www-apache-bugdb mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From Paul Stewart <stew...@parc.xerox.com>
Subject mod_cgi/8531: CGI PATH_INFO translates "/foocgi/bar//../baz" into "/foocgi/bar/baz/"
Date Sat, 13 Oct 2001 19:31:31 GMT

>Number:         8531
>Category:       mod_cgi
>Synopsis:       CGI PATH_INFO translates "/foocgi/bar//../baz" into "/foocgi/bar/baz/"
>Confidential:   no
>Severity:       non-critical
>Priority:       medium
>Responsible:    apache
>State:          open
>Class:          sw-bug
>Submitter-Id:   apache
>Arrival-Date:   Sat Oct 13 12:40:00 PDT 2001
>Originator:     stewart@parc.xerox.com
>Release:        1.3.19
Linux / RedHat 7.1 dist
When "cleaning up" PATH_INFO for a CGI script, Apache fails to gobble up "//"
entries.  While not a real problem in itself, it treats "//" as a first-class
path component when gobbling up "../" entries.  This means that a CGI script
passed a path "/bar//../baz" is now passed "/bar/baz" instead of the correct
With a trivial CGI script:

  my $filePath = $ENV{PATH_INFO};
  print "Content-Type: text/plain\n\nInitial file path: $filePath\n";

Then (if the script is http://host/cgi-bin/test.cgi) perform GETs of
Gobble up "//" first.
 [In order for any reply to be added to the PR database, you need]
 [to include <apbugs@Apache.Org> in the Cc line and make sure the]
 [subject line starts with the report component and number, with ]
 [or without any 'Re:' prefixes (such as "general/1098:" or      ]
 ["Re: general/1098:").  If the subject doesn't match this       ]
 [pattern, your message will be misfiled and ignored.  The       ]
 ["apbugs" address is not added to the Cc line of messages from  ]
 [the database automatically because of the potential for mail   ]
 [loops.  If you do not include this Cc, your reply may be ig-   ]
 [nored unless you are responding to an explicit request from a  ]
 [developer.  Reply only with text; DO NOT SEND ATTACHMENTS!     ]

View raw message