https://bz.apache.org/bugzilla/show_bug.cgi?id=69994
--- Comment #2 from abernal <[email protected]> --- Confirmed the exact claim: ap_normalize_path()'s return value is checked at server/request.c:214 but silently discarded at the identical call around line 273 (the re-normalization after decoding %2f, only reached with AllowEncodedSlashes on). ap_normalize_path() already prevents the actual escape internally (it drops the offending ".." rather than writing above the root, see the "Already at root, ignore and return a failure if asked to" branch in server/util.c), so this is not a live traversal, matching what was reported here. Reproduced against a real build: a path like /a/..%2f..%2fb.html on a vhost with AllowEncodedSlashes on is silently served (200, wrong file, nothing logged) instead of getting the same 400 a plain ".." already gets. Fix and a regression test are available as a pull request: https://github.com/apache/httpd/pull/917 -- You are receiving this mail because: You are the assignee for the bug. --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
