Ignore malformed Cache-Control directives per RFC 7234 #12670
Conversation
bneradt
force-pushed
the
fix_malformed_cc_processing
branch
from
1590274 to
aacd81e
Compare
bneradt
changed the title
bneradt
force-pushed
the
fix_malformed_cc_processing
branch
4 times, most recently
from
882f78f to
26748d1
Compare
|
Not to prevent this one ... but is it worth doing a quick look at
|
Detect and ignore Cache-Control directives that are malformed (e.g., using semicolons instead of commas). When the parser cannot fully consume a Cache-Control directive value, leaving unparsed non-whitespace content, the directive is treated as unrecognized and ignored per RFC 7234 Section 5.2. For example, a malformed header such as 'public; max-age=30' (note the incorrect semicolon separator) would previously set the 'public' bit but ignore the unparsed 'max-age=30', causing the response to be cached with incorrect heuristic lifetimes. Not only is this incorrect per the RFC, but the intended max-age was, from the user's perspective, mysteriously ignored. Now the entire malformed directive is ignored, allowing default caching rules to apply correctly. Fixes: apache#12029
bneradt
force-pushed
the
fix_malformed_cc_processing
branch
from
26748d1 to
5daad76
Compare
Thank you @mlibbey . I updated the code for these conditions as well and beefed up the tests for it too. |
bneradt
force-pushed
the
fix_malformed_cc_processing
branch
from
5daad76 to
11d2a6e
Compare
zwoop
left a comment
zwoop
left a comment
There was a problem hiding this comment.
Looks good. Once landed, please do a cache-test comparison before / after this PR (compare master to 10.1 I guess?) and see that we only have fixes and no new defects.
| } | ||
| } | ||
|
|
||
| // Detect whether there is any more non-whitespace content after the |
There was a problem hiding this comment.
This feels little heavy on the comments, but oh well.
3 participants
Detect and ignore Cache-Control directives that are malformed (e.g.,
using semicolons instead of commas). When the parser cannot fully
consume a Cache-Control directive value, leaving unparsed non-whitespace
content, the directive is treated as unrecognized and ignored per RFC
7234 Section 5.2.
For example, a malformed header such as 'public; max-age=30' (note the
incorrect semicolon separator) would previously set the 'public' bit but
ignore the unparsed 'max-age=30', causing the response to be cached with
incorrect heuristic lifetimes. Not only is this incorrect per the RFC,
but the intended max-age was, from the user's perspective, mysteriously
ignored. Now the entire malformed directive is ignored, allowing default
caching rules to apply correctly.
Fixes: #12029