diff --git a/docs/manual/env.html.en b/docs/manual/env.html.en index 15c35b38b5..207c01816a 100644 --- a/docs/manual/env.html.en +++ b/docs/manual/env.html.en @@ -324,6 +324,19 @@ set for the redirection text, and these broken browsers will then correctly use that of the destination page.

+
+

Security note

+ +

Sending error pages without a specified character set may + allow a cross-site-scripting attack for existing browsers (MSIE) + which do not follow the HTTP/1.1 specification and attempt to + "guess" the character set from the content. Such browsers can + be easily fooled into using the UTF-7 character set, and UTF-7 + content from input data (such as the request-URI) will not be + escaped by the usual escaping mechanisms designed to prevent + cross-site-scripting attacks.

+
+

force-proxy-request-1.0, proxy-nokeepalive, proxy-sendchunked, proxy-sendcl

diff --git a/docs/manual/env.xml.ja b/docs/manual/env.xml.ja index c4357528af..7ef0630b03 100644 --- a/docs/manual/env.xml.ja +++ b/docs/manual/env.xml.ja @@ -1,7 +1,7 @@ - + +