From owner-freebsd-ports-bugs@FreeBSD.ORG Thu Apr 10 18:20:01 2008 Return-Path: Delivered-To: freebsd-ports-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9012D106566B for ; Thu, 10 Apr 2008 18:20:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 6ADAA8FC19 for ; Thu, 10 Apr 2008 18:20:01 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (gnats@localhost [127.0.0.1]) by freefall.freebsd.org (8.14.2/8.14.2) with ESMTP id m3AIK1rN011739 for ; Thu, 10 Apr 2008 18:20:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.2/8.14.1/Submit) id m3AIK1Ee011738; Thu, 10 Apr 2008 18:20:01 GMT (envelope-from gnats) Resent-Date: Thu, 10 Apr 2008 18:20:01 GMT Resent-Message-Id: <200804101820.m3AIK1Ee011738@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-ports-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Fred Cox Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 7255C106567A for ; Thu, 10 Apr 2008 18:09:58 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 5F9D88FC39 for ; Thu, 10 Apr 2008 18:09:58 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.2/8.14.2) with ESMTP id m3AI9bZK083361 for ; Thu, 10 Apr 2008 18:09:37 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.2/8.14.1/Submit) id m3AI9brm083360; Thu, 10 Apr 2008 18:09:37 GMT (envelope-from nobody) Message-Id: <200804101809.m3AI9brm083360@www.freebsd.org> Date: Thu, 10 Apr 2008 18:09:37 GMT From: Fred Cox To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: ports/122632: port www/p5-CGI.pm: CGI->pathinfo unsafely uses URI in regular expression, allowing easy crashes X-BeenThere: freebsd-ports-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Ports bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 10 Apr 2008 18:20:01 -0000 >Number: 122632 >Category: ports >Synopsis: port www/p5-CGI.pm: CGI->pathinfo unsafely uses URI in regular expression, allowing easy crashes >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Apr 10 18:20:00 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Fred Cox >Release: 6.2 >Organization: vLane.com >Environment: FreeBSD ut.vlane.com 6.2-RELEASE-p8 FreeBSD 6.2-RELEASE-p8 #1: Mon Nov 5 01:48:40 UTC 2007 root@ut.vlane.com:/usr/obj/usr/src/sys/MOTO amd64 >Description: If a CGI/CGI::Fast program calls CGI->pathinfo, and the URL contains an illegal sequence for a regular expression, it dies with an error similar to: Nested quantifiers in regex; marked by <-- HERE in m//articleVote/13Y(134)aNDTLAK61A++ <-- HERE kVBhneW6yw|2000.-.BMW.-.Z8.-.http-3a-2f-2fwww-2enadaguides-2ecom-2fdefault-2easpx-3fLI-3d1-2d22-2d1-2d5006-2d0-2d0-2d0-26l-3d1-26w-3d22-26p-3d1-26f-3d5012-26m-3d1026-26c-3d7-26da-3d-2d1-26y-3d2000-26da-2d1$/ at (eval 1582) line 7. Note that the attached patch does not clean up all instances of the usage of untrustworthy data in regular expressions. I only fixed the part that was crashing for me. >How-To-Repeat: Write a CGI that uses CGI->pathinfo, and feed it a URL that includes ++ or something else that won't work within a regular expression. >Fix: Rewrite section of code to use substr instead of regular expression. See patch. Patch attached with submission follows: *** CGI.pm.orig Mon Dec 17 17:05:39 2007 --- CGI.pm Thu Apr 10 10:50:24 2008 *************** *** 2766,2777 **** my $self = shift; my $raw_script_name = $ENV{SCRIPT_NAME} || ''; my $raw_path_info = $ENV{PATH_INFO} || ''; my $uri = $ENV{REQUEST_URI} || ''; ! if ($raw_script_name =~ m/$raw_path_info$/) { ! $raw_script_name =~ s/$raw_path_info$//; } my @uri_double_slashes = $uri =~ m^(/{2,}?)^g; my @path_double_slashes = "$raw_script_name $raw_path_info" =~ m^(/{2,}?)^g; --- 2766,2780 ---- my $self = shift; my $raw_script_name = $ENV{SCRIPT_NAME} || ''; my $raw_path_info = $ENV{PATH_INFO} || ''; my $uri = $ENV{REQUEST_URI} || ''; ! # trim the pathinfo from the script name ! my $raw_path_info_len = length $raw_path_info; ! ! if ( substr( $raw_script_name, -$raw_path_info_len ) eq $raw_path_info ) { ! $raw_script_name = substr( $raw_script_name, 0, -$raw_path_info_len ); } my @uri_double_slashes = $uri =~ m^(/{2,}?)^g; my @path_double_slashes = "$raw_script_name $raw_path_info" =~ m^(/{2,}?)^g; >Release-Note: >Audit-Trail: >Unformatted: