[RFE] Add the "NoDecode" option to the AllowEncodeSlashes directive in httpd
Issue
[RFE] Add "NoDecode" option to AllowEncodeSlashes directive.
The AllowEncodedSlashes directive currently supports "yes|no" in the latest available version for RHEL6: httpd-2.2.15-29.el6. In the upstream version httpd-2.2.18, a third option "NoDecode" was added to that directive. Upstream apache documentation
Add that third option added as a supported option to the AllowEncodedSlashes directive to address security concerns over not using NoDecode
As noted in the upstream documentation,
"Note: If encoded slashes are needed in path info, use of NoDecode is strongly recommended as a security measure.Allowing slashes to be decoded could potentially allow unsafe path"
This would affect the httpd package as well as the associated httpd-manual documentation package.
Environment
Red Hat Enterprise Linux 6
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.