You are viewing a plain text version of this content. The canonical link for it is here.
Posted to cvs@httpd.apache.org by jo...@apache.org on 2026/01/19 14:25:21 UTC
svn commit: r1931423 - in httpd/httpd/trunk/test/modules/core: . htdocs/ssi
Author: jorton
Date: Mon Jan 19 14:25:20 2026
New Revision: 1931423
Log:
Adds test for SSI query string injection
Submitted by: Giannis Christodoulou <io.xristod gmail.com>
Github: closes #591
Added:
httpd/httpd/trunk/test/modules/core/htdocs/ssi/
httpd/httpd/trunk/test/modules/core/htdocs/ssi/exec.shtml
httpd/httpd/trunk/test/modules/core/test_004_ssi.py
Modified:
httpd/httpd/trunk/test/modules/core/env.py
Modified: httpd/httpd/trunk/test/modules/core/env.py
==============================================================================
--- httpd/httpd/trunk/test/modules/core/env.py Mon Jan 19 12:45:08 2026 (r1931422)
+++ httpd/httpd/trunk/test/modules/core/env.py Mon Jan 19 14:25:20 2026 (r1931423)
@@ -12,7 +12,7 @@ class CoreTestSetup(HttpdTestSetup):
def __init__(self, env: 'HttpdTestEnv'):
super().__init__(env=env)
self.add_source_dir(os.path.dirname(inspect.getfile(CoreTestSetup)))
- self.add_modules(["cgid"])
+ self.add_modules(["cgid","include"])
class CoreTestEnv(HttpdTestEnv):
Added: httpd/httpd/trunk/test/modules/core/htdocs/ssi/exec.shtml
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ httpd/httpd/trunk/test/modules/core/htdocs/ssi/exec.shtml Mon Jan 19 14:25:20 2026 (r1931423)
@@ -0,0 +1 @@
+<!--#exec cmd="echo SSI_OK" -->
\ No newline at end of file
Added: httpd/httpd/trunk/test/modules/core/test_004_ssi.py
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ httpd/httpd/trunk/test/modules/core/test_004_ssi.py Mon Jan 19 14:25:20 2026 (r1931423)
@@ -0,0 +1,32 @@
+import pytest
+import textwrap
+
+from pyhttpd.conf import HttpdConf
+
+class TestSSIInjection:
+
+ @pytest.fixture(autouse=True, scope="class")
+ def _class_scope(self, env):
+ conf = HttpdConf(env, extras={
+ "base": textwrap.dedent(f"""
+ <Directory "{env.gen_dir}">
+ Options +Includes
+ AddType text/html .shtml
+ AddOutputFilter INCLUDES .shtml
+ </Directory>
+ """)
+ })
+ conf.install()
+ assert env.apache_restart() == 0
+
+ def test_ssi_004_01(self, env):
+ """
+ CVE-2025-58098:
+ Server Side Includes must not add query string to #exec cmd=...
+ """
+ url = env.mkurl("http", "htdocs", "/ssi/exec.shtml?INJECTED")
+ r = env.curl_get(url)
+
+ body = r.response["body"].decode("utf-8")
+ assert "SSI_OK" in body
+ assert "INJECTED" not in body
\ No newline at end of file