timeout, "s") != APR_SUCCESS) { + return "LDAPConnectionPoolTTL has wrong format"; + } + +-- +2.27.0 + diff --git a/httpd.spec b/httpd.spec index 9c93b97..f10eb5d 100644 --- a/httpd.spec +++ b/httpd.spec @@ -8,7 +8,7 @@ Name: httpd Summary: Apache HTTP Server Version: 2.4.51 -Release: 15 +Release: 18 License: ASL 2.0 URL: https://httpd.apache.org/ Source0: https://archive.apache.org/dist/httpd/httpd-%{version}.tar.bz2 @@ -68,7 +68,7 @@ Patch14: backport-layout_add_openEuler.patch Patch15: backport-httpd-2.4.43-gettid.patch Patch16: backport-httpd-2.4.43-r1861793+.patch Patch17: backport-httpd-2.4.48-r1828172+.patch -Patch18: backport-httpd-2.4.46-htcacheclean-dont-break.patch +Patch18: backport-httpd-2.4.46-htcacheclean-dont-break.patch Patch19: backport-CVE-2022-22719.patch Patch20: backport-CVE-2022-22720.patch Patch21: backport-CVE-2022-22721.patch @@ -76,7 +76,7 @@ Patch22: backport-001-CVE-2022-23943.patch Patch23: backport-002-CVE-2022-23943.patch Patch24: backport-CVE-2021-44790.patch Patch25: backport-001-CVE-2021-44224.patch -Patch26: backport-002-CVE-2021-44224.patch +Patch26: backport-002-CVE-2021-44224.patch Patch27: backport-Switch-from-PCRE-to-PCRE2.patch Patch28: backport-CVE-2022-28615.patch Patch29: backport-CVE-2022-31813.patch @@ -100,6 +100,14 @@ Patch46: backport-CVE-2022-37436.patch Patch47: backport-open-the-lock-database-read-only-when-possible.patch Patch48: backport-CVE-2023-27522.patch Patch49: backport-CVE-2023-25690.patch +Patch50: backport-Report-an-error-if-the-AJP-backend-sends-an-invalid-number-of-headers.patch +Patch51: backport-handled-a-negative-value-when-parsing-the-config.patch +Patch52: backport-avoid-delimiting-the-query-with-a-backreference.patch +Patch53: backport-fix-missing-APLOGNO.patch +Patch54: backport-Fix-double-encoding-of-the-uri-path-of-the-request.patch +Patch55: backport-do-not-match-the-extention-against-possible-query-string.patch +Patch56: backport-Do-not-double-encode-encoded-slashes.patch +Patch57: backport-Check-before-forwarding-that-a-nocanon-path-has-not-been-rewritten.patch BuildRequires: gcc autoconf pkgconfig findutils xmlto perl-interpreter perl-generators systemd-devel BuildRequires: zlib-devel libselinux-devel lua-devel brotli-devel @@ -216,6 +224,10 @@ sed 's/@MPM@/%{mpm}/' < $RPM_SOURCE_DIR/httpd.service.xml \ xmlto man ./httpd.service.xml %build +%ifarch loongarch64 sw_64 +%_update_config_guess +%_update_config_sub +%endif rm -rf srclib/{apr,apr-util,pcre} autoheader && autoconf || exit 1 @@ -532,6 +544,30 @@ exit $rv %{_rpmconfigdir}/macros.d/macros.httpd %changelog +* Wed Aug 09 2023 panchenbo - 2.4.51-18 +- Type:bugfix +- ID: +- SUG:NA +- DESC:add sw_64 support,optimize sw build patch,add loongarch64 support + +* Wed May 24 2023 chengyechun - 2.4.51-17 +- Type:bugfix +- ID: +- SUG:restart +- DESC:Fix double encoding of the uri-path of the request + Do not match the extention against possible query string + Do not double encode slashes + Check before forwarding that a nocanon path has not been rewriteen + +* Fri Apr 14 2023 chengyechun - 2.4.51-16 +- Type:bugfix +- ID: +- SUG:restart +- DESC:Report an error if the AJP backend sends an invalid number of headers + handled a negative value when parsing the config + avoid delimiting the query with a backreference + fix missing APLOGNO + * Fri Mar 10 2023 chengyechun - 2.4.51-15 - Type:CVE - ID:CVE-2023-27522, CVE-2023-25690 @@ -723,7 +759,7 @@ exit $rv - Type:bugfix - ID:NA - SUG:NA -- DESC:add SSLCipherSuite +- DESC:add SSLCipherSuite * Sat Jan 11 2020 openEuler Buildteam - 2.4.34-13 - Type:NA