Project

General

Profile

Feature #869

Problems with (dumb?) HTTP request lines containing an URI fragment part (#...)

Added by Anonymous over 12 years ago. Updated about 12 years ago.

Status:
Fixed
Priority:
Normal
Assignee:
-
Category:
core
Target version:
Start date:
Due date:
% Done:

0%

Estimated time:
Missing in 1.5.x:

Description

If a client sends a fragment part within the request URI (although RFC 2616, 3.2.2 seems to say that the last part of the HTTP URL is the query part), lighty might be a little bit too strict. Consequences are (for example):


$ curl 'www.lighttpd.net/' -s -D - | grep HTTP/1.1
HTTP/1.1 200 OK
$ curl 'www.lighttpd.net/#' -s -D - | grep HTTP/1.1
HTTP/1.1 404 Not Found

uri.query contains everything after a '?' within the requested URL, so the fragment part would be part of uri.query, which should not be (see RFC 2396, Appendix A).
This affects CGI, because the QUERY_STRING environment variable is set to uri.query, but only an URI query part is expected (CGI Spec. 6.1.8).

-- MarcusSt

Associated revisions

Revision 1366 (diff)
Added by jan over 12 years ago

remove fragments from the request-uri (fixes #869)

Revision 55c90e4c (diff)
Added by jan over 12 years ago

remove fragments from the request-uri (fixes #869)

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@1366 152afb58-edef-0310-8abb-c4023f1b3aa9

History

#1

Updated by jan over 12 years ago

  • Status changed from New to Assigned
#2

Updated by jan over 12 years ago

  • Status changed from Assigned to Fixed
  • Resolution set to fixed

fixed in r1366

Also available in: Atom