9

How to reproduce the error:
-- A space in my URL will trigger the error.

Observation of the error:
-- It seems to happen suddenly since around 3/10.
---- I did not upgrade my Apache version, but it seems like the -1ubuntu4.27 package was being auto-installed (There are related messages on the /var/log/dpkg.log.).
-- On browser: 403 Forbidden error.
-- On Apache error log: it gets the AH10411: Rewritten query string contains control characters or spaces error.

Potential solution:
I found two references, user @MrWhite suggested using the B flag on RewriteRule. It does work for my server.

My question:
-- Precisely, is it that particular package causing the error?
-- Does this problem only happen to RewriteRule?
-- Is there a universal fix? I mean if I have multiple applications, instead of changing each of their RewriteRule, is it possible to make correction one time and the fix can be applied to the entire server?

Related reference:
-- https://stackoverflow.com/questions/75684314/ah10411-error-managing-spaces-and-20-in-apache-mod-rewrite
-- RewriteRule started returning 403 Forbidden error

5
  • 1
    I think that the answer is already in your first link which points to security-fix. So I don't know how to flag it. Commented Mar 13, 2023 at 11:45
  • Which directives specifically are you having a problem with? And where exactly? What URLs (and range of characters) are you expecting?
    – MrWhite
    Commented Mar 13, 2023 at 13:01
  • @MrWhite: Thank you for your reply. I would like to first answer your questions: Which directives and where: Sorry if I misunderstand your question please correct me. As far as I can tell it seems any URL that has space and if it is being requested from browser, it will cause the error. If you meant directory path, they are under /var/www/html/. Range of characters: Beside space, I don't know if other characters are having this new problem. I have a feeling that probably more characters are being affected; because I tested some other URL special characters and some of them fail.
    – Chi
    Commented Mar 13, 2023 at 20:52
  • @MrWhite: (Continuing my last message.) Before this problem occurs, there is almost zero problem from all URLs that my server processes. I will need to compare the result of my updated server and my offline server to confirm if some of the URL special characters are being affected by this Apache upgrade. I read your reply from the other question. I have the same doubt, I need more study to find out precisely what kind of security problem does this upgrade package "fix".
    – Chi
    Commented Mar 13, 2023 at 20:57
  • @MrWhite: Based on a search result that I found, I assume before this upgrade, "invalid query string" is being forwarded?
    – Chi
    Commented Mar 13, 2023 at 21:07

2 Answers 2

7

As pointed out by Rohit Gupta in a comment, there was a change to Apache2 outlined in this git pull request, I just had to change my RewriteRules to include the B and BNP flags.

For example:

RewriteRule ^(.*)$ index.php?q=$1 "[L,QSA,B= ?,BNP]"

The old RewriteRule did not include that B and BNP entries. The BNP may not be necessary for your service. It makes sure to use %20 instead of + for the space (i.e. NP as No Plus).

Make sure you change all the RewriteRule in this way.

IMPORTANT NOTE:

The quotation is important in that case because a space delimits parameters by default. In other words:

[L,QSA,B= ?,BNP]

would be viewed as

[L,QSA,B=

and

?,BNP]

and obviously Apache2 would fail to load that.

0

Try replace spaces with +

Add the following after

RewriteBase /
RewriteRule ^(.*)\ (.*)$ /$1+$2 [L,R=301]

in main .htaccess

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Commented Apr 11, 2023 at 20:11

Not the answer you're looking for? Browse other questions tagged or ask your own question.