[TS-1981] Url remap method filtering is broken with invalid method

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 5.0.0
• Component/s: Configuration, Security
• Labels: review
• Assignee: Brian Geffon
• Reporter: Thach Tran
• Created: 27/Jun/13 15:11
• Updated: 22/Dec/15 19:40
• Resolved: 30/May/14 20:54

Description

ACL filtering based on HTTP's method is ignored if method received from client is invalid.

To reproduce, with the default 8080 server_ports configure the remap.conf as follows.

map http://localhost:8080/ http://www.google.com/ @method=GET

Then run the following curl command.

$ curl -v -X AAAAAA http://localhost:8080/

Notice that a 200 OK response is received by the client with some (empty) HTML from google.com.

If the following curl command is issued instead

$ curl -v -X PUT http://localhost:8080/

One will see that TS sends back a 403 Access Denied as expected.

Issue Links

• is related to: TS-4098 Remap filtering isn't working to only allow certain methods