You are viewing a plain text version of this content. The canonical link for it is here.

Posted to cvs@httpd.apache.org by hu...@apache.org on 2012/08/12 09:45:55 UTC

svn commit: r1372054 - in /httpd/httpd/trunk: CHANGES server/util.c

Author: humbedooh
Date: Sun Aug 12 07:45:55 2012
New Revision: 1372054

URL: http://svn.apache.org/viewvc?rev=1372054&view=rev
Log:
core:
Be less strict when checking whether Content-Type is set to "application/x-www-form-urlencoded" 
when parsing POST data, or we risk losing data with an appended charset.

PR 53698
Reported by: Petter Berntsen < sluggr gmail.com >

Modified:
    httpd/httpd/trunk/CHANGES
    httpd/httpd/trunk/server/util.c

Modified: httpd/httpd/trunk/CHANGES
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/CHANGES?rev=1372054&r1=1372053&r2=1372054&view=diff
==============================================================================
--- httpd/httpd/trunk/CHANGES [utf-8] (original)
+++ httpd/httpd/trunk/CHANGES [utf-8] Sun Aug 12 07:45:55 2012
@@ -1,6 +1,11 @@
                                                          -*- coding: utf-8 -*-
 Changes with Apache 2.5.0
 
+  *) core: Be less strict when checking whether Content-Type is set to 
+     "application/x-www-form-urlencoded" when parsing POST data, 
+     or we risk losing data with an appended charset. PR 53698
+     [Petter Berntsen <sluggr gmail.com>]
+
   *) Windows: Fix SSL failures on windows with AcceptFilter https none.
      PR: 52476.  [Jeff Trawick]
 

Modified: httpd/httpd/trunk/server/util.c
URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/server/util.c?rev=1372054&r1=1372053&r2=1372054&view=diff
==============================================================================
--- httpd/httpd/trunk/server/util.c (original)
+++ httpd/httpd/trunk/server/util.c Sun Aug 12 07:45:55 2012
@@ -2406,7 +2406,7 @@ AP_DECLARE(int) ap_parse_form_data(reque
 
     /* sanity check - we only support forms for now */
     ct = apr_table_get(r->headers_in, "Content-Type");
-    if (!ct || strcmp("application/x-www-form-urlencoded", ct)) {
+    if (!ct || ap_strcmp_match(ct, "application/x-www-form-urlencoded*")) {
         return ap_discard_request_body(r);
     }

Re: svn commit: r1372054 - in /httpd/httpd/trunk: CHANGES server/util.c

Posted by Daniel Gruno <ru...@cord.dk>.

On 08/12/2012 03:15 PM, Ruediger Pluem wrote:
> 
> 
> humbedooh@apache.org wrote:
>> Author: humbedooh
>> Date: Sun Aug 12 07:45:55 2012
>> New Revision: 1372054
>>
>> URL: http://svn.apache.org/viewvc?rev=1372054&view=rev
>> Log:
>> core:
>> Be less strict when checking whether Content-Type is set to "application/x-www-form-urlencoded" 
>> when parsing POST data, or we risk losing data with an appended charset.
>>
>> PR 53698
>> Reported by: Petter Berntsen < sluggr gmail.com >
>>
>> Modified:
>>     httpd/httpd/trunk/CHANGES
>>     httpd/httpd/trunk/server/util.c
>>
> 
>> Modified: httpd/httpd/trunk/server/util.c
>> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/server/util.c?rev=1372054&r1=1372053&r2=1372054&view=diff
>> ==============================================================================
>> --- httpd/httpd/trunk/server/util.c (original)
>> +++ httpd/httpd/trunk/server/util.c Sun Aug 12 07:45:55 2012
>> @@ -2406,7 +2406,7 @@ AP_DECLARE(int) ap_parse_form_data(reque
>>  
>>      /* sanity check - we only support forms for now */
>>      ct = apr_table_get(r->headers_in, "Content-Type");
>> -    if (!ct || strcmp("application/x-www-form-urlencoded", ct)) {
>> +    if (!ct || ap_strcmp_match(ct, "application/x-www-form-urlencoded*")) {
> 
> ap_strcmp_match seems to be a lot of overhead for just prefix matching a string.
> How about
> 
>  strncmp("application/x-www-form-urlencoded", ct, 33)
> 
> instead.
> 
> Regards
> 
> Rüdiger
> 
Yeah, that approach seems better. Took me a couple of tries to commit
the right version though - I blame the lack of coffee coupled with heavy
partying last night.

With regards
Daniel.

RE: svn commit: r1372054 - in /httpd/httpd/trunk: CHANGES server/util.c

Posted by Plüm, Rüdiger, Vodafone Group <ru...@vodafone.com>.


> -----Original Message-----
> From: Nick Kew [mailto:nick@webthing.com]
> Sent: Montag, 13. August 2012 13:11
> To: dev@httpd.apache.org
> Subject: Re: svn commit: r1372054 - in /httpd/httpd/trunk: CHANGES
> server/util.c
> 
> 
> On 12 Aug 2012, at 14:15, Ruediger Pluem wrote:
> 
> > ap_strcmp_match seems to be a lot of overhead for just prefix matching
> a string.
> > How about
> >
> > strncmp("application/x-www-form-urlencoded", ct, 33)
> 
> Either way, shouldn't it be a case-insensitive match?

Good point.

Regards

Rüdiger

Re: svn commit: r1372054 - in /httpd/httpd/trunk: CHANGES server/util.c

Posted by Nick Kew <ni...@webthing.com>.

On 12 Aug 2012, at 14:15, Ruediger Pluem wrote:

> ap_strcmp_match seems to be a lot of overhead for just prefix matching a string.
> How about
> 
> strncmp("application/x-www-form-urlencoded", ct, 33)

Either way, shouldn't it be a case-insensitive match?

-- 
Nick Kew

Re: svn commit: r1372054 - in /httpd/httpd/trunk: CHANGES server/util.c

Posted by Ruediger Pluem <rp...@apache.org>.


humbedooh@apache.org wrote:
> Author: humbedooh
> Date: Sun Aug 12 07:45:55 2012
> New Revision: 1372054
> 
> URL: http://svn.apache.org/viewvc?rev=1372054&view=rev
> Log:
> core:
> Be less strict when checking whether Content-Type is set to "application/x-www-form-urlencoded" 
> when parsing POST data, or we risk losing data with an appended charset.
> 
> PR 53698
> Reported by: Petter Berntsen < sluggr gmail.com >
> 
> Modified:
>     httpd/httpd/trunk/CHANGES
>     httpd/httpd/trunk/server/util.c
> 

> Modified: httpd/httpd/trunk/server/util.c
> URL: http://svn.apache.org/viewvc/httpd/httpd/trunk/server/util.c?rev=1372054&r1=1372053&r2=1372054&view=diff
> ==============================================================================
> --- httpd/httpd/trunk/server/util.c (original)
> +++ httpd/httpd/trunk/server/util.c Sun Aug 12 07:45:55 2012
> @@ -2406,7 +2406,7 @@ AP_DECLARE(int) ap_parse_form_data(reque
>  
>      /* sanity check - we only support forms for now */
>      ct = apr_table_get(r->headers_in, "Content-Type");
> -    if (!ct || strcmp("application/x-www-form-urlencoded", ct)) {
> +    if (!ct || ap_strcmp_match(ct, "application/x-www-form-urlencoded*")) {

ap_strcmp_match seems to be a lot of overhead for just prefix matching a string.
How about

 strncmp("application/x-www-form-urlencoded", ct, 33)

instead.

Regards

Rüdiger