Feature #2340
closeddecoding %2F in fastcgi PATH_INFO
Description
Currently lighttpd, like Apache decodes %2F to '/' in the PATH_INFO. This really brakes a lot of functionality in the fastcgi applications as they don't have the ability to distinguish between '/' and %2F. Say I have a path /one/two%2Fthree. If a fastcgi app tokenizes the PATH_INFO string between '/' before doing a url-decoding, this allows the "directory" names to themselves have '/' characters (one and two/three).
From what I understand, the purpose of url-encoding a character is to prevent it from being parsed in the url. I understand that a lot of applications out there may be dependent on this being broken, but apache has allowed this "brokenness" to be turned off with a "AllowEncodedSlashes NoDecode" directive in the configuration.
I develop the fastcgi++ library and am trying to move toward having the path info stored in a tokenized container as explained above. Unfortunately, this is totally broken when used with lighttpd because of this issue.
Is there any chance this will ever be changed? Does the architecture make such a change difficult or would it be simple? Any advice on pursuing such a modification?
Updated by gstrauss almost 9 years ago
- Status changed from New to Fixed
- Target version set to 1.4.40
Also available in: Atom