[RFE] Add the "NoDecode" option to the AllowEncodeSlashes directive in httpd
Issue
[RFE] Add "NoDecode" option to AllowEncodeSlashes directive.
The AllowEncodedSlashes directive currently supports "yes|no" in the latest available version for RHEL6: httpd-2.2.15-29.el6. In the upstream version httpd-2.2.18, a third option "NoDecode" was added to that directive. Upstream apache documentation
Add that third option added as a supported option to the AllowEncodedSlashes directive to address security concerns over not using NoDecode
As noted in the upstream documentation,
"Note: If encoded slashes are needed in path info, use of NoDecode is strongly recommended as a security measure.Allowing slashes to be decoded could potentially allow unsafe path"
This would affect the httpd package as well as the associated httpd-manual documentation package.
Environment
Red Hat Enterprise Linux 6
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.
