Repository navigation
mod_cache: Parse comma separated Cache-Control directives again. - #821
Closed
arturobernalg wants to merge 1 commit into
Closed
arturobernalg wants to merge 1 commit into
arturobernalg wants to merge 1 commit into
Conversation
notroj
approved these changes
Oct 16, 2026
notroj
left a comment
notroj
left a comment
Collaborator
There was a problem hiding this comment.
Since this is a trunk-specific regression it doesn't need a changes-entry. This broke somewhere in the r1856507 / r1856500 / r1856493 sequence? It would be good to reference that in the commit message.
Otherwise LGTM
arturobernalg
force-pushed
the
fix/httpd-70028-cache-control-comma-list
branch
from
October 19, 2026 09:48
bd231e5 to
4a0b459
Compare
cache_strqtok() did not end a token at a comma or whitespace unless an argument followed, so "private, no-store" was read as one token and the response was stored. Stop at any non-token character, after the '=' test. This is a trunk-only regression from r1856507, which rewrote the tokenizer as a state machine and dropped the T_HTTP_TOKEN_STOP check in the token state that r1856493 and r1856500 still had. BZ 70028.
arturobernalg
force-pushed
the
fix/httpd-70028-cache-control-comma-list
branch
from
October 19, 2026 09:57
4a0b459 to
f6f13ef
Compare
Member
Author
|
Thanks for the review. I removed the changes-entry, and the commit message now references r1856507 as the revision that introduced the regression: it rewrote cache_strqtok() as a state machine and dropped the T_HTTP_TOKEN_STOP check in the token state that r1856493 and r1856500 still had. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
cache_strqtok() did not end a token at a comma or whitespace unless an argument followed, so "private, no-store" was read as one token and the response was stored. Stop at any non-token character, after the '=' test. BZ 70028.
(see
SECURITY.mdandhttps://www.apache.org/security/#reporting-a-vulnerability).
APLOGNO()tag;numbers are assigned by a committer at merge time (see
docs/log-message-tags/README).changes-entries/*.txtfile is included,following the template in
README.CHANGES(not needed otherwise).test/modules/xxxdirectory matching themodules/xxxmodule source,or
test/modules/corefor core server changes. On Unix, verify thesepass locally with e.g.
make check-pytest PYTEST_DIRS=test/modules/xxx.