-
Bug
-
Resolution: Done
-
Major
-
1.1.3.Final, 1.2.0.Final
-
None
Current version of get_path_param doesn't expect ';' as path parameters separator so this urls are not correctly handled:
/test.jsp;jsessionid=123123.NODE01;name=vale
See for instance the mod_proxy_balancer implementation (in httpd 2.2.21):
/* Retrieve the parameter with the given name * Something like 'JSESSIONID=12345...N' */ static char *get_path_param(apr_pool_t *pool, char *url, const char *name, int scolon_sep) { char *path = NULL; char *pathdelims = "?&"; if (scolon_sep) { pathdelims = ";?&"; } for (path = strstr(url, name); path; path = strstr(path + 1, name)) { path += strlen(name); if (*path == '=') { /* * Session path was found, get it's value */ ++path; if (strlen(path)) { char *q; path = apr_strtok(apr_pstrdup(pool, path), pathdelims, &q); return path; } } } return NULL; }
Severity of this bug to me is not so high since using more than one path parameters is not so common.
- is incorporated by
-
MODCLUSTER-461 If Session ID key stored in URL contains sticky session cookie name it it used for routing
- Resolved