Re: mod_rewrite double escaping query strings

Tom Evans <tevans.uk@xxxxxxxxxxxxxx> · Thu, 02 Oct 2008 17:34:15 +0100

On Thu, 2008-10-02 at 16:41 +0100, Tom Evans wrote:
> Following up my own email, for the archive, the solution was to add flag
> NE to the RewriteRule.
> 
> Cheers
> 
> Tom

Keeping up my monologue, adding flag NE (no-escape) is still just half a
solution. For an example I created the file %.html in my documentroot,
with the vhost config as below:

  ServerName sweetums
  ServerAlias foofoo
  RewriteEngine On
  RewriteCond %{HTTP_HOST} !^sweetums$
  RewriteRule ^/(.*) http://sweetums/$1 [R=301,L]

I get the following behaviour:
http://foofoo/index.html => http://sweetums/index.html
http://foofoo/index.html?fo=%25 => http://sweetums/index.html?fo=%2525 
http://foofoo/%25.html => http://sweetums/%25.html 

So, it is correct for paths containing escaped characters, and incorrect
for query strings containing escaped characters.

If I modify the RewriteRule to add flag NE, then I get this behaviour:
http://foofoo/index.html => http://sweetums/index.html
http://foofoo/index.html?foo=%25 => http://sweetums/index.html?foo=%25 
http://foofoo/%25.html?foo=%25 => http://sweetums/%.html?foo=%25 (bad
request)

So this time, it is incorrect for paths containing escaped characters,
and correct for query strings containing escaped characters.

It seems I can either have the path escaped incorrectly, or the query
string escaped incorrectly, but there are no options to keep both path
and query strings correctly escaped as per the original request.

If someone knows a solution to this, please let me know! Otherwise, I
guess I'll be writing a hostname c14n module..

Cheers

Tom