Skip site navigation (1)Skip section navigation (2)
Date:      Thu, 10 Apr 2008 18:09:37 GMT
From:      Fred Cox <sailorfred@yahoo.com>
To:        freebsd-gnats-submit@FreeBSD.org
Subject:   ports/122632: port www/p5-CGI.pm: CGI->pathinfo unsafely uses URI in regular expression, allowing easy crashes
Message-ID:  <200804101809.m3AI9brm083360@www.freebsd.org>
Resent-Message-ID: <200804101820.m3AIK1Ee011738@freefall.freebsd.org>

next in thread | raw e-mail | index | archive | help

>Number:         122632
>Category:       ports
>Synopsis:       port www/p5-CGI.pm: CGI->pathinfo unsafely uses URI in regular expression, allowing easy crashes
>Confidential:   no
>Severity:       serious
>Priority:       high
>Responsible:    freebsd-ports-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Thu Apr 10 18:20:00 UTC 2008
>Closed-Date:
>Last-Modified:
>Originator:     Fred Cox
>Release:        6.2
>Organization:
vLane.com
>Environment:
FreeBSD ut.vlane.com 6.2-RELEASE-p8 FreeBSD 6.2-RELEASE-p8 #1: Mon Nov  5 01:48:40 UTC 2007     root@ut.vlane.com:/usr/obj/usr/src/sys/MOTO  amd64
>Description:
If a CGI/CGI::Fast program calls CGI->pathinfo, and the URL contains an illegal sequence for a regular expression, it dies with an error similar to:

Nested quantifiers in regex; marked by <-- HERE in m//articleVote/13Y(134)aNDTLAK61A++ <-- HERE kVBhneW6yw|2000.-.BMW.-.Z8.-.http-3a-2f-2fwww-2enadaguides-2ecom-2fdefault-2easpx-3fLI-3d1-2d22-2d1-2d5006-2d0-2d0-2d0-26l-3d1-26w-3d22-26p-3d1-26f-3d5012-26m-3d1026-26c-3d7-26da-3d-2d1-26y-3d2000-26da-2d1$/ at (eval 1582) line 7.

Note that the attached patch does not clean up all instances of the usage of untrustworthy data in regular expressions.  I only fixed the part that was crashing for me.

>How-To-Repeat:
Write a CGI that uses CGI->pathinfo, and feed it a URL that includes ++ or something else that won't work within a regular expression.
>Fix:
Rewrite section of code to use substr instead of regular expression.

See patch.

Patch attached with submission follows:

*** CGI.pm.orig	Mon Dec 17 17:05:39 2007
--- CGI.pm	Thu Apr 10 10:50:24 2008
***************
*** 2766,2777 ****
     my $self = shift;
     my $raw_script_name = $ENV{SCRIPT_NAME} || '';
     my $raw_path_info   = $ENV{PATH_INFO}   || '';
     my $uri             = $ENV{REQUEST_URI} || '';
  
!    if ($raw_script_name =~ m/$raw_path_info$/) {
!      $raw_script_name =~ s/$raw_path_info$//;
     }
  
     my @uri_double_slashes  = $uri =~ m^(/{2,}?)^g;
     my @path_double_slashes = "$raw_script_name $raw_path_info" =~ m^(/{2,}?)^g;
  
--- 2766,2780 ----
     my $self = shift;
     my $raw_script_name = $ENV{SCRIPT_NAME} || '';
     my $raw_path_info   = $ENV{PATH_INFO}   || '';
     my $uri             = $ENV{REQUEST_URI} || '';
  
!    # trim the pathinfo from the script name
!    my $raw_path_info_len = length $raw_path_info;
! 
!    if ( substr( $raw_script_name, -$raw_path_info_len ) eq $raw_path_info ) {
!       $raw_script_name = substr( $raw_script_name, 0, -$raw_path_info_len );
     }
  
     my @uri_double_slashes  = $uri =~ m^(/{2,}?)^g;
     my @path_double_slashes = "$raw_script_name $raw_path_info" =~ m^(/{2,}?)^g;
  


>Release-Note:
>Audit-Trail:
>Unformatted:



Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200804101809.m3AI9brm083360>