yhirose 174bce5ccf Escape request data in the docker server's access and error logs ...

req.path is percent-decoded, so a request like GET /%0D%0A... put a
literal CR/LF into the NGINX-style log lines and let a client forge
extra entries. Log the raw req.target (matching NGINX's $request) and
escape '"', '\', control and non-ASCII bytes as \xHH the way NGINX
does. Also note in the README logging section that req.path may
contain control characters and should be escaped before logging.

2026-09-27 22:50:26 -04:00

11 KiB

Raw Blame History

View Raw