Release of the lightweight HTTP server . The new version features 149 changes, including the default enabling of URL normalization, a complete overhaul of mod_webdav, and performance optimization efforts.
Starting from lighttpd 1.4.54 server behavior related to URL normalization during HTTP request processing. Options for strict checking of values in the Host header are enabled, along with normalization of links passed in headers and blocking of links with unescaped control characters. The normalization process includes automatic conversion of ā\ā to ā/ā, āā to ā/ā, āā to ā+ā, resolution and removal of file path segments with directories ā.ā and ā..ā, and decoding of escaped characters ā-ā, ā.ā, ā_ā and ā~ā.
If desired, the URL processing behavior can be changed in the settings using the options Ā«header-strictĀ», Ā«host-strictĀ», Ā«host-normalizeĀ», Ā«url-normalizeĀ», Ā«url-normalize-unreservedĀ», Ā«url-normalize-requiredĀ»,
Ā«url-ctrls-rejectĀ», Ā«url-path-2f-decodeĀ», Ā«url-path-dotseg-removeĀ», and Ā«url-query-20-plusĀ», which are now set to Ā«enableĀ».
Other changes include a complete redesign of the mod_webdav module, achieving full compatibility with specifications, enhancing performance and reliability. Among the incompatible changes in mod_webdav is the blocking of incomplete PUT requests. In mod_auth, support for the SHA-256 algorithm for hashing authentication parameters (HTTP Auth Digest) has been added.
The new mod_maxminddb module is introduced instead of mod_geoip (mod_geoip is now declared deprecated).
Source: opennet.ru
