You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@httpd.apache.org by Lloyd Parkes <Ll...@ird.govt.nz> on 2008/02/07 02:33:39 UTC
[users@httpd] Do NOT add a slash at the end of the directory path.
Why?
We've all seen this comment for ServerRoot, but does anyone know why it's there?
What bad things will happen if I put a slash at the end of my ServerRoot?
The documentation for ServerRoot doesn't say anything about this. Google finds
nothing obvious.
I would give it a go to test things out, but I only have access to large
government web servers, so maybe not.
Cheers
--
Lloyd Parkes
Senior Systems Programmer
Open Systems
Ph: +64 4 890 2437
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Do NOT add a slash at the end of the directory path.
Posted by Lloyd Parkes <Ll...@ird.govt.nz>.
Sander Temme wrote:
>> I would give it a go to test things out, but I only have access to
>> large government web servers, so maybe not.
>
> How about setting up a test server for yourself, on your own machine?
> That'll give you something you can test out to your heart's desire.
I don't know what problems to look for, and the last thing I need is for some
subtle problem to go undetected for a month and then suddenly become critical.
Also, if nobody knows why that comment is there, I'll file a bug report to get
it removed. (Or tested on more platforms than I have and documented properly).
Cheers
--
Lloyd Parkes
Senior Systems Programmer
Open Systems
Ph: +64 4 890 2437
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Do NOT add a slash at the end of the directory path.
Posted by Sander Temme <sc...@apache.org>.
On Feb 6, 2008, at 5:33 PM, Lloyd Parkes wrote:
> I would give it a go to test things out, but I only have access to
> large government web servers, so maybe not.
How about setting up a test server for yourself, on your own machine?
That'll give you something you can test out to your heart's desire.
S.
--
Sander Temme
sctemme@apache.org
PGP FP: 51B4 8727 466A 0BC3 69F4 B7B8 B2BE BC40 1529 24AF
Re: [users@httpd] Do NOT add a slash at the end of the directory path.
Posted by so...@apache.org.
On Thu, Feb 7, 2008 at 4:29 PM, Lloyd Parkes <Ll...@ird.govt.nz> wrote:
> solprovider@apache.org wrote:
> > Input validation is typically handled with something like:
> > if(ServerRoot ends with slash) ServerRoot = ServerRootWithFinalSlashRemoved;
> I must confess that I thought this was the normal way to do things as well.
>
> Of course, one problem is that removing a trailing slash may not be the right
> thing to do because Apache runs on more than just Unix. Windows is probably easy
> to handle compared with NetWare and mainframes.
> Lloyd Parkes
The directory separator depends on the OS: slash (*nix and others),
backslash (MS), and colon (Apple). The period was used by at least
one OS. Most programming languages have a method for discovering the
proper separator e.g. File.separator in Java. The difficulty is not
discovering the separator character, but handling multibyte
characters. The final byte may match the separator while part of a
multibyte character so removing that byte would not be correct.
My designs prefer input validation over instructions like your
objection. I often add code to verify results from my own functions
under the assumption that I or someone else may break things someday.
My research on how httpd handles this will be delayed until next week.
I am still hoping an httpd dev will comment.
solprovider
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Do NOT add a slash at the end of the directory path.
Posted by Lloyd Parkes <Ll...@ird.govt.nz>.
solprovider@apache.org wrote:
> Input validation is typically handled with something like:
> if(ServerRoot ends with slash) ServerRoot = ServerRootWithFinalSlashRemoved;
I must confess that I thought this was the normal way to do things as well.
Of course, one problem is that removing a trailing slash may not be the right
thing to do because Apache runs on more than just Unix. Windows is probably easy
to handle compared with NetWare and mainframes.
Cheers
--
Lloyd Parkes
Senior Systems Programmer
Open Systems
Ph: +64 4 890 2437
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org
Re: [users@httpd] Do NOT add a slash at the end of the directory path.
Posted by so...@apache.org.
On 2/6/08, Lloyd Parkes <Ll...@ird.govt.nz> wrote:
> Why?
>
> We've all seen this comment for ServerRoot, but does anyone know why it's there?
> What bad things will happen if I put a slash at the end of my ServerRoot?
>
> The documentation for ServerRoot doesn't say anything about this. Google finds
> nothing obvious.
>
> I would give it a go to test things out, but I only have access to large
> government web servers, so maybe not.
> Lloyd Parkes
Input validation is typically handled with something like:
if(ServerRoot ends with slash) ServerRoot = ServerRootWithFinalSlashRemoved;
Reading the code using the web svn, I found checks to verify that
ServerRoot exists and is a directory in core.c. I have yet to find
where the config file is read so the validation could happen before
core.c (maybe in http_config.c?) I need the code local to read it
properly so I