Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've got a rewrite rule set up like this:

RewriteCond %{DOCUMENT_ROOT}/cache/%{REQUEST_URI} -f
RewriteRule ^(.*)$ cache/$1 [QSA,PT,L]

Brief explanation for this rule: it checks to see if a requested file exists in the cache directory. If it does, then it serves the cache directory.

E.g. a request to http://somehost.tld/about.html would be served from http://somehost.tld/cache/about.html (if this file exists).

What I'm concerned about is if the RewriteRule is insecure. Is it possible for someone to request a URL like this, with double periods in it to move up a directory:


So causing private_file.txt to be served from a directory above my apache public folder?

share|improve this question
BTW I did try this out but my results were inconclusive on my server, I think its safe, but I'm not certain... – Eliot Sykes Feb 17 '10 at 12:07
My guess is that Apache would deny access to the file private_file.txt. However a determined attacker could possibly test for the presence of private_file.txt on your system by the response given. – PP. Feb 17 '10 at 12:08
up vote 2 down vote accepted

Including .. in a URL doesn't work at either the HTTP request level or the browser level. Browsers just resolve the relative paths, sending a request for the appropriate file (capping it at the server root). So typing this into an address bar:


Would result in a HTTP request for:


In other words, someone would have to manually craft a HTTP request for the ../.. to reach Apache. And that comes back with HTTP 400 Bad Request. Example from my local server (which has no rewrite rules):

ritsuko:~ spyder$ curl -v http://localhost/../randomfile
* About to connect() to localhost port 80 (#0)
*   Trying ::1... connected
* Connected to localhost (::1) port 80 (#0)
> GET /../randomfile HTTP/1.1
> User-Agent: curl/7.19.4 (universal-apple-darwin10.0) libcurl/7.19.4 OpenSSL/0.9.8l zlib/1.2.3
> Host: localhost
> Accept: */*
< HTTP/1.1 400 Bad Request
< Date: Wed, 17 Feb 2010 13:18:40 GMT
< Server: Apache/2.2.13 (Unix) mod_ssl/2.2.13 OpenSSL/0.9.8l DAV/2
< Content-Length: 226
< Connection: close
< Content-Type: text/html; charset=iso-8859-1
<title>400 Bad Request</title>
<h1>Bad Request</h1>
<p>Your browser sent a request that this server could not understand.<br />
* Closing connection #0
share|improve this answer

apache doesn't allow 'move up a directory'.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.