Improved detection of broken percent encoding in URI.
diff --git a/src/http/ngx_http_parse.c b/src/http/ngx_http_parse.c index 8e1b118..b8a27e0 100644 --- a/src/http/ngx_http_parse.c +++ b/src/http/ngx_http_parse.c
@@ -1561,6 +1561,10 @@ } } + if (state == sw_quoted || state == sw_quoted_second) { + return NGX_HTTP_PARSE_INVALID_REQUEST; + } + done: r->uri.len = u - r->uri.data;