Opened 11 years ago

Closed 10 years ago

#316 closed enhancement (fixed)

X-Accel-Redirect should accept escaped URI

Reported by: Sergey Kandaurov Owned by:
Priority: minor Milestone:
Component: nginx-core Version: 1.3.x
Keywords: Cc:
uname -a:
nginx -V: nginx version: nginx/1.3.13
configure arguments: --prefix=/usr/local/etc/nginx --with-cc-opt='-I /usr/local/include' --with-ld-opt='-L /usr/local/lib' --conf-path=/usr/local/etc/nginx/nginx.conf --sbin-path=/usr/local/sbin/nginx --pid-path=/var/run/ --error-log-path=/var/log/nginx-error.log --user=www --group=www --with-debug --with-ipv6 --http-client-body-temp-path=/var/tmp/nginx/client_body_temp --http-fastcgi-temp-path=/var/tmp/nginx/fastcgi_temp --http-proxy-temp-path=/var/tmp/nginx/proxy_temp --http-scgi-temp-path=/var/tmp/nginx/scgi_temp --http-uwsgi-temp-path=/var/tmp/nginx/uwsgi_temp --http-log-path=/var/log/nginx-access.log --with-http_stub_status_module --with-pcre


When using the X-Accel-Redirect, it fails to send some files (returning a 404) because it does not URL-decode the requested path. It does work when the file name need not be URL-decoded.
The reason is that X-Accel-Redirect expected to contain non-encoded URI.
In particular this makes impossible to (normally) serve resources with '?' in name, as anything after '?' is treated as query string.

Correct fix would be to change X-Accel-Redirect to accept escaped URI instead.
X-Accel-Redirect value should be unescaped when it got from upstream, somewhere before ngx_http_internal_redirect() call.
Probably ngx_http_parse_unsafe_uri() should be changed to unescape uri.
The change of ngx_http_parse_unsafe_uri() will also positively affect dav and ssi modules.
There are several patches proposed by the community [2][3].


Change History (3)

comment:1 by André Cruz, 11 years ago

This is very important for me. Since currently x-accel breaks when URLs have UTF-8 encoded, chars I find this to be a bug.

comment:2 by Ruslan Ermilov <ru@…>, 10 years ago

In 74bfa803a5aade632e15cc05eb8d4c52c85abe9c/nginx:

Teach ngx_http_parse_unsafe_uri() how to unescape URIs.

This fixes handling of escaped URIs in X-Accel-Redirect (ticket #316),
SSI (ticket #240), and DAV.

comment:3 by Ruslan Ermilov, 10 years ago

Resolution: fixed
Status: newclosed

Fix committed.

Note: See TracTickets for help on using tickets.