httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Joe Orton <jor...@redhat.com>
Subject Re: Backslashes in HTTP Headers
Date Tue, 02 Oct 2007 11:52:27 GMT
On Mon, Oct 01, 2007 at 02:01:24AM +0100, Nick Kew wrote:
> Coadvisor has several testcases involving a Content-Type line with 
> a lot of qualifier tokens.  These tokens are quoted strings and
> include backslashes.  This is going to wrap when I cut&paste:
> 
> Content-Type: text/other; charset=ISO-8859-4; attribute=value; q=0.9;
> q=9.0000  ; a="quoted text/html"; a="quoted, list=b"; a="quoted \r\n
> new line"; a="quoted \r\n\t\r\n new lines"; a="slashed \alpha";
> a="slashed \\nnew line"; a="slashed \\r\\ncrlf"; a="slashed \\n\\nnew
> lines"; a="slashed \"string"; a-rvlmxgisq=v-r808478;
> a-rtbtrjxmwqirv=v-r797440; a-rwsqj=v-r9946045539;
> a-rkdrdmk=v-r93968576355\r\n
> 
> Our ap_rgetline_core is seeing those quoted \-r-\-n sequences as
> newlines and getting hopelessly confused (the outcome is 400
> in the case of a request header, 502 from a response).

For exactly what request does the server give a 400, and what error is 
given (attach or reference to avoid line-wrapping if necessary)?  I 
doubt there is any code in the server which will backslash-expand header 
values as you describe; certainly ap_rgetline_core doesn't do it.

joe

Mime
View raw message