<HTML><BODY style="word-wrap: break-word; -khtml-nbsp-mode: space; -khtml-line-break: after-white-space; "><BR><DIV><DIV>On Oct 19, 2005, at 4:29 PM, Jason Mobarak wrote:</DIV><BLOCKQUOTE type="cite"><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">So pageWithAttackJS.js would more likely be liveglue.js?</DIV></BLOCKQUOTE><DIV><BR class="khtml-block-placeholder"></DIV>Perhaps, but I don't think liveglue.js is a hardcoded relative link.</DIV><DIV><BR class="khtml-block-placeholder"></DIV><DIV><BLOCKQUOTE type="cite"><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">I don't quite understand why this works.<SPAN class="Apple-converted-space"> </SPAN>If the first two segments of the vhost request are the protocol and the host why isn't it the case that these segments are consumed, the URL is re-written to:</DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; "><A href="http://foo.bar/vhost/http/google.com">http://foo.bar/vhost/http/google.com</A></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; min-height: 14px; "><BR></DIV><DIV style="margin-top: 0px; margin-right: 0px; margin-bottom: 0px; margin-left: 0px; ">...and it fails because foo.bar doesn't exist?<SPAN class="Apple-converted-space"> </SPAN>Why are the segments still consumed after this point, or...?</DIV></BLOCKQUOTE></DIV><FONT class="Apple-style-span" color="#0000DD"><BR class="khtml-block-placeholder"></FONT><DIV><FONT class="Apple-style-span" color="#0000DD">Because the point of VHostMonsterResource is so that the application doesn't need to know the url it's actually being accessed from in a ProxyPass situation. In a real world example you'd trick the user to go to <A href="http://foo.bar/vhost/http/google.com/">http://foo.bar/vhost/http/google.com/</A> and the user would, the apache server at foo.bar would foward the request to <A href="http://localhost:8080/vhost/http/foo.bar/vhost/http/google.com/">http://localhost:8080/vhost/http/foo.bar/vhost/http/google.com/</A> so the above multiple calls happen and the final request consists of a host being set to google.com. There just isn't any implementation for it to fail because foo.bar doesn't exist. The jist is, VHostMonsterResources flaws are numerous and inherent.</FONT></DIV><DIV><FONT class="Apple-style-span" color="#0000DD"><BR class="khtml-block-placeholder"></FONT></DIV><DIV><FONT class="Apple-style-span" color="#0000DD">-David</FONT></DIV></BODY></HTML>