When %26 and %20 are in the same URL, mod_proxy with SSL unescapes encoded chars when it shouldn't

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Dear apache group: I have a strange issue.

Rhel 5
Apache 2.2.21 (Unix)
httpd.conf http://pastebin.com/EpkZtUCM
httpd-ssl.conf http://pastebin.com/vUk0yV4F 

I am proxying to a backend tomcat server, the SSL terminates at apache.

When downloading a file from Tomcat through the SSL proxy, if the URL has any combination of %26 and %20, the URLs are escaped incorrectly and result in 404 errors.

Example:

Tomcat file: webapps/ndd/document-1.1.2222/a&b Test.txt
Apache URL: https://uat.ndipiazza.com/ndd/document-1.1.2222/a%26b%20Test.txt

Results in 404 error: https://uat.ndipiazza.com/ndd/document-1.1.2222/a&b Test.txt
(Ampersand was unescaped so the path is all wrong now by the time it gets to Tomcat)

If you remove HTTPS, it works.
If you hit the file on Tomcat directly, it works.
If you remove the %20 from the filename, it works.
Cannot replicate the behavior on any other server but this one!

Very strange.

Anyone have any idea what this might be? How I might work around this or fix it? 

-Nicholas 


---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx
For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx




[Index of Archives]     [Open SSH Users]     [Linux ACPI]     [Linux Kernel]     [Linux Laptop]     [Kernel Newbies]     [Security]     [Netfilter]     [Bugtraq]     [Squid]     [Yosemite News]     [MIPS Linux]     [ARM Linux]     [Linux Security]     [Linux RAID]     [Samba]     [Video 4 Linux]     [Device Mapper]

  Powered by Linux