You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2024/05/03 22:21:08 UTC
[Bug 68973] New: Content-Length header missing in 2.4.59 is a breaking change
https://bz.apache.org/bugzilla/show_bug.cgi?id=68973
Bug ID: 68973
Summary: Content-Length header missing in 2.4.59 is a breaking
change
Product: Apache httpd-2
Version: 2.4.59
Hardware: PC
OS: All
Status: NEW
Severity: blocker
Priority: P2
Component: All
Assignee: bugs@httpd.apache.org
Reporter: webhaupt@backmail.eu
Target Milestone: ---
I believe that you are severely underestimating the negative consequences of
your decision to remove the possibility to send the Content-Length header with
the latest update 2.4.59.
For decades, the Content-Length header has been used to determine the file size
that is delivered through PHP.
Existing software is relying on this value. For example, I am using this value
in an update mechanism to show the file size to be downloaded. At the same
time, this value indicates if there is a valid file to be delivered. If there
is no file size, there is no valid file and the download isn't even started.
It was not to be expected that this header would ever be removed, so it was
relied upon. You will find hundreds of scripts on StackOverflow relying on this
value.
Existing software is relying on this value.
This breaking change is not documented. There is no warning and the loss of
Content-Length isn't even mentioned in the changelog:
https://downloads.apache.org/httpd/CHANGES_2.4
I have now lost three full work days discussing this issue with my server
provider and trying everything to find the reason and a solution for this
issue.
As I now learned in another topic here, this hidden change was part of a
security fix and the only working solution is to adjust the trust level with
htaccess like this:
SetEnvIf Request_URI "\.php$" ap_trust_cgilike_cl
While at least there is this workaround, this is still a breaking change and
shoul be treated as such. Since it is not, it was possibly an unintentional
change.
I urge you to reverse this change so as not to break any more existing
software.
It would also be highly recommended to include a corresponding note for the
current version 2.4.59 in the changelog.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68973] Content-Length header missing in 2.4.59 is a breaking change
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68973
--- Comment #3 from mrl22 <ri...@webfwd.co.uk> ---
Thank you @webhaupt
I sunk half a day into this and still had no idea what was causing it... and
then I found this page.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68973] Content-Length header missing in 2.4.59 is a breaking change
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68973
--- Comment #1 from sebmougey <sm...@smy.fr> ---
Hello
I spent a lot of time to find the reasons of issues in our products, caused by
this strange decision to remove the Content-Length header.
And I also don't understand why this was not mentioned in the changelog.
Can you please revert it in the next release ?
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68973] Content-Length header missing in 2.4.59 is a breaking change
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68973
--- Comment #5 from apache@dstoecker.de ---
This change broke at least two of our systems interacting with hundreds of
hardware devices in the field and caused unnecessary on-the-site support with
travel costs as well as at least 2 days investigating the root cause of the
failing systems.
Not using content length from the scripts and not sending it is a very bad
decision. I have many scripts which use this functionality (fortunately not all
of them cause a final failure due to this change).
I'd agree that Apache could verify the value, but it should not ignore and
strip it!
P.S. Not describing such a major breaking change is a simply No-Go!
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68973] Content-Length header missing in 2.4.59 is a breaking change
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68973
--- Comment #7 from Nelson Benitez <nb...@gmail.com> ---
Removing content-length is causing regressions in server software, eg. in
Nextcloud see https://github.com/nextcloud/server/issues/47017
Excerpt from mentioned Nextcloud issue:
PDF files need be read at end of the file (to find trailer dictionary) that
means doing a file seek_to_end over the http stream of the pdf file, that was
possible (in GNOME gvfs http stream implementation) thanks to the
content-length header, so the removal of that is causing users to report that
PDF files can no longer be opened from a mounted Nextcloud instance.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68973] Content-Length header missing in 2.4.59 is a breaking change
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68973
cweiske+bz.apache.org@cweiske.de changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |cweiske+bz.apache.org@cweis
| |ke.de
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68973] Content-Length header missing in 2.4.59 is a breaking change
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68973
--- Comment #8 from rw <ri...@weickelt.de> ---
Thank you for bringing this up. I have wasted several hours to figure out why
my OTA update solution suddenly broke. All http client libraries for tiny
embedded devices rely on the presence of the Content-Length field.
Thanks for also mentioning the workaround. The line
SetEnvIf Request_URI "\.py$" ap_trust_cgilike_cl
in .htaccess did the trick, indeed.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68973] Content-Length header missing in 2.4.59 is a breaking change
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68973
--- Comment #4 from cweiske+bz.apache.org@cweiske.de ---
My XMPP client Conversations failed to show images sent to me, and the ultimate
reason was that the Apache update to 2.4.59 on my server prevented the
Content-Length header to be sent out.
The client expects and checks this header in HTTP HEAD requests to determine
the file size to be downloaded.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68973] Content-Length header missing in 2.4.59 is a breaking change
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68973
--- Comment #6 from helpless@byom.de ---
I just spent three hours debugging our application which started to behave in
weird ways when accessed from Windows clients, while on other clients it
continued to work. The reason is that various .NET methods don't fully support
responses with Transfer-Encoding chunked, which Apache started to introduce in
the HTTP responses out of nowhere.
The analysis would have taken even longer if we didn't had one server left
where the application still worked, so I was able to compare their
configuration and code.
I actually stumbled upon the doucmentation of ap_trust_cgilike_cl at
https://httpd.apache.org/docs/current/env.html#cgilike but discarded it because
it says "Available in 2.4.59 and later", which we don't run. Only then to later
find out, that the package maintainer backported the changes for
CVE-2024-24795.
I'm aware that the change will not be rolled back in this case, but still would
like to leave a note that in similar situations in the future security and
backwards compatibility should be weighed up and not unconditionally decided in
favor of security. CVE-2024-24795 has a score of 4.0, which means it has almost
no relevance in practice, so maybe the breaking change should have been
introduced only in the next major version, while minor updates stay with a
default value of ap_trust_cgilike_cl = 1. If someone wants to fix the security
issue for his existing setup as well, he could set it to 0.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68973] Content-Length header missing in 2.4.59 is a breaking change
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68973
Nelson Benitez <nb...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |nbenitezl@gmail.com
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68973] Content-Length header missing in 2.4.59 is a breaking change
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68973
--- Comment #7 from ryooda <52...@belgianairways.com> ---
https://colibris-wiki.org/wikilibre/?gogoanime-best-site-to-watch-dubbed-anime-online
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68973] Content-Length header missing in 2.4.59 is a breaking change
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68973
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |WONTFIX
--- Comment #2 from Eric Covener <co...@gmail.com> ---
There is no short-term plan to revert the change. I've added changelog entries
pointing to the environment variable.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68907 tracks an alternative fix.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 68973] Content-Length header missing in 2.4.59 is a breaking change
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=68973
--- Comment #9 from turbulentarius@gmail.com ---
I may also have noticed issues in Nextcloud due to this, but I did not make the
connection until recently, when I randomly noticed the content-length header
was not being set for an unrelated PHP application.
Obviously you don't expect something like that to happen. Ever. So you don't
look out for it. It is very weird and highly unusual.
No idea what the reason is, but typically the content-length header is being
set for a very well-thought reason by those of us using it. I really could not
care less that some scripts might set it inaccurately or abuse it. People
should not run such scripts on their servers anyway.
The main symptom was that download times was showing up as unknown in my
browser. I knew something was wrong with that, but did not discover the cause
until now.
This is a breaking change, and Apache should either not have overridden the
header, or it should have refused to serve the file with a specific error
message in the log IMHO
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org