Remove restriction preventing expressions in Redirects outside of <Location>#540
Remove restriction preventing expressions in Redirects outside of <Location>#540robertmathews wants to merge 1 commit intoapache:trunkfrom
Conversation
…cts outside of <Location>
Currently, it's not possible to use expression syntax like this in (say) .htaccess files:
<If "%{HTTPS} != 'on'">
Redirect 301 https://%{HTTP_HOST}%{REQUEST_URI}
</If>
You have to instead use a much uglier RewriteCond/RewriteRule.
The reason it doesn't work is not because the code doesn't exist, but because mod_alias.c restricts expressions in redirects to "<Location> context only for now".
It's not clear why that restriction was/is needed. I asked if anyone knew the reason for it on the httpd dev mailing list in 2022, but nobody replied:
https://lists.apache.org/thread/m72z147c3rffpk7goy7n0z66l7jw16lc
My company has been running this patch on many production servers for three years with no trouble. It allows the above example to work as expected from a .htaccess file, which seems generally useful and in accordance with the "ongoing effort to only use a single variant, called ap_expr, for all configuration directives".
|
I'm wondering if anyone knows of a security-related reason why this should not be implemented? @ylavic, you added the If it's not secure, I'd like to stop using the patch myself and remove this pull request. |
|
Digging in the archives[1] (my memory fails at 10y ago) it seems that allowing expressions outside where the regular expression is a match rather than the redirected URL.
[1] https://lists.apache.org/thread/omk0bgf3h649tz62qblw1112kbl7p10n |
Thank you, that makes sense. I will ponder if there's a way to avoid this issue. Thanks for your time! |
|
Could we use the expr=... prefix like used elsewhere? |
3 participants
Currently, it's not possible to use expression syntax like this in (say) .htaccess files:
You have to instead use a much uglier RewriteCond/RewriteRule.
The reason it doesn't work is not because the code doesn't exist, but because mod_alias.c restricts expressions in redirects to
<Location> context only for now.It's not clear why that restriction was/is needed. I asked if anyone knew the reason for it on the httpd dev mailing list in 2022, but nobody replied: https://lists.apache.org/thread/m72z147c3rffpk7goy7n0z66l7jw16lc
My company has been running this patch on many production servers for three years with no trouble. It allows the above example to work as expected from a .htaccess file, which seems generally useful and in accordance with the "ongoing effort to only use a single variant, called ap_expr, for all configuration directives".