From: Stefan Fritsch Date: Sun, 9 Dec 2012 13:28:04 +0000 (+0000) Subject: Merge r1413732, r1418752: X-Git-Tag: 2.4.4~348 X-Git-Url: https://granicus.if.org/sourcecode?a=commitdiff_plain;h=c91d11e0ca9f0c13cfacaefee04b7d36b3802172;p=apache Merge r1413732, r1418752: various mods: host and URI escaping: Be sure to escape potential troubled strings add missing html escaping Submitted by: jim, sf Reviewed by: covener, minfrin, sf git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.4.x@1418941 13f79535-47bb-0310-9956-ffa450edef68 --- diff --git a/CHANGES b/CHANGES index 50f6558e64..df167f1b8e 100644 --- a/CHANGES +++ b/CHANGES @@ -2,6 +2,10 @@ Changes with Apache 2.4.4 + *) mod_status, mod_info, mod_proxy_ftp, mod_proxy_balancer, mod_imagemap, + mod_ldap: Improve escaping of hostname and URIs HTML output. + [Jim Jagielski, Stefan Fritsch] + *) mod_header: Allow for exposure of loadavg and server load using new format specifiers %l, %i, %b [Jim Jagielski] diff --git a/STATUS b/STATUS index da8d39227e..f11711f680 100644 --- a/STATUS +++ b/STATUS @@ -91,12 +91,6 @@ RELEASE SHOWSTOPPERS: PATCHES ACCEPTED TO BACKPORT FROM TRUNK: [ start all new proposals below, under PATCHES PROPOSED. ] - * various mods: host and URI escaping - trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1413732 - http://svn.apache.org/viewvc?view=revision&revision=1418752 - 2.4.x patch: trunk works sans mod_policy - +1 covener, minfrin, sf - * (2/x) backport some easy patch to keep 2.4.x in line with trunk as much as possible 1398970: Use 'ap_strcasestr' instead of a strdup/str_tolower/strstr sequence 1407853: cppCheck: Suspicious condition. diff --git a/modules/generators/mod_info.c b/modules/generators/mod_info.c index 75c37782bc..2f2db9fa61 100644 --- a/modules/generators/mod_info.c +++ b/modules/generators/mod_info.c @@ -459,7 +459,8 @@ static int show_server_settings(request_rec * r) MODULE_MAGIC_NUMBER_MINOR); ap_rprintf(r, "
Hostname/port: " - "%s:%u
\n", ap_get_server_name(r), + "%s:%u\n", + ap_escape_html(r->pool, ap_get_server_name(r)), ap_get_server_port(r)); ap_rprintf(r, "
Timeouts: " diff --git a/modules/generators/mod_status.c b/modules/generators/mod_status.c index 8b39db43a9..54404e90bb 100644 --- a/modules/generators/mod_status.c +++ b/modules/generators/mod_status.c @@ -400,7 +400,8 @@ static int status_handler(request_rec *r) "Apache Status\n" "\n" "

Apache Server Status for ", r); - ap_rvputs(r, ap_get_server_name(r), " (via ", r->connection->local_ip, + ap_rvputs(r, ap_escape_html(r->pool, ap_get_server_name(r)), + " (via ", r->connection->local_ip, ")

\n\n", NULL); ap_rvputs(r, "
Server Version: ", ap_get_server_description(), "
\n", NULL); diff --git a/modules/ldap/util_ldap_cache_mgr.c b/modules/ldap/util_ldap_cache_mgr.c index 826757704f..ae7e652aec 100644 --- a/modules/ldap/util_ldap_cache_mgr.c +++ b/modules/ldap/util_ldap_cache_mgr.c @@ -604,7 +604,7 @@ char *util_ald_cache_display_stats(request_rec *r, util_ald_cache_t *cache, char if (id) { buf2 = apr_psprintf(p, "%s", - r->uri, + ap_escape_html(r->pool, ap_escape_uri(r->pool, r->uri)), id, name); } diff --git a/modules/mappers/mod_imagemap.c b/modules/mappers/mod_imagemap.c index d7b01dd665..9edb3e9f7e 100644 --- a/modules/mappers/mod_imagemap.c +++ b/modules/mappers/mod_imagemap.c @@ -338,7 +338,7 @@ static char *imap_url(request_rec *r, const char *base, const char *value) if (!strcasecmp(value, "referer")) { referer = apr_table_get(r->headers_in, "Referer"); if (referer && *referer) { - return ap_escape_html(r->pool, referer); + return referer; } else { /* XXX: This used to do *value = '\0'; ... which is totally bogus @@ -521,40 +521,50 @@ static void menu_comment(request_rec *r, char *menu, char *comment) static void menu_default(request_rec *r, char *menu, char *href, char *text) { + char *ehref, *etext; if (!strcasecmp(href, "error") || !strcasecmp(href, "nocontent")) { return; /* don't print such lines, these aren't really href's */ } + + ehref = ap_escape_uri(r->pool, href); + etext = ap_escape_html(r->pool, text); + if (!strcasecmp(menu, "formatted")) { - ap_rvputs(r, "
(Default) ", text,
-               "
\n", NULL); + ap_rvputs(r, "
(Default) ", etext,
+                     "
\n", NULL); } else if (!strcasecmp(menu, "semiformatted")) { - ap_rvputs(r, "
(Default) ", text,
+        ap_rvputs(r, "
(Default) ", etext,
                "
\n", NULL);
     }
     else if (!strcasecmp(menu, "unformatted")) {
-        ap_rvputs(r, "", text, "", NULL);
+        ap_rvputs(r, "", etext, "", NULL);
     }
     return;
 }
 
