Return-Path: 
 <dev-return-79539-apmail-httpd-dev-archive=httpd.apache.org@httpd.apache.org>
X-Original-To: apmail-httpd-dev-archive@www.apache.org
Delivered-To: apmail-httpd-dev-archive@www.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id 9E5B910F52
	for <apmail-httpd-dev-archive@www.apache.org>;
 Wed,  1 Jan 2014 12:07:03 +0000 (UTC)
Received: (qmail 22799 invoked by uid 500); 1 Jan 2014 12:06:55 -0000
Delivered-To: apmail-httpd-dev-archive@httpd.apache.org
Received: (qmail 22740 invoked by uid 500); 1 Jan 2014 12:06:52 -0000
Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
list-help: <mailto:dev-help@httpd.apache.org>
list-unsubscribe: <mailto:dev-unsubscribe@httpd.apache.org>
List-Post: <mailto:dev@httpd.apache.org>
List-Id: <dev.httpd.apache.org>
Delivered-To: mailing list dev@httpd.apache.org
Received: (qmail 22732 invoked by uid 99); 1 Jan 2014 12:06:51 -0000
Received: from nike.apache.org (HELO nike.apache.org) (192.87.106.230)
    by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 01 Jan 2014 12:06:51 +0000
X-ASF-Spam-Status: No, hits=-0.0 required=5.0
	tests=SPF_HELO_PASS,SPF_PASS
X-Spam-Check-By: apache.org
Received-SPF: pass (nike.apache.org: domain of minfrin@sharp.fm designates
 174.143.229.200 as permitted sender)
Received: from [174.143.229.200] (HELO chandler.sharp.fm) (174.143.229.200)
    by apache.org (qpsmtpd/0.29) with ESMTP; Wed, 01 Jan 2014 12:06:44 +0000
Received: from chandler.sharp.fm (localhost [127.0.0.1])
	by chandler.sharp.fm (Postfix) with ESMTP id 7AACC2B956D
	for <dev@httpd.apache.org>; Wed,  1 Jan 2014 06:06:23 -0600 (CST)
Received: from [172.20.10.4] (unknown [41.117.72.183])
	(using TLSv1 with cipher AES128-SHA (128/128 bits))
	(Client did not present a certificate)
	(Authenticated sender: minfrin@sharp.fm)
	by chandler.sharp.fm (Postfix) with ESMTP id 33CDC2B956C
	for <dev@httpd.apache.org>; Wed,  1 Jan 2014 06:06:21 -0600 (CST)
Content-Type: text/plain; charset=us-ascii
Mime-Version: 1.0 (Mac OS X Mail 6.6 \(1510\))
Subject: Re: svn commit: r1554300 - in /httpd/httpd/trunk: CHANGES
 include/ap_mmn.h include/ap_regex.h include/http_core.h
 modules/proxy/mod_proxy.c modules/proxy/mod_proxy.h server/core.c
 server/request.c server/util_pcre.c
From: Graham Leggett <minfrin@sharp.fm>
In-Reply-To: <6375995.kYODS9EMga@k>
Date: Wed, 1 Jan 2014 14:06:17 +0200
Content-Transfer-Encoding: quoted-printable
Message-Id: <D8B306D6-DC0C-4C3E-8F3C-6408FA2C7B18@sharp.fm>
References: <20131230195053.8FBE123889CB@eris.apache.org>
 <6375995.kYODS9EMga@k>
To: dev@httpd.apache.org
X-Mailer: Apple Mail (2.1510)
X-Virus-Scanned: ClamAV using ClamSMTP
X-Virus-Checked: Checked by ClamAV on apache.org

On 01 Jan 2014, at 1:59 PM, Stefan Fritsch <sf@sfritsch.de> wrote:

> I definitely like this idea. While I haven't done a full review of the=20=

> patch, I have a few questions:
>=20
> Aren't the apr_table keys case insensitive anyway? Why do we need the=20=

> case conversion of the key names?

All the variables in subprocess_env are all uppecased, before I added =
the uppercasing the variables were the only ones lowercased when they =
were listed and it looked wrong.

> Maybe making ap_regname() accept an optional prefix string that is=20
> prepended to each name would be a good idea?
>=20
> Maybe the use in <LocationMatch> and friends should add some prefix to=20=

> the names? Like "m_" or "match_" or "m:"? This would make it more=20
> difficult to shoot oneself in the foot by allowing a remote attacker=20=

> to set env variables that have some special meanings elsewhere in=20
> httpd (or in an executed cgi script). And/or maybe these values should=20=

> be filtered out again when exporting them to cgi env variables?

I wondered about this, on one hand it is nice to be able to set any =
variable, but on the other hand there is a lot of safety in preventing =
someone from being able to shadow an existing variable. I had =
"MATCH_FOO" in mind originally.

Regards,
Graham
--