DO NOT REPLY [Bug 50851] mod_proxy_fcgi does not comply with RFC 3875 (CGI 1.1)

[bu...@apache.org]

https://issues.apache.org/bugzilla/show_bug.cgi?id=50851

--- Comment #1 from Mark Montague <ma...@catseye.org> 2011-03-01 15:33:29 EST ---
Created an attachment (id=26700)
 --> (https://issues.apache.org/bugzilla/attachment.cgi?id=26700)
Prevent mod_proxy_fcgi from setting PATH_INFO

The attached patch fixes the problem by removing the code from
modules/proxy/mod_proxy_fcgi.c that sets PATH_INFO.  With PATH_INFO not set,
server/util_script.c:ap_add_cgi_vars() no longer sets SCRIPT_NAME incorrectly,
and it no longer sets PATH_TRANSLATED at all.

This patch results in the following changes to the environment variables in the
original problem description (changes are in a unified diff like format):

-PATH_INFO=/www/php-ssl/hello.php/some/info
-PATH_TRANSLATED=/www/html-ssl/www/php-ssl/hello.php/some/info
-SCRIPT_NAME=/test
+SCRIPT_NAME=/test/hello.php/some/info

The script-URI constructed according to the instructions in RFC 3875 then
becomes:

https://f14dev1.catseye.org:443/test/hello.php/some/info?foo=bar&rod=moby

...which is correct.

I believe this to be an acceptable solution to the problem because section
4.1.5 of RFC 3875 says that PATH INFO "identifies the resource or sub-resource
to be returned by the CGI script, and is derived from the portion of the URI
path hierarchy following the part that identifies the script itself".  Since
the proxy cannot know what portion of the URI path represents the script, not
setting PATH_INFO seems better than setting it to a value that does not meet
this definition, especially since "the server MAY impose restrictions and
limitations on what values it permits for PATH_INFO".


The complete list of environment variables generated after the patch is applied
when the user requests

https://f14dev1.catseye.org/test/hello.php/some/info?foo=bar&rod=moby

is:

HTTPS=on
SSL_TLS_SNI=f14dev1.catseye.org
HTTP_HOST=f14dev1.catseye.org
HTTP_USER_AGENT=Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10.6; en-US;
rv:1.9.2.13) Gecko/20101203 Firefox/3.6.13
HTTP_ACCEPT=text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
HTTP_ACCEPT_LANGUAGE=en-us,en;q=0.7,ja;q=0.3
HTTP_ACCEPT_ENCODING=gzip,deflate
HTTP_ACCEPT_CHARSET=ISO-8859-1,utf-8;q=0.7,*;q=0.7
HTTP_KEEP_ALIVE=115
HTTP_CONNECTION=keep-alive
PATH=/sbin:/usr/sbin:/bin:/usr/bin
SERVER_SIGNATURE=<address>Apache/2.3.10 (Fedora) Server at <a
href="mailto:webmaster@catseye.org">f14dev1.catseye.org</a> Port
443</address>#012
SERVER_SOFTWARE=Apache/2.3.10 (Fedora)
SERVER_NAME=f14dev1.catseye.org
SERVER_ADDR=172.16.168.128
SERVER_PORT=443
REMOTE_ADDR=172.16.168.1
DOCUMENT_ROOT=/www/html-ssl
SERVER_ADMIN=webmaster@catseye.org
SCRIPT_FILENAME=proxy:fcgi://127.0.0.1:9000/www/php-ssl/hello.php/some/info
REMOTE_PORT=50630
GATEWAY_INTERFACE=CGI/1.1
SERVER_PROTOCOL=HTTP/1.1
REQUEST_METHOD=GET
QUERY_STRING=foo=bar&rod=moby
REQUEST_URI=/test/hello.php/some/info?foo=bar&rod=moby
SCRIPT_NAME=/test/hello.php/some/info

-- 
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.

---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org