fix set_uri security issue

patches/nginx-1.17.8-set_uri_security_issue.patch

@@ -0,0 +1,39 @@
+diff --git a/src/http/modules/ngx_http_static_module.c b/src/http/modules/ngx_http_static_module.c
+index 282d6ee..cb5b6c1 100644
+--- a/src/http/modules/ngx_http_static_module.c
++++ b/src/http/modules/ngx_http_static_module.c
+@@ -44,6 +44,20 @@ ngx_module_t  ngx_http_static_module = {
+     NGX_MODULE_V1_PADDING
+ };
+ 
++static ngx_int_t
++ngx_http_check_safe_location(u_char *str, size_t len)
++{
++    u_char ch;
++    size_t i;
++
++    for (i = 0; i < len; i++) {
++        ch = str[i];
++        if (ch <= 31 || ch == 127) {
++            return NGX_ERROR;
++        }
++    }
++    return NGX_OK;
++}
+ 
+ static ngx_int_t
+ ngx_http_static_handler(ngx_http_request_t *r)
+@@ -183,6 +197,13 @@ ngx_http_static_handler(ngx_http_request_t *r)
+             }
+         }
+ 
++        if (ngx_http_check_safe_location(location, len) != NGX_OK) {
++            ngx_http_clear_location(r);
++            ngx_log_error(NGX_LOG_ERR, log, NGX_HTTP_INTERNAL_SERVER_ERROR,
++                          "bad uri, control characters are not allowed");
++            return NGX_HTTP_INTERNAL_SERVER_ERROR;
++        }
++         
+         r->headers_out.location->hash = 1;
+         ngx_str_set(&r->headers_out.location->key, "Location");
+         r->headers_out.location->value.len = len;

util/mirror-tarballs

@@ -443,6 +443,13 @@ fi
 
 rm -f *.patch || exit 1
 
+answer=`$root/util/ver-ge "$main_ver" 1.17.8`
+if [ "$answer" = "Y" ]; then
+    echo "$info_txt applying the always_enable_cc_feature_tests patch to nginx"
+    patch -p1 < $root/patches/nginx-$main_ver-set_uri_security_issue.patch
+    echo
+fi
+
 echo "$info_txt applying the always_enable_cc_feature_tests patch to nginx"
 patch -p1 < $root/patches/nginx-$main_ver-always_enable_cc_feature_tests.patch
 echo