Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
MIME-Version: 1.0
In-Reply-To: 
 <CACsi250e4NqJiOe39CHpNcWkfv1E2t62tsT0+5+hZ=uKsHc2qA@mail.gmail.com>
References: 
 <CAP__2DWMnM6Pm=cM-bLtUiP2znYCKDbEPZM5HG7NXx6az_s1wg@mail.gmail.com>
	<CACsi252B_rKioMZ9aoeVrv4Ov86JFFg9=Na1-wBS-eVMEO5PmQ@mail.gmail.com>
	<CACsi253JKUdLwHv1BP+Edo4BKLjrpwZijtkE0O19m7bKbzM8=A@mail.gmail.com>
	<CACsi250jfG5rwoqQOHB3M6EiKfAEgzw4GTwNTEf=3EHMT-=EDQ@mail.gmail.com>
	<CALK=YjObnKw=ofJgxke6PiPy7Qf_Ft1LvybkMLR4XSxMH913=g@mail.gmail.com>
	<CACsi251rGaWfoyt5eq4-xKgcKCFp34BNqEkbWUX2J=PcZNK-Pg@mail.gmail.com>
	<CACsi250e4NqJiOe39CHpNcWkfv1E2t62tsT0+5+hZ=uKsHc2qA@mail.gmail.com>
Date: Mon, 8 Feb 2016 11:32:58 -0600
Message-ID: 
 <CACsi250Mo-cU_=X10O68huUEXMzqSPC+xsATYKk8kh4AUwgH5Q@mail.gmail.com>
Subject: Re: Improper string concatenation in mod_alias allows code execution
 out of bounds defined in apache config file.
From: William A Rowe Jr <wrowe@rowe-clan.net>
To: docs@httpd.apache.org, httpd <dev@httpd.apache.org>
Content-Type: multipart/alternative; boundary=001a11409b988d1cb7052b459743

--001a11409b988d1cb7052b459743
Content-Type: text/plain; charset=UTF-8

On Mon, Feb 8, 2016 at 11:21 AM, William A Rowe Jr <wrowe@rowe-clan.net>
wrote:

> I think my text below should have stated;
>
> Note that unexpected expansion occurs when trailing slashes are
> not balanced between the source url and target path.  For example,
> Alias / /usr/share/htdocs
> will resolve http://example.com/-private/ as /usr/share/htdocs-private/
> while
> Alias /content/ /usr/share/htdocs
> will similarly result in the the URL /content/-private/ resolving to the
> path /usr/share/htdocs-private/
>
> The statement could use some word-smithing.
>

An actual use-case that may exist in the wild would like;

Alias /user/ /path/to/users-

where

http://example.com/user/wrowe/ would map to /path/to/users-wrowe

Or some similar scenario to map to .../webapp-wrowe.  Lots of possible
but rare applications.

If we were to lock this behavior down with warnings, we might want
to introduce a run-immediate directive "AliasWarnConcatenation off"
that allows the "wiser" administrator to go without our stern warnings.

--001a11409b988d1cb7052b459743
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On M=
on, Feb 8, 2016 at 11:21 AM, William A Rowe Jr <span dir=3D"ltr">&lt;<a hre=
f=3D"mailto:wrowe@rowe-clan.net" target=3D"_blank">wrowe@rowe-clan.net</a>&=
gt;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0 0 =
0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir=3D"ltr"><div><=
div><div>I think my text below should have stated;</div><div><br></div><div=
><span style=3D"color:rgb(80,0,80)">Note that unexpected expansion occurs w=
hen trailing slashes=C2=A0</span><span style=3D"color:rgb(80,0,80)">are=C2=
=A0</span></div><div><span style=3D"color:rgb(80,0,80)">not balanced betwee=
n the source url and target path.=C2=A0 For example,</span></div><div><span=
 style=3D"color:rgb(80,0,80)">Alias / /usr/share/htdocs</span></div><div><s=
pan style=3D"color:rgb(80,0,80)">will resolve <a href=3D"http://example.com=
/-private/" target=3D"_blank">http://example.com/-private/</a> as /usr/shar=
e/htdocs-private/</span></div><div><span style=3D"color:rgb(80,0,80)">while=
=C2=A0</span></div><div><span style=3D"color:rgb(80,0,80)">Alias /content/ =
/usr/share/htdocs</span><br></div><div><font color=3D"#500050">will similar=
ly result in the the URL /content/-private/ resolving to the</font></div><d=
iv><span style=3D"color:rgb(80,0,80)">path /usr/share/htdocs-private/</span=
></div><div><br></div><div>The statement could use some word-smithing.</div=
></div></div></div></blockquote><div><br></div><div>An actual use-case that=
 may exist in the wild would like;</div><div><br></div><div>Alias /user/ /p=
ath/to/users-</div><div><br></div><div>where=C2=A0</div><div><br></div><div=
><a href=3D"http://example.com/user/wrowe/">http://example.com/user/wrowe/<=
/a> would map to /path/to/users-wrowe</div><div><br></div><div>Or some simi=
lar scenario to map to .../webapp-wrowe.=C2=A0 Lots of possible</div><div>b=
ut rare applications.</div><div><br></div><div>If we were to lock this beha=
vior down with warnings, we might want<br></div><div>to introduce a run-imm=
ediate directive &quot;AliasWarnConcatenation off&quot;</div><div>that allo=
ws the &quot;wiser&quot; administrator to go without our stern warnings.</d=
iv><div><br></div><div><br></div></div></div></div>

--001a11409b988d1cb7052b459743--