Ticket #1253 (new defect)

Opened 1 year ago

Last modified 9 months ago

underline in http address causes a 400 - Bad Request error example http://my_web.com.br

Reported by: itamar@ispbrasil.com.br Assigned to: jan
Priority: high Milestone: 1.5.0
Component: core Version: 1.4.18
Severity: blocker Keywords:
Cc: itamar@ispbrasil.com.br Blocking:
Need Feedback: 0

Description

underline in http address causes a 400 - Bad Request error example http://my_web.com.br

I have tested this and in apache works fine.

http://www.google.com.br/search?q=site%3Ahipermusicas.com&ie=utf-8&oe=utf-8&aq=t&rls=org.mozilla:pt-BR:official&client=firefox-a

Attachments

Change History

07/06/2007 07:26:47 PM changed by anonymous

Underscore is not a valid character in a hostname. See http://tools.ietf.org/html/rfc952.

07/06/2007 07:38:31 PM changed by itamar@ispbrasil.com.br

and lighttpd works only with hostname ? the dns accept underscore

take a look on rfc1033

http://www.faqs.org/rfcs/rfc1033.html

"A-Z", "a-z", "0-9", dash and underscore

07/09/2007 12:03:06 PM changed by anonymous coward

Underscore is not an option. RFC 1033 is wrong about this, and it's only some guideline paper, anyway, so there's no relevance here. I'd say that lighty's response 400 is pretty clean and straight forward.

09/18/2007 09:01:45 PM changed by flycker

i have the same problem with underlines..

09/19/2007 12:27:11 AM changed by jrabbit

What is and isn't valid in DNS is completely irrelevant (almost), as is what is and isn't valid on the Internet - who says a server has to be on the Internet or have its name resolved using DNS?

For lighttpd to satisfy the standards regarding hostnames, the only thing it should comply with is the HTTP specification for the host portion of a URI. The HTTP 1.1 specification references RFC 2396 for this, which defines the host portion of an HTTP URI as complying with section 3 of the DNS specification in RFC 1034, which in turn says letters, numbers and hyphen with no label being more than 63 characters and the entire name being no more than 255 characters. Therefore, by this definition "_" is invalid.

However, RFC 2396 was obseleted in 2005 by RFC 3986 which extends the set of characters that are valid in the host portion of a URI to:

A-Z / a-z / 0-9 / "-" / "." / "_" / "~" / "!" / 
"$" / "&" / "'" / "(" / ")" / "*" / "+" / "," / 
";" / "=" and a "%" followed by two hex digits.

No updates to HTTP have been published since then, and I'm not sure what the rules are - if RFC A references RFC B which is obseleted by RFC C, does that mean applications conforming to RFC A now must comply with RFC C? If so, "_" should be allowed.

From a practical standpoint, lighttpd can run on a local Windows network and URLs can contain Windows hostnames instead of DNS names, so I think it should be supported.

09/19/2007 08:45:27 AM changed by tiagofischer@gmail.com

  • version changed from 1.4.15 to 1.4.18.
  • severity changed from normal to blocker.

This is my case:

I use willcard dns record to all my subdomains. I have a free forum creating site, and the users can put "_" in theirs forum name, who will be the name of subdomain. (my_forum.mysite.com) Maybe its my fault to allowed that.. but it's works. With apache works too.. i thinking on change to "-", but i have a loot of subdomains in this case and more then 20 billions pageviews per month. It will be a loot of trouble to change.. Its a practical case, and i cannot use lighty because this.. falling back to apache.

Examples: http:// gg_lunaticos dot queroumforum dot com http:// escorts_pt dot queroumforum dot com http:// dj_victor_x_forum dot iwannaforum dot com

Thanks and sorry for bad english.

09/28/2007 01:47:14 PM changed by flycker

Can you show me where i need to change this in the source? I wondering to change this before compile.. then i can use!

Thanks

10/01/2007 02:17:57 PM changed by anonymous

It's not the best solution.. but its work to fix my problem:

Examples:

http:// gg_lunaticos .queroumforum.com
http:// _teste .queroumforum.com
http:// teste2_ .queroumforum.com
http:// teste_teste .queroumforum.com

Diff:

106c106
< if (!light_isalpha(host->ptr[i+1])) {
---

if (!light_isalpha(host->ptr[i+1]) && '_' != host->ptr[i+1]) {

128c128
< if (!light_isalpha(c)) {
---

if (!light_isalpha(c) && '_' != c) {

133c133
< if (c != '-' && !light_isalnum(c)) {
---

if (c != '_' && c != '-' && !light_isalnum(c)) {

171c171
< if (!light_isalnum(c)) {
---

if (!light_isalnum(c) && c != '_') {

176c176
< if (c != '-' && !light_isalnum(c)) {
---

if (c != '_' && c != '-' && !light_isalnum(c)) {


Add/Change #1253 (underline in http address causes a 400 - Bad Request error example http://my_web.com.br)




Change Properties