Release of the lightweight HTTP server . The new version features 149 changes, including the default enabling of URL normalization, a complete overhaul of mod_webdav, and performance optimization efforts.
Starting from lighttpd 1.4.54 server behavior related to URL normalization during HTTP request processing. Options for strict validation of values in the Host header have been activated, along with normalization of links transmitted in headers and blocking of links with unescaped control characters. The normalization process includes automatic conversion of '\' to '\/', '' to '\/', '' to '+', resolution and removal of file path components with directories '.' and '..', and decoding of escaped characters '-', '.', '_', and '~'.
If desired, the URL processing behavior can be changed in the settings using the options Ā«header-strictĀ», Ā«host-strictĀ», Ā«host-normalizeĀ», Ā«url-normalizeĀ», Ā«url-normalize-unreservedĀ», Ā«url-normalize-requiredĀ»,
Ā«url-ctrls-rejectĀ», Ā«url-path-2f-decodeĀ», Ā«url-path-dotseg-removeĀ», and Ā«url-query-20-plusĀ», which are now set to Ā«enableĀ».
Other changes include a complete redesign of the mod_webdav module, achieving full compatibility with specifications, enhancing performance and reliability. Among the incompatible changes in mod_webdav is the blocking of incomplete PUT requests. In mod_auth, support for the SHA-256 algorithm for hashing authentication parameters (HTTP Auth Digest) has been added.
The new mod_maxminddb module is introduced instead of mod_geoip (mod_geoip is now declared deprecated).
Source: opennet.ru
