[RFE] Add the "NoDecode" option to the AllowEncodeSlashes directive in httpd

Solution Verified - Updated -

Issue

[RFE] Add "NoDecode" option to AllowEncodeSlashes directive.

The AllowEncodedSlashes directive currently supports "yes|no" in the latest available version for RHEL6: httpd-2.2.15-29.el6. In the upstream version httpd-2.2.18, a third option "NoDecode" was added to that directive. Upstream apache documentation

Add that third option added as a supported option to the AllowEncodedSlashes directive to address security concerns over not using NoDecode

As noted in the upstream documentation,

"Note: If encoded slashes are needed in path info, use of NoDecode is strongly recommended as a security measure.Allowing slashes to be decoded could potentially allow unsafe path"

This would affect the httpd package as well as the associated httpd-manual documentation package.

Environment

Red Hat Enterprise Linux 6

Subscriber exclusive content

A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.

Current Customers and Partners

Log in for full access

Log In

New to Red Hat?

Learn more about Red Hat subscriptions

Using a Red Hat product through a public cloud?

How to access this content