Mailing-List: contact dev-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@httpd.apache.org
MIME-Version: 1.0
In-Reply-To: <d0724677-23a4-c77c-5685-d73a5fb4f6e8@gmail.com>
References: <20160701150043.006B13A01DD@svn01-us-west.apache.org>
 <CAFedD40mRSik2G_0TMi=DiYgPtpRUoWoGLVA1okEBK4ySmuNxg@mail.gmail.com>
 <20295b01-7ba0-516c-9e4f-1561bc86f048@gmail.com> <CACsi252KPTmhzQRaPyngfEB9iMxgZ2HcAaNX+XMASqtAi+2wzg@mail.gmail.com>
 <a142e7fa-0a51-bf42-f495-6183c644023a@gmail.com> <CAKQ1sVObQ=M8NSsBL2i3K+-p-VfY+MWf1auy8ssgdGjjQtohHw@mail.gmail.com>
 <CACsi252VyfXnHHVA2S1dGgOXq0eiiPxWYHKF1uVLfmdmKdz=XQ@mail.gmail.com>
 <CAFedD409yGp1PvNap5AeFRoreKi0ODcmKMQ_FR-=fDminLh=bg@mail.gmail.com>
 <CACsi252HDQL=4g+Ytkh6=Dw2CMHTxwK+wTqe98P6AUQBPeGG5w@mail.gmail.com>
 <CAFedD41XmoNiA5Y45mc6MnsFCpuf6vsyFDH547Z7vby6L5xAmg@mail.gmail.com>
 <CACsi251rHjKDhRVYMg8HKwHyeDWpDmHjkgmtihEsnSTGsgDzCA@mail.gmail.com>
 <2AD2DD6E-56DA-431D-853B-8D2B552D847A@greenbytes.de> <CAFedD40Vw4m8SKb==VJb9HvX0efttdVHPLfrq+md+1xZQ2dmiQ@mail.gmail.com>
 <dbc9c7d1-643a-d001-8c0f-338a1ea1a2d8@gmail.com> <CACsi251Fap3T10UbC4ishC2=tjczA8bSTZm_k1FKx29B-6UJ0Q@mail.gmail.com>
 <d0724677-23a4-c77c-5685-d73a5fb4f6e8@gmail.com>
From: William A Rowe Jr <wrowe@rowe-clan.net>
Date: Mon, 1 Aug 2016 15:17:48 -0500
Message-ID: <CACsi252TxJX+PpvEVHdc8WiwLFh9nvdzpd9FHOx2u-Uc7wSi3w@mail.gmail.com>
Subject: Re: svn commit: r1750953 - /httpd/httpd/trunk/server/util_script.c
To: httpd <dev@httpd.apache.org>
Content-Type: multipart/alternative; boundary=94eb2c05aa2a4c25420539084b45
archived-at: Mon, 01 Aug 2016 20:18:01 -0000

--94eb2c05aa2a4c25420539084b45
Content-Type: text/plain; charset=UTF-8

On Mon, Aug 1, 2016 at 3:03 PM, Jacob Champion <champion.p@gmail.com> wrote:

> On 08/01/2016 12:38 PM, William A Rowe Jr wrote:
>
>> I'll review the rest of your comments shortly, but you might want to
>> review
>> https://tools.ietf.org/html/rfc3875 before claiming CGI isn't an HTTP
>> input :-)
>>
>
> I suspect we're talking past each other at this point. I'm aware of 3875
> (though I don't claim to be an expert), and I quoted it in my response. I
> am using the term "HTTP input" in response to your much earlier statement
> that
>
> (We aren't talking about non-HTTP sources.)
>>
>
> We *are* talking about non-HTTP sources. CGI is *not* HTTP. It obviously
> shares a great deal of syntax, but a CGI application is neither an HTTP
> client nor an HTTP server, and it does not speak HTTP to our server.
> Therefore CGI is not an "HTTP input" and we are not bound by 723x's
> requirements for parsing date-stamps that originate from it -- which, IIUC,
> was your argument. The wisdom of doing so (or not) is a completely separate
> issue, outside the bounds of the spec.
>

We are bound by RFC 3875, which says...

