Date: Thu, 10 Apr 2008 18:09:37 GMT From: Fred Cox <sailorfred@yahoo.com> To: freebsd-gnats-submit@FreeBSD.org Subject: ports/122632: port www/p5-CGI.pm: CGI->pathinfo unsafely uses URI in regular expression, allowing easy crashes Message-ID: <200804101809.m3AI9brm083360@www.freebsd.org> Resent-Message-ID: <200804101820.m3AIK1Ee011738@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 122632
>Category: ports
>Synopsis: port www/p5-CGI.pm: CGI->pathinfo unsafely uses URI in regular expression, allowing easy crashes
>Confidential: no
>Severity: serious
>Priority: high
>Responsible: freebsd-ports-bugs
>State: open
>Quarter:
>Keywords:
>Date-Required:
>Class: sw-bug
>Submitter-Id: current-users
>Arrival-Date: Thu Apr 10 18:20:00 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator: Fred Cox
>Release: 6.2
>Organization:
vLane.com
>Environment:
FreeBSD ut.vlane.com 6.2-RELEASE-p8 FreeBSD 6.2-RELEASE-p8 #1: Mon Nov 5 01:48:40 UTC 2007 root@ut.vlane.com:/usr/obj/usr/src/sys/MOTO amd64
>Description:
If a CGI/CGI::Fast program calls CGI->pathinfo, and the URL contains an illegal sequence for a regular expression, it dies with an error similar to:
Nested quantifiers in regex; marked by <-- HERE in m//articleVote/13Y(134)aNDTLAK61A++ <-- HERE kVBhneW6yw|2000.-.BMW.-.Z8.-.http-3a-2f-2fwww-2enadaguides-2ecom-2fdefault-2easpx-3fLI-3d1-2d22-2d1-2d5006-2d0-2d0-2d0-26l-3d1-26w-3d22-26p-3d1-26f-3d5012-26m-3d1026-26c-3d7-26da-3d-2d1-26y-3d2000-26da-2d1$/ at (eval 1582) line 7.
Note that the attached patch does not clean up all instances of the usage of untrustworthy data in regular expressions. I only fixed the part that was crashing for me.
>How-To-Repeat:
Write a CGI that uses CGI->pathinfo, and feed it a URL that includes ++ or something else that won't work within a regular expression.
>Fix:
Rewrite section of code to use substr instead of regular expression.
See patch.
Patch attached with submission follows:
*** CGI.pm.orig Mon Dec 17 17:05:39 2007
--- CGI.pm Thu Apr 10 10:50:24 2008
***************
*** 2766,2777 ****
my $self = shift;
my $raw_script_name = $ENV{SCRIPT_NAME} || '';
my $raw_path_info = $ENV{PATH_INFO} || '';
my $uri = $ENV{REQUEST_URI} || '';
! if ($raw_script_name =~ m/$raw_path_info$/) {
! $raw_script_name =~ s/$raw_path_info$//;
}
my @uri_double_slashes = $uri =~ m^(/{2,}?)^g;
my @path_double_slashes = "$raw_script_name $raw_path_info" =~ m^(/{2,}?)^g;
--- 2766,2780 ----
my $self = shift;
my $raw_script_name = $ENV{SCRIPT_NAME} || '';
my $raw_path_info = $ENV{PATH_INFO} || '';
my $uri = $ENV{REQUEST_URI} || '';
! # trim the pathinfo from the script name
! my $raw_path_info_len = length $raw_path_info;
!
! if ( substr( $raw_script_name, -$raw_path_info_len ) eq $raw_path_info ) {
! $raw_script_name = substr( $raw_script_name, 0, -$raw_path_info_len );
}
my @uri_double_slashes = $uri =~ m^(/{2,}?)^g;
my @path_double_slashes = "$raw_script_name $raw_path_info" =~ m^(/{2,}?)^g;
>Release-Note:
>Audit-Trail:
>Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200804101809.m3AI9brm083360>