Date: Thu, 10 Apr 2008 18:09:37 GMT From: Fred Cox <sailorfred@yahoo.com> To: freebsd-gnats-submit@FreeBSD.org Subject: ports/122632: port www/p5-CGI.pm: CGI->pathinfo unsafely uses URI in regular expression, allowing easy crashes Message-ID: <200804101809.m3AI9brm083360@www.freebsd.org> Resent-Message-ID: <200804101820.m3AIK1Ee011738@freefall.freebsd.org>
next in thread | raw e-mail | index | archive | help
>Number: 122632 >Category: ports >Synopsis: port www/p5-CGI.pm: CGI->pathinfo unsafely uses URI in regular expression, allowing easy crashes >Confidential: no >Severity: serious >Priority: high >Responsible: freebsd-ports-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Thu Apr 10 18:20:00 UTC 2008 >Closed-Date: >Last-Modified: >Originator: Fred Cox >Release: 6.2 >Organization: vLane.com >Environment: FreeBSD ut.vlane.com 6.2-RELEASE-p8 FreeBSD 6.2-RELEASE-p8 #1: Mon Nov 5 01:48:40 UTC 2007 root@ut.vlane.com:/usr/obj/usr/src/sys/MOTO amd64 >Description: If a CGI/CGI::Fast program calls CGI->pathinfo, and the URL contains an illegal sequence for a regular expression, it dies with an error similar to: Nested quantifiers in regex; marked by <-- HERE in m//articleVote/13Y(134)aNDTLAK61A++ <-- HERE kVBhneW6yw|2000.-.BMW.-.Z8.-.http-3a-2f-2fwww-2enadaguides-2ecom-2fdefault-2easpx-3fLI-3d1-2d22-2d1-2d5006-2d0-2d0-2d0-26l-3d1-26w-3d22-26p-3d1-26f-3d5012-26m-3d1026-26c-3d7-26da-3d-2d1-26y-3d2000-26da-2d1$/ at (eval 1582) line 7. Note that the attached patch does not clean up all instances of the usage of untrustworthy data in regular expressions. I only fixed the part that was crashing for me. >How-To-Repeat: Write a CGI that uses CGI->pathinfo, and feed it a URL that includes ++ or something else that won't work within a regular expression. >Fix: Rewrite section of code to use substr instead of regular expression. See patch. Patch attached with submission follows: *** CGI.pm.orig Mon Dec 17 17:05:39 2007 --- CGI.pm Thu Apr 10 10:50:24 2008 *************** *** 2766,2777 **** my $self = shift; my $raw_script_name = $ENV{SCRIPT_NAME} || ''; my $raw_path_info = $ENV{PATH_INFO} || ''; my $uri = $ENV{REQUEST_URI} || ''; ! if ($raw_script_name =~ m/$raw_path_info$/) { ! $raw_script_name =~ s/$raw_path_info$//; } my @uri_double_slashes = $uri =~ m^(/{2,}?)^g; my @path_double_slashes = "$raw_script_name $raw_path_info" =~ m^(/{2,}?)^g; --- 2766,2780 ---- my $self = shift; my $raw_script_name = $ENV{SCRIPT_NAME} || ''; my $raw_path_info = $ENV{PATH_INFO} || ''; my $uri = $ENV{REQUEST_URI} || ''; ! # trim the pathinfo from the script name ! my $raw_path_info_len = length $raw_path_info; ! ! if ( substr( $raw_script_name, -$raw_path_info_len ) eq $raw_path_info ) { ! $raw_script_name = substr( $raw_script_name, 0, -$raw_path_info_len ); } my @uri_double_slashes = $uri =~ m^(/{2,}?)^g; my @path_double_slashes = "$raw_script_name $raw_path_info" =~ m^(/{2,}?)^g; >Release-Note: >Audit-Trail: >Unformatted:
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?200804101809.m3AI9brm083360>