squid-2.3.devel3-strip-whitespace.patch

Some comments on the squid-2.3.devel3-strip-whitespace patch. The
description reads:

        By default, Squid would deny requests when the URL
        contained a whitespace character. RFC 2616 says that
        applications should strip out whitespace. This patch
        adds a new ``strip'' option for the ``uri_whitespace''
        directive and makes it the default.

Have not found this recommendation anywhere in RFC 2616, only that
semantically transparent proxies must not rewrite the abs_path
request-URI in any way (section 5.1.2, last paragraph).

RFC2396 does state that whitespace should be ignored when extracting and
URI from textual context. I am however not confident in that this
section applies to RFC2616. It for sure applies when the browser reads
HTML however, and the encoding rules in RFC 2396 section 2 forbids
applications from generating an URI containing whitespace.

However, current practice for HTTP when spaces are used in the
request-URI is to give significance to the spaces. If you are to change
Squids default setting from "deny" then you'd better change it to
"allow", or I am afraid things will only get worse as people now won't
detect when the URI is invalid and instead get other results than
expected.

An error message telling that the request is invalid is very easy to
doagnose. A request that transparently gets transformed to a lightly
different one is not.

/Henrik
Received on Mon Nov 22 1999 - 14:12:05 MST