Thank you philh for the link.
mod_rewrite is addressed as the Swiss Army Knife when it comes to extending the functionality of the Apache servers. It can do a lot of things with minimal fuss or adding thousands of lines of code.
But it is a double edged sword as well if you are careless with your directives. Sometimes you can bring the server down to its knees with a contrived unending loop.
Bad elements could engineer artificially contrived requests to trigger the vulnerability if your statements are not crafted well enough. In a typical worst case scenario, your server goes into a loop, consuming resources to the point of crashing the server.
Most server admins know this and this is one of the major reasons your host will dump your site.
Fortunately, the required skill to invoke a runaway loop is high and the common script kiddies do not have the wherewithal to trigger one anytime now. Still that does not mean that you can be sloppy in coding.
Some time ago we had spent months working on a content delivery engine which depended on a 404 Error trap and a lengthy mod_rewrite set of directives. The 'engine' worked flawlessly in the development servers and even under beta testing in the production servers. Then someone added just one page of content which brought the servers down. It is the not page which triggered the disaster, but one embedded URL with an accented character. The input module was not adequately sanitized. It is just an example of working with a double edged sword.
|