You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2012/02/05 18:27:48 UTC
DO NOT REPLY [Bug 52605] New: LimitRequestLine not taken into
account when talking to CGI script
https://issues.apache.org/bugzilla/show_bug.cgi?id=52605
Bug #: 52605
Summary: LimitRequestLine not taken into account when talking
to CGI script
Product: Apache httpd-2
Version: 2.2.16
Platform: PC
URL: http://bugs.debian.org/638011
OS/Version: Linux
Status: NEW
Severity: minor
Priority: P2
Component: Core
AssignedTo: bugs@httpd.apache.org
ReportedBy: jmv_deb@nirgal.com
Classification: Unclassified
From: Riccardo Murri <ri...@gmail.com>
As of version 2.2.16, Apache applies a fixed line length limit of 8192
bytes when talking to a CGI script: in file `server/util_script.c`,
function `ap_scan_script_header_err_core`, at lines 403--433,
one can read:
char x[MAX_STRING_LEN];
char *w, *l;
[...]
if (buffer) {
*buffer = '\0';
}
w = buffer ? buffer : x;
[...]
while (1) {
int rv = (*getsfunc) (w, MAX_STRING_LEN - 1, getsfunc_data);
where `MAX_STRING_LEN` is defined in `httpd.h` to be equal to
`HUGE_STRING_LEN`, that is, 8192.
The directive `LimitRequestLine` should apply here as well, or the
documentation should make it clear that this setting does not
influence the CGI module.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 52605] LimitRequestLine not taken into account
when talking to CGI script
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52605
Eric Covener <co...@gmail.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |NEEDINFO
--- Comment #1 from Eric Covener <co...@gmail.com> 2012-02-05 17:35:49 UTC ---
The data being read isn't a request line or a request-anything, so why would
that limit apply?
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 52605] LimitRequestLine not taken into account
when talking to CGI script
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52605
--- Comment #4 from Nirgal Vourgère <jm...@nirgal.com> 2012-02-15 14:22:50 UTC ---
I'm not sure this is related, but since commit 1200947 [1], documentation [2]
says:
"Under normal conditions, the value should not be changed from the default.
Also, you can't set this higher than 8190 without modifying the source and
rebuilding."
See also bug 51665 [3]
[1] https://httpd.apache.org/docs/2.2/en/mod/core.html#limitrequestline
[2]
https://svn.apache.org/viewvc/httpd/httpd/branches/2.2.x/docs/manual/mod/core.xml?r1=1166612&r2=1200947&pathrev=1200947
[3] https://issues.apache.org/bugzilla/show_bug.cgi?id=51665
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 52605] LimitRequestLine not taken into account
when talking to CGI script
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52605
--- Comment #3 from Eric Covener <co...@gmail.com> 2012-02-05 18:58:13 UTC ---
On 2.2 I was able to send a request line >8k and see its value in the
REQUEST_URI environment variable. Can you share the details of the test case?
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 52605] LimitRequestLine not taken into account
when talking to CGI script
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52605
--- Comment #2 from Riccardo Murri <ri...@gmail.com> 2012-02-05 18:07:44 UTC ---
Maybe I extracted the wrong bits of code, but in essence the problem
is this: Apache truncates request lines passed to a CGI script to
~8kB, and there is apparently no way of changing that setting.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 52605] LimitRequestLine not taken into account
when talking to CGI script
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52605
--- Comment #5 from Riccardo Murri <ri...@gmail.com> 2012-02-15 18:06:03 UTC ---
I came across this issue when diagnosing a problem with the IkiWiki
CGI. Details of the IkiWiki issue can be found here (with pointers to
a similar bug in another software):
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=638009
In essence, the problem is that the IkiWiki CGI script generates an
HTTP 302 response, with a very long `Location: ...` line (~16k;
basically it embeds the text of the whole Wiki page in the http:// URL
as a query parameter). Then Apache (I was using the Debian "squeeze"
one) truncated the line, apparently at ~8k.
The IkiWiki bug has been corrected since (it shouldn't have issued a
redirect in the first place), so current version will not exhibit that
behavior.
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
DO NOT REPLY [Bug 52605] Please allow request lines longer than 8k
Posted by bu...@apache.org.
https://issues.apache.org/bugzilla/show_bug.cgi?id=52605
Nirgal Vourgère <jm...@nirgal.com> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|LimitRequestLine not taken |Please allow request lines
|into account when talking |longer than 8k
|to CGI script |
--
Configure bugmail: https://issues.apache.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org