 6.3.4.  Protocol-Specific Header Fields

   The script MAY return any other header fields that relate to the
   response message defined by the specification for the SERVER_PROTOCOL
   (HTTP/1.0 [1] or HTTP/1.1 [4]).  The server MUST translate the header
   data from the CGI header syntax to the HTTP header syntax if these
   differ.  For example, the character sequence for newline (such as
   UNIX's US-ASCII LF) used by CGI scripts may not be the same as that
   used by HTTP (US-ASCII CR followed by LF).

E.g. no accommodation of non-HTTP input as header fields, other than
to avoid hop-by-hop server <> client header fields, which httpd is required
to dodge.

--94eb2c05aa2a4c25420539084b45
Content-Type: text/html; charset=UTF-8
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div class=3D"gmail_extra"><div class=3D"gmail_quote">On M=
on, Aug 1, 2016 at 3:03 PM, Jacob Champion <span dir=3D"ltr">&lt;<a href=3D=
"mailto:champion.p@gmail.com" target=3D"_blank">champion.p@gmail.com</a>&gt=
;</span> wrote:<br><blockquote class=3D"gmail_quote" style=3D"margin:0px 0p=
x 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"><span =
class=3D"gmail-">On 08/01/2016 12:38 PM, William A Rowe Jr wrote:<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left:1px solid rgb(204,204,204);padding-left:1ex">
I&#39;ll review the rest of your comments shortly, but you might want to re=
view<br>
<a href=3D"https://tools.ietf.org/html/rfc3875" rel=3D"noreferrer" target=
=3D"_blank">https://tools.ietf.org/html/rfc3875</a> before claiming CGI isn=
&#39;t an HTTP<br>
input :-)<br>
</blockquote>
<br></span>
I suspect we&#39;re talking past each other at this point. I&#39;m aware of=
 3875 (though I don&#39;t claim to be an expert), and I quoted it in my res=
ponse. I am using the term &quot;HTTP input&quot; in response to your much =
earlier statement that<span class=3D"gmail-"><br>
<br>
<blockquote class=3D"gmail_quote" style=3D"margin:0px 0px 0px 0.8ex;border-=
left:1px solid rgb(204,204,204);padding-left:1ex">
(We aren&#39;t talking about non-HTTP sources.)<br>
</blockquote>
<br></span>
We *are* talking about non-HTTP sources. CGI is *not* HTTP. It obviously sh=
ares a great deal of syntax, but a CGI application is neither an HTTP clien=
t nor an HTTP server, and it does not speak HTTP to our server. Therefore C=
GI is not an &quot;HTTP input&quot; and we are not bound by 723x&#39;s requ=
irements for parsing date-stamps that originate from it -- which, IIUC, was=
 your argument. The wisdom of doing so (or not) is a completely separate is=
sue, outside the bounds of the spec.<br></blockquote><div><br></div><div>We=
 are bound by RFC 3875, which says...</div><div><br></div><div>=C2=A06.3.4.=
=C2=A0 Protocol-Specific Header Fields</div><div><br></div><div>=C2=A0 =C2=
=A0The script MAY return any other header fields that relate to the</div><d=
iv>=C2=A0 =C2=A0response message defined by the specification for the SERVE=
R_PROTOCOL</div><div>=C2=A0 =C2=A0(HTTP/1.0 [1] or HTTP/1.1 [4]).=C2=A0 The=
 server MUST translate the header</div><div>=C2=A0 =C2=A0data from the CGI =
header syntax to the HTTP header syntax if these</div><div>=C2=A0 =C2=A0dif=
fer.=C2=A0 For example, the character sequence for newline (such as</div><d=
iv>=C2=A0 =C2=A0UNIX&#39;s US-ASCII LF) used by CGI scripts may not be the =
same as that</div><div>=C2=A0 =C2=A0used by HTTP (US-ASCII CR followed by L=
F).</div></div><br></div><div class=3D"gmail_extra">E.g. no accommodation o=
f non-HTTP input as header fields, other than</div><div class=3D"gmail_extr=
a">to avoid hop-by-hop server &lt;&gt; client header fields, which httpd is=
 required</div><div class=3D"gmail_extra">to dodge.</div><div class=3D"gmai=
l_extra"><br></div><div class=3D"gmail_extra"><br></div><div class=3D"gmail=
_extra"><br></div></div>

--94eb2c05aa2a4c25420539084b45--