00795d8d53
splitting (CVE-2023-38709)
75 lines
3.2 KiB
Diff
75 lines
3.2 KiB
Diff
diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
|
|
index 393343a..16cb23c 100644
|
|
--- a/modules/http/http_filters.c
|
|
+++ b/modules/http/http_filters.c
|
|
@@ -1348,6 +1348,9 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
|
|
*/
|
|
apr_table_clear(r->headers_out);
|
|
apr_table_clear(r->err_headers_out);
|
|
+ r->content_type = r->content_encoding = NULL;
|
|
+ r->content_languages = NULL;
|
|
+ r->clength = r->chunked = 0;
|
|
apr_brigade_cleanup(b);
|
|
|
|
/* Don't recall ap_die() if we come back here (from its own internal
|
|
@@ -1364,8 +1367,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
|
|
APR_BRIGADE_INSERT_TAIL(b, e);
|
|
e = apr_bucket_eos_create(c->bucket_alloc);
|
|
APR_BRIGADE_INSERT_TAIL(b, e);
|
|
- r->content_type = r->content_encoding = NULL;
|
|
- r->content_languages = NULL;
|
|
ap_set_content_length(r, 0);
|
|
recursive_error = 1;
|
|
}
|
|
@@ -1392,6 +1393,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
|
|
if (!apr_is_empty_table(r->err_headers_out)) {
|
|
r->headers_out = apr_table_overlay(r->pool, r->err_headers_out,
|
|
r->headers_out);
|
|
+ apr_table_clear(r->err_headers_out);
|
|
}
|
|
|
|
/*
|
|
@@ -1411,6 +1413,17 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
|
|
fixup_vary(r);
|
|
}
|
|
|
|
+
|
|
+ /*
|
|
+ * Control cachability for non-cacheable responses if not already set by
|
|
+ * some other part of the server configuration.
|
|
+ */
|
|
+ if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) {
|
|
+ char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN);
|
|
+ ap_recent_rfc822_date(date, r->request_time);
|
|
+ apr_table_addn(r->headers_out, "Expires", date);
|
|
+ }
|
|
+
|
|
/*
|
|
* Now remove any ETag response header field if earlier processing
|
|
* says so (such as a 'FileETag None' directive).
|
|
@@ -1423,6 +1436,7 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
|
|
basic_http_header_check(r, &protocol);
|
|
ap_set_keepalive(r);
|
|
|
|
+ /* 204/304 responses don't have content related headers */
|
|
if (AP_STATUS_IS_HEADER_ONLY(r->status)) {
|
|
apr_table_unset(r->headers_out, "Transfer-Encoding");
|
|
apr_table_unset(r->headers_out, "Content-Length");
|
|
@@ -1465,16 +1479,6 @@ AP_CORE_DECLARE_NONSTD(apr_status_t) ap_http_header_filter(ap_filter_t *f,
|
|
apr_table_setn(r->headers_out, "Content-Language", field);
|
|
}
|
|
|
|
- /*
|
|
- * Control cachability for non-cacheable responses if not already set by
|
|
- * some other part of the server configuration.
|
|
- */
|
|
- if (r->no_cache && !apr_table_get(r->headers_out, "Expires")) {
|
|
- char *date = apr_palloc(r->pool, APR_RFC822_DATE_LEN);
|
|
- ap_recent_rfc822_date(date, r->request_time);
|
|
- apr_table_addn(r->headers_out, "Expires", date);
|
|
- }
|
|
-
|
|
/* This is a hack, but I can't find anyway around it. The idea is that
|
|
* we don't want to send out 0 Content-Lengths if it is a head request.
|
|
* This happens when modules try to outsmart the server, and return
|