 static void menu_directive(request_rec *r, char *menu, char *href, char *text)
 {
+    char *ehref, *etext;
     if (!strcasecmp(href, "error") || !strcasecmp(href, "nocontent")) {
         return;                 /* don't print such lines, as this isn't
                                    really an href */
     }
+
+    ehref = ap_escape_uri(r->pool, href);
+    etext = ap_escape_html(r->pool, text);
+
     if (!strcasecmp(menu, "formatted")) {
-        ap_rvputs(r, "
          ", text,
+        ap_rvputs(r, "
          ", etext,
                "
\n", NULL);
     }
     else if (!strcasecmp(menu, "semiformatted")) {
-        ap_rvputs(r, "
          ", text,
+        ap_rvputs(r, "
          ", etext,
                "
\n", NULL);
     }
     else if (!strcasecmp(menu, "unformatted")) {
-        ap_rvputs(r, "", text, "", NULL);
+        ap_rvputs(r, "", etext, "", NULL);
     }
     return;
 }
diff --git a/modules/proxy/mod_proxy_balancer.c b/modules/proxy/mod_proxy_balancer.c
index bc82756b90..9b5c5164f7 100644
--- a/modules/proxy/mod_proxy_balancer.c
+++ b/modules/proxy/mod_proxy_balancer.c
@@ -1244,7 +1244,8 @@ static int balancer_handler(request_rec *r)
                  "}\n"
                  "\n\n", r);
         ap_rputs("
Load Balancer Manager for ", r);
-        ap_rvputs(r, ap_get_server_name(r), "
\n\n", NULL);
+        ap_rvputs(r, ap_escape_html(r->pool, ap_get_server_name(r)),
+                  "\n\n", NULL);
         ap_rvputs(r, "
Server Version: ",
                   ap_get_server_description(), "
\n", NULL);
         ap_rvputs(r, "
Server Built: ",
@@ -1253,10 +1254,10 @@ static int balancer_handler(request_rec *r)
         for (i = 0; i < conf->balancers->nelts; i++) {
 
             ap_rputs("
\n
LoadBalancer Status for ", r);
-            ap_rvputs(r, "", NULL);
+                      "\">", NULL);
             ap_rvputs(r, balancer->s->name, "
\n", NULL);
             ap_rputs("\n\n"
                 ""
@@ -1303,11 +1304,12 @@ static int balancer_handler(request_rec *r)
             for (n = 0; n < balancer->workers->nelts; n++) {
                 char fbuf[50];
                 worker = *workers;
-                ap_rvputs(r, "\n", NULL);
                 ap_rvputs(r, "
MaxMembersStickySessionDisableFailoverTimeoutFailoverAttemptsMethod
", NULL);
+                          "\">", NULL);
                 ap_rvputs(r, worker->s->name, "", ap_escape_html(r->pool, worker->s->route),
                           NULL);
@@ -1334,20 +1336,20 @@ static int balancer_handler(request_rec *r)
         if (wsel && bsel) {
             ap_rputs("
Edit worker settings for ", r);
             ap_rvputs(r, wsel->s->name, "
\n", NULL);
-            ap_rputs("
\n", NULL);
+            ap_rputs("pool, action), "\">\n", NULL);
             ap_rputs("
\n\n", wsel->s->lbfactor);
             ap_rputs("\n", wsel->s->lbset);
             ap_rputs("\n", r);
+            ap_rputs("\">\n", r);
             ap_rputs("\n", r);
+            ap_rputs("\">\n", r);
             ap_rputs("", r);
             ap_rputs("
Load factor:
LB Set:
Route:
Route Redirect:
Status:\n", r);
             create_radio("w_status_I", (PROXY_WORKER_IGNORE_ERRORS & wsel->s->status), r);
diff --git a/modules/proxy/mod_proxy_ftp.c b/modules/proxy/mod_proxy_ftp.c
index 33237d6ff7..b342a1c9d0 100644
--- a/modules/proxy/mod_proxy_ftp.c
+++ b/modules/proxy/mod_proxy_ftp.c
@@ -530,7 +530,9 @@ static apr_status_t proxy_send_dir_filter(ap_filter_t *f,
                 " \n"
                 " \n  
Directory of "
                 "%s/%s",
-                site, basedir, escpath, site, basedir, escpath, site, str);
+                ap_escape_html(p, site), basedir, escpath,
+                ap_escape_uri(p, site), basedir, escpath,
+                ap_escape_uri(p, site), str);
 
         APR_BRIGADE_INSERT_TAIL(out, apr_bucket_pool_create(str, strlen(str),
                                                           p, c->bucket_alloc));

IgnDrnDisStby