mirror of
http://git.haproxy.org/git/haproxy.git/
synced 2025-03-01 09:00:51 +00:00
62ba9ba6ca
The url_decode() function used by the url_dec converter and a few other call points is ambiguous on its processing of the '+' character which itself isn't stable in the spec. This one belongs to the reserved characters for the query string but not for the path nor the scheme, in which it must be left as-is. It's only in argument strings that follow the application/x-www-form-urlencoded encoding that it must be turned into a space, that is, in query strings and POST arguments. The problem is that the function is used to process full URLs and paths in various configs, and to process query strings from the stats page for example. This patch updates the function to differentiate the situation where it's parsing a path and a query string. A new argument indicates if a query string should be assumed, otherwise it's only assumed after seeing a question mark. The various locations in the code making use of this function were updated to take care of this (most call places were using it to decode POST arguments). The url_dec converter is usually called on path or url samples, so it needs to remain compatible with this and will default to parsing a path and turning the '+' to a space only after a question mark. However in situations where it would explicitly be extracted from a POST or a query string, it now becomes possible to enforce the decoding by passing a non-null value in argument. It seems to be what was reported in issue #585. This fix may be backported to older stable releases. |
||
|---|---|---|
| .. | ||
| base64.h | ||
| buf.h | ||
| buffer.h | ||
| cfgparse.h | ||
| chunk.h | ||
| compat.h | ||
| compiler.h | ||
| config.h | ||
| debug.h | ||
| defaults.h | ||
| errors.h | ||
| fcgi.h | ||
| h1.h | ||
| h2.h | ||
| hash.h | ||
| hathreads.h | ||
| hpack-dec.h | ||
| hpack-enc.h | ||
| hpack-huff.h | ||
| hpack-tbl.h | ||
| http-hdr.h | ||
| http.h | ||
| htx.h | ||
| initcall.h | ||
| ist.h | ||
| istbuf.h | ||
| memory.h | ||
| mini-clist.h | ||
| namespace.h | ||
| net_helper.h | ||
| openssl-compat.h | ||
| regex.h | ||
| standard.h | ||
| template.h | ||
| ticks.h | ||
| time.h | ||
| tools.h | ||
| uri_auth.h | ||
| version.h | ||
| xref.h | ||