Project

General

Profile

Actions

Feature #2340

closed

decoding %2F in fastcgi PATH_INFO

Added by eddie over 13 years ago. Updated almost 9 years ago.

Status:
Fixed
Priority:
Normal
Category:
mod_fastcgi
Target version:
ASK QUESTIONS IN Forums:

Description

Currently lighttpd, like Apache decodes %2F to '/' in the PATH_INFO. This really brakes a lot of functionality in the fastcgi applications as they don't have the ability to distinguish between '/' and %2F. Say I have a path /one/two%2Fthree. If a fastcgi app tokenizes the PATH_INFO string between '/' before doing a url-decoding, this allows the "directory" names to themselves have '/' characters (one and two/three).

From what I understand, the purpose of url-encoding a character is to prevent it from being parsed in the url. I understand that a lot of applications out there may be dependent on this being broken, but apache has allowed this "brokenness" to be turned off with a "AllowEncodedSlashes NoDecode" directive in the configuration.

I develop the fastcgi++ library and am trying to move toward having the path info stored in a tokenized container as explained above. Unfortunately, this is totally broken when used with lighttpd because of this issue.

Is there any chance this will ever be changed? Does the architecture make such a change difficult or would it be simple? Any advice on pursuing such a modification?

#3

Updated by gstrauss about 9 years ago

  • Tracker changed from Bug to Feature
#5

Updated by gstrauss almost 9 years ago

  • Status changed from New to Fixed
  • Target version set to 1.4.40
Actions

Also available in: Atom