httpd-cvs mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
Subject svn commit: r1179266 - /httpd/httpd/trunk/docs/manual/rewrite/flags.xml
Date Wed, 05 Oct 2011 15:36:56 GMT
Author: jorton
Date: Wed Oct  5 15:36:56 2011
New Revision: 1179266

- add a security warning, and tweak the example, in light of CVE-2011-3368


Modified: httpd/httpd/trunk/docs/manual/rewrite/flags.xml
--- httpd/httpd/trunk/docs/manual/rewrite/flags.xml (original)
+++ httpd/httpd/trunk/docs/manual/rewrite/flags.xml Wed Oct  5 15:36:56 2011
@@ -482,7 +482,7 @@ example, if you wanted all image request
 image server, you might do something like the following:</p>
-RewriteRule (.*)\.(jpg|gif|png)$1.$2 [P]
+RewriteRule /(.*)\.(jpg|gif|png)$1.$2 [P]
 <p>Use of the [P] flag implies [L] - that is, the request is immediately
@@ -498,6 +498,15 @@ more powerful implementation of the <dir
 module="mod_proxy">ProxyPass</directive> directive,
 to map remote content into the namespace of the local server.</p>
+<note type="warning">
+<title>Security Warning</title>
+<p>Take care when constructing the target URL of the rule, considering
+the security impact from allowing the client influence over the set of
+URLs to which your server will act as a proxy.  Ensure that the scheme
+and hostname part of the URL is either fixed, or does not allow the
+client undue influence.</p>
 <p>Note: <module>mod_proxy</module> must be enabled in order
 to use this flag.</p>

View raw message