[core] behavior change: stricter URL normalization
behavior change: stricter URL normalization
Prior behavior can be obtained by configuring lighttpd.conf with:
server.http-parseopts = (“url-normalize” => “disable” )
although this is not recommended.
This behavior change was pre-announced with the releases of
lighttpd 1.4.52 (2018.11.28)
lighttpd 1.4.53 (2019.01.27)
The recommended settings are:
server.http-parseopts = (
"header-strict" => "enable",
"host-strict" => "enable",
"host-normalize" => "enable",
"url-normalize" => "enable",
"url-normalize-unreserved" => "enable",
"url-normalize-required" => "enable",
"url-ctrls-reject" => "enable",
"url-path-2f-decode" => "enable",
"url-path-backslash-trans" => "enable",
"url-path-dotseg-remove" => "enable",
"url-query-20-plus" => "enable"
)
The lighttpd defaults with this commit are slightly less strict:
server.http-parseopts = (
"header-strict" => "enable",
"host-strict" => "enable",
"host-normalize" => "enable",
"url-normalize" => "enable",
"url-normalize-unreserved" => "enable",
#"url-normalize-required" => "enable",
"url-ctrls-reject" => "enable",
"url-path-2f-decode" => "enable",
#"url-path-backslash-trans" => "enable",
"url-path-dotseg-remove" => "enable",
#"url-query-20-plus" => "enable"
)