Hi.

Thank you for pound, it's a really great software.

In pound's documenation, it is said that:

"Rather then change *Pound* to accept these characters (which could create
    some serious issues with security on other systems) we have made this
    behavior dependent on a compile-time switch. This is not accessible
    through the config file - you'll have to add -DMSDAV to the CFLAGS in
    the Makefile (or run configure --enable-msdav). You are free to do so,
    but be aware of what the implications are!"

Could you please confirm that, if one enables webdav during
compilation, using "WebDAV 0" in the config file would not be enough
to DISABLE those dirty characters?

In order words, what is the real security impact of enabling webdav
during compilation? (considering one can disable it in the config).

I'm trying to get some background to discuss with debian's pound
package maintainers the possibility of enabling webdav by default in
compilation, and leaving "WebDAV 0" in the config file.

Currently, debian's pound package not being compiled with webdav, so
one must recompile the package in order to get that feature. Debian
developers argues that the upstream author should have had some good
reasons to not enabled that by default, so they are just using that.

I have patched ubuntu's pound package to use that feature, and this
package will probably go to the next version of that distribution, if
they accept it.

[...]

On Wednesday 30 March 2005 03:00, Yves Junqueira wrote:[...]

These are two separate issues, and they control different aspects of 
operation.

In general an HTTP request looks like "verb path ...", where "verb" is what 
needs to be done (GET, POST, etc) and "path" is (in general) the path to some 
resource/file.

The --enable-msdav flags says what characters are allowed in the path (it's 
really a regular expression). In contrast "WebDAV 1" says that some 
additional verbs are allowed in the request (same as ExtendedHTTP, but for 
another set of verbs).

This means that compiling Pound with --enable-msdav will allow additional 
characters in the URL even when WebDAV is 0. Draw your own conclusions re. 
security.

To make matters worse: --enable-msdav is sometimes required for some other 
applications even though they never use DAV![...]