escape the cookie_name before pasting into the regexp.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@103326 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/CHANGES b/CHANGES
index f5368882510f821f7f6faf98e48833e94b2ed7c3..42d0c23a86f2b0f3560145ecdba83be834033d8e 100644 (file)
--- a/CHANGES
+++ b/CHANGES
@@ -2,6 +2,9 @@ Changes with Apache 2.1.0-dev
 
   [Remove entries to the current 2.0 section below, when backported]
 
+  *) mod_usertrack: Escape the cookie name before pasting into the
+     regexp.  [André Malo]
+
   *) Enable special ErrorDocument value 'default' which restores the
      canned server response for the scope of the directive.
      [Geoffrey Young]

diff --git a/modules/metadata/mod_usertrack.c b/modules/metadata/mod_usertrack.c
index d7bbb2247917abfad994ea17a3a6b921e8fee1ee..9c00a9a1d0c4c707a9e5711f8b6305095e980179 100644 (file)
--- a/modules/metadata/mod_usertrack.c
+++ b/modules/metadata/mod_usertrack.c
@@ -160,12 +160,44 @@ static void set_and_comp_regexp(cookie_dir_rec *dcfg,
                                 apr_pool_t *p,
                                 const char *cookie_name)
 {
+    int danger_chars = 0;
+    const char *sp = cookie_name;
+
     /* The goal is to end up with this regexp,
      * ^cookie_name=([^;,]+)|[;,][ \t]+cookie_name=([^;,]+)
      * with cookie_name obviously substituted either
      * with the real cookie name set by the user in httpd.conf, or with the
      * default COOKIE_NAME. */
-    dcfg->regexp_string = apr_pstrcat(p, "^", cookie_name, "=([^;,]+)|[;,][ \t]*", cookie_name, "=([^;,]+)", NULL);
+
+    /* Anyway, we need to escape the cookie_name before pasting it
+     * into the regex
+     */
+    while (*sp) {
+        if (!apr_isalnum(*sp)) {
+            ++danger_chars;
+        }
+        ++sp;
+    }
+
+    if (danger_chars) {
+        char *cp;
+        cp = apr_palloc(p, sp - cookie_name + danger_chars + 1); /* 1 == \0 */
+        sp = cookie_name;
+        cookie_name = cp;
+        while (*sp) {
+            if (!apr_isalnum(*sp)) {
+                *cp++ = '\\';
+            }
+            *cp++ = *sp++;
+        }
+        *cp = '\0';
+    }
+
+    dcfg->regexp_string = apr_pstrcat(p, "^",
+                                      cookie_name,
+                                      "=([^;,]+)|[;,][ \t]*",
+                                      cookie_name,
+                                      "=([^;,]+)", NULL);
 
     dcfg->regexp = ap_pregcomp(p, dcfg->regexp_string, REG_EXTENDED);
 }