VirtualHostMonster silently trims a slash from a double slash

[Anthony Gerrard]

We ran into a problem when some bot / hacker was sending requests to our server like

http://mysite.org/real-folder/http://google.ru/

which resulted in unhandled exceptions. We're using Apache, Zope, VHM, Plone plus plone.app.theming. The errors were originating in p.a.theming's use of plone.subrequest which read certain values stored in the request object including VIRTUAL_URL_PARTS to build a subrequest.

I've written a couple of tests (attached) which show that Zope will trim one of the slashes off a double slash in both the ACTUAL_URL and VIRTUAL_URL_PARTS values stored on the request.

Admittedly this is a bit of an edge case but I think it is a bug in Zope2.

[Hanno Schlichting (hannosch)]

I don't know the RFC well enough. But keeping double slashes intact sounds like the right thing to do here.

[Colin Watson (cjwatson)]

The zope2 project on Launchpad has been archived at the request of the Zope developers (see https://answers.launchpad.net/launchpad/+question/683589 and https://answers.launchpad.net/launchpad/+question/685285). If this bug is still relevant, please refile it at https://github.com/zopefoundation/zope2.