[PATCH 02 of 10] Rewrite: fixed incorrect initial escaping in "set"

Maxim Dounin mdounin at mdounin.ru
Sun May 17 00:12:35 UTC 2026


# HG changeset patch
# User Maxim Dounin <mdounin at mdounin.ru>
# Date 1778973194 -10800
#      Sun May 17 02:13:14 2026 +0300
# Node ID 071c2e847b986bb7b133ff42c26f9aa2f55b102b
# Parent  9aadc356492de0e61c8ee202c246c2353e8fbc83
Rewrite: fixed incorrect initial escaping in "set".

Previously, the following configuration resulted in inconsistent escaping
of the $temp variable in requests to "/a/..." and "/b/...":

    map $uri $foo {
        ~(.*) 1;
    }

    location /a/ {
        set $temp $foo:$1;
        return 200 $temp;
    }

    location /b/ {
        rewrite ^(.*) $1;
        set $temp $foo:$1;
        return 200 $temp;
    }

In requests to "/a/..." the $1 capture contents were escaped when
copying to the $temp variable due to e->quote being initially set in
ngx_http_rewrite_handler().  And in requests to "/b/..." escaping was
not used, since e->quote was cleared by ngx_http_script_regex_start_code()
and ngx_http_script_regex_end_code().  Note well that in both cases $1
comes from a regular expression in the map, and different behaviour here
is clearly unexpected.

The "e->quote = 1;" initialization in ngx_http_rewrite_handler() was
originally introduced in 485:4ebe09b07e30 (0.1.17) along with the new
rewrite module, and had no effect at the time: e->quote was always set
before being used.  It started to affect the module behaviour after the
introduction of the "set" directive in 501:d4ea69372b94 (0.1.25) and
variables support in "set" in 515:417a087c9c4d (0.1.32).

With this change, e->quote is no longer set in ngx_http_rewrite_handler(),
resulting in consistent behaviour in all cases (and also matching the
behaviour seen without an intermediate "set").

diff --git a/src/http/modules/ngx_http_rewrite_module.c b/src/http/modules/ngx_http_rewrite_module.c
--- a/src/http/modules/ngx_http_rewrite_module.c
+++ b/src/http/modules/ngx_http_rewrite_module.c
@@ -171,7 +171,6 @@ ngx_http_rewrite_handler(ngx_http_reques
 
     e->ip = rlcf->codes->elts;
     e->request = r;
-    e->quote = 1;
     e->log = rlcf->log;
     e->status = NGX_DECLINED;
 



More information about the nginx-devel mailing list