Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
Received-SPF: pass (nike.apache.org: message received from 54.76.25.247 which
 is an MX secondary for dev@httpd.apache.org)
From: =?iso-8859-1?q?Andr=E9_Malo?= <nd@perlig.de>
Organization: TIMTOWTDI
To: dev@httpd.apache.org
Subject: Re: *Match, RewriteRule POLA violation?
Date: Fri, 1 May 2015 17:52:45 +0200
User-Agent: KMail/1.9.10
References: <CB72B91C-7F3D-4C34-81C3-108EB323EA94@riggs.me>
 <CAKQ1sVN8BZ_x-3-z7bj72Y+0v1jq0_nahV9cSB=XAMESF5NaOg@mail.gmail.com>
 <alpine.GSO.2.02.1505011728340.6893@hatchepsut.acc.umu.se>
In-Reply-To: <alpine.GSO.2.02.1505011728340.6893@hatchepsut.acc.umu.se>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
Message-Id: <201505011752.45430@news.perlig.de>

* Niklas Edmundsson wrote:

> On Thu, 30 Apr 2015, Yann Ylavic wrote:
> > On Thu, Apr 30, 2015 at 2:57 PM, Jim Riggs <apache-lists@riggs.me> 
wrote:
> >> Thanks, Yann. I remember looking at this code before. The question
> >> remains, though: Is it currently "wrong"? Does it need to be "fixed",
> >> or was this distinction made intentionally? Is there a specific use
> >> case that requires the regex-matching directives to not get
> >> slash-normalized URIs?
> >
> > I would like it to be fixed, non leading "/+" is equivalent to "/",
> > this would break very few (if any) cases IMHO, and may even unbreak
> > more ones .
>
> +1
>
> I would expect Location and LocationMatch using the same uri for
> comparison.

Hmm, that assumption is wrong by definition. Location always matches a 
prefix (a part of a parsed/unparsed url), while LocationMatch always 
matches the complete URL.

> I would actually go so far as the current state might 
> warrant a CVE for being a hidden security risk that might cause
> inadvertent information exposure.

It *is* documented right here, btw: 
http://httpd.apache.org/docs/2.4/mod/core.html#location

(found it, eventually...)

nd
-- 
"Umfassendes Werk (auch fuer Umsteiger vom Apache 1.3)"
                                          -- aus einer Rezension

<http://pub.perlig.de/books.html#apache2>