From: Jim Jagielski Date: Mon, 26 Nov 2012 17:18:54 +0000 (+0000) Subject: CVE-2012-3499 and CVE-2012-4558 X-Git-Tag: 2.5.0-alpha~6088 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=18cc8e835b71e832d78c93bf97a6232a088747fb;p=apache CVE-2012-3499 and CVE-2012-4558 Be sure to escape potential troubled strings git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1413732 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/modules/generators/mod_info.c b/modules/generators/mod_info.c index 75c37782bc..2f2db9fa61 100644 --- a/modules/generators/mod_info.c +++ b/modules/generators/mod_info.c @@ -459,7 +459,8 @@ static int show_server_settings(request_rec * r) MODULE_MAGIC_NUMBER_MINOR); ap_rprintf(r, "
Hostname/port: " - "%s:%u
\n", ap_get_server_name(r), + "%s:%u\n", + ap_escape_html(r->pool, ap_get_server_name(r)), ap_get_server_port(r)); ap_rprintf(r, "
Timeouts: " diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c index 8b39db43a9..54404e90bb 100644 --- a/modules/generators/mod_status.c +++ b/modules/generators/mod_status.c @@ -400,7 +400,8 @@ static int status_handler(request_rec *r) "Apache Status\n" "\n" "

Apache Server Status for ", r); - ap_rvputs(r, ap_get_server_name(r), " (via ", r->connection->local_ip, + ap_rvputs(r, ap_escape_html(r->pool, ap_get_server_name(r)), + " (via ", r->connection->local_ip, ")

\n\n", NULL); ap_rvputs(r, "
Server Version: ", ap_get_server_description(), "
\n", NULL); diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c index 19db1511cb..8057e29608 100644 --- a/modules/mappers/mod_imagemap.c +++ b/modules/mappers/mod_imagemap.c @@ -338,7 +338,7 @@ static char *imap_url(request_rec *r, const char *base, const char *value) if (!strcasecmp(value, "referer")) { referer = apr_table_get(r->headers_in, "Referer"); if (referer && *referer) { - return ap_escape_html(r->pool, referer); + return referer; } else { /* XXX: This used to do *value = '\0'; ... which is totally bogus @@ -521,40 +521,50 @@ static void menu_comment(request_rec *r, char *menu, char *comment) static void menu_default(request_rec *r, char *menu, char *href, char *text) { + char *ehref, *etext; if (!strcasecmp(href, "error") || !strcasecmp(href, "nocontent")) { return; /* don't print such lines, these aren't really href's */ } + + ehref = ap_escape_uri(r->pool, href); + etext = ap_escape_html(r->pool, text); + if (!strcasecmp(menu, "formatted")) { - ap_rvputs(r, "
(Default) ", text,
-               "
\n", NULL); + ap_rvputs(r, "
(Default) ", etext,
+                     "
\n", NULL); } else if (!strcasecmp(menu, "semiformatted")) { - ap_rvputs(r, "
(Default) ", text,
+        ap_rvputs(r, "
(Default) ", etext,
                "
\n", NULL);
     }
     else if (!strcasecmp(menu, "unformatted")) {
-        ap_rvputs(r, "", text, "", NULL);
+        ap_rvputs(r, "", etext, "", NULL);
     }
     return;
 }
 
 static void menu_directive(request_rec *r, char *menu, char *href, char *text)
 {
+    char *ehref, *etext;
     if (!strcasecmp(href, "error") || !strcasecmp(href, "nocontent")) {
         return;                 /* don't print such lines, as this isn't
                                    really an href */
     }
+
+    ehref = ap_escape_uri(r->pool, href);
+    etext = ap_escape_html(r->pool, text);
+
     if (!strcasecmp(menu, "formatted")) {
-        ap_rvputs(r, "
          ", text,
+        ap_rvputs(r, "
          ", etext,
                "
\n", NULL);
     }
     else if (!strcasecmp(menu, "semiformatted")) {
-        ap_rvputs(r, "
          ", text,
+        ap_rvputs(r, "
          ", etext,
                "
\n", NULL);
     }
     else if (!strcasecmp(menu, "unformatted")) {
-        ap_rvputs(r, "", text, "", NULL);
+        ap_rvputs(r, "", etext, "", NULL);
     }
     return;
 }
diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c
index 78a00d3dc5..de3a0490ac 100644
--- a/modules/proxy/mod_proxy_balancer.c
+++ b/modules/proxy/mod_proxy_balancer.c
@@ -1428,7 +1428,8 @@ static int balancer_handler(request_rec *r)
                  "}\n"
                  "\n\n", r);
         ap_rputs("
Load Balancer Manager for ", r);
-        ap_rvputs(r, ap_get_server_name(r), "
\n\n", NULL);
+        ap_rvputs(r, ap_escape_html(r->pool, ap_get_server_name(r)),
+                  "\n\n", NULL);
         ap_rvputs(r, "
Server Version: ",
                   ap_get_server_description(), "
\n", NULL);
         ap_rvputs(r, "
Server Built: ",
@@ -1437,10 +1438,10 @@ static int balancer_handler(request_rec *r)
         for (i = 0; i < conf->balancers->nelts; i++) {
 
             ap_rputs("
\n
LoadBalancer Status for ", r);
-            ap_rvputs(r, "", NULL);
+                      "\">", NULL);
             ap_rvputs(r, balancer->s->name, " [",balancer->s->sname, "]
\n", NULL);
             ap_rputs("\n\n"
                 ""
@@ -1487,11 +1488,12 @@ static int balancer_handler(request_rec *r)
             for (n = 0; n < balancer->workers->nelts; n++) {
                 char fbuf[50];
                 worker = *workers;
-                ap_rvputs(r, "\n", NULL);
                 ap_rvputs(r, "
MaxMembersStickySessionDisableFailoverTimeoutFailoverAttemptsMethod
", NULL);
+                          "\">", NULL);
                 ap_rvputs(r, worker->s->name, "", ap_escape_html(r->pool, worker->s->route),
                           NULL);
@@ -1518,20 +1520,20 @@ static int balancer_handler(request_rec *r)
         if (wsel && bsel) {
             ap_rputs("
Edit worker settings for ", r);
             ap_rvputs(r, wsel->s->name, "
\n", NULL);
-            ap_rputs("
\n", NULL);
+            ap_rputs("pool, action), "\">\n", NULL);
             ap_rputs("
\n\n", wsel->s->lbfactor);
             ap_rputs("\n", wsel->s->lbset);
             ap_rputs("\n", r);
+            ap_rputs("\">\n", r);
             ap_rputs("\n", r);
+            ap_rputs("\">\n", r);
             ap_rputs("", r);
             ap_rputs("
Load factor:
LB Set:
Route:
Route Redirect:
Status:\n", r);
             create_radio("w_status_I", (PROXY_WORKER_IGNORE_ERRORS & wsel->s->status), r);
diff --git a/modules/proxy/mod_proxy_ftp.c b/modules/proxy/mod_proxy_ftp.c
index 4b7fef2fb4..b6e9f821bd 100644
--- a/modules/proxy/mod_proxy_ftp.c
+++ b/modules/proxy/mod_proxy_ftp.c
@@ -530,7 +530,9 @@ static apr_status_t proxy_send_dir_filter(ap_filter_t *f,
                 " \n"
                 " \n  
Directory of "
                 "%s/%s",
-                site, basedir, escpath, site, basedir, escpath, site, str);
+                ap_escape_html(p, site), basedir, escpath,
+                ap_escape_uri(p, site), basedir, escpath,
+                ap_escape_uri(p, site), str);
 
         APR_BRIGADE_INSERT_TAIL(out, apr_bucket_pool_create(str, strlen(str),
                                                           p, c->bucket_alloc));

IgnDrnDisStby