Problems with (dumb?) HTTP request lines containing an URI fragment part (#...)

[MarcusSt]

If a client sends a fragment part within the request URI (although RFC 2616, 3.2.2 seems to say that the last part of the HTTP URL is the query part), lighty might be a little bit too strict. Consequences are (for example):

$ curl 'www.lighttpd.net/' -s -D - | grep HTTP/1.1
HTTP/1.1 200 OK
$ curl 'www.lighttpd.net/#' -s -D - | grep HTTP/1.1
HTTP/1.1 404 Not Found

uri.query contains everything after a '?' within the requested URL, so the fragment part would be part of uri.query, which should not be (see RFC 2396, Appendix A). This affects CGI, because the QUERY_STRING environment variable is set to uri.query, but only an URI query part is expected (CGI Spec. 6.1.8).

[jan]

fixed in [1366]