Good day,
In my handler hook I've implemented some code in an attempt to prevent this
attack. Unfortunately it doesn't take into account that there might be
spaces in the URL. Has anyone already overcome this or can provide a proper
solution?
Here is the code in question:
/* ensure r->uri and r->unparsed_uri are similar to prevent path traversal
attacks */
unparsed_uri = apr_pstrdup(r->pool, r->unparsed_uri);
/* get the unparsed base uri (everything up to '?') */
unparsed_uri_base = apr_strtok(unparsed_uri, "?", &buf);
buf = strstr(r->uri, unparsed_uri_base);
/*** ISSUE: If there is a space in the URL then r->uri will have the
encoded space as %20 and r->unparsed_uri will not */
/* compare unparsed base with parsed uri */
if(buf == NULL || strlen(r->uri) != strlen(buf)) {
error(
cfg,
"Malformed URI"
);
return HTTP_INTERNAL_SERVER_ERROR;
}
--
[image: Ping Identity logo] <https://www.pingidentity.com/>
Justin Kennedy
Sr. Development Engineer
@ jkenn...@pingidentity.com [image: phone] +1 604.697.7055 Connect with
us… [image: twitter logo] <https://twitter.com/pingidentity> [image:
youtube logo] <https://www.youtube.com/user/PingIdentityTV> [image:
LinkedIn logo] <https://www.linkedin.com/company/21870> [image: Facebook
logo] <https://www.facebook.com/pingidentitypage> [image: Google+ logo]
<https://plus.google.com/u/0/114266977739397708540> [image: slideshare logo]
<http://www.slideshare.net/PingIdentity> [image: flipboard logo]
<http://flip.it/vjBF7> [image: rss feed icon]
<https://www.pingidentity.com/blogs/>
