IntenseWebs/nginx
3
0
Fork 0
mirror of https://github.com/nginx/nginx.git synced 2024-12-19 05:33:52 -06:00
Code Issues Packages Projects Releases Wiki Activity

fix "/dir/%3F../" and "/dir/%23../" cases

Browse Source
This commit is contained in:
Igor Sysoev 2010-06-04 16:05:55 +00:00
parent 04e1156d2e
commit 4cf7f2727d
1 changed files with 3 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
src/http/ngx_http_parse.c
View File

@ -1187,16 +1187,11 @@ ngx_http_parse_complex_uri(ngx_http_request_t *r, ngx_uint_t merge_slashes)
if (ch >= '0' && ch <= '9') { if (ch >= '0' && ch <= '9') {
ch = (u_char) ((decoded << 4) + ch - '0'); ch = (u_char) ((decoded << 4) + ch - '0');
if (ch == '%') { if (ch == '%' || ch == '#') {
state = sw_usual; state = sw_usual;
*u++ = ch; *u++ = ch;
ch = *p++; ch = *p++;
break; break;
}
if (ch == '#') {
*u++ = ch;
ch = *p++;
} else if (ch == '\0') { } else if (ch == '\0') {
return NGX_HTTP_PARSE_INVALID_REQUEST; return NGX_HTTP_PARSE_INVALID_REQUEST;
@ -1211,8 +1206,10 @@ ngx_http_parse_complex_uri(ngx_http_request_t *r, ngx_uint_t merge_slashes)
ch = (u_char) ((decoded << 4) + c - 'a' + 10); ch = (u_char) ((decoded << 4) + c - 'a' + 10);
if (ch == '?') { if (ch == '?') {
state = sw_usual;
*u++ = ch; *u++ = ch;
ch = *p++; ch = *p++;
break;
} else if (ch == '+') { } else if (ch == '+') {
r->plus_in_uri = 1; r->plus_in_uri = 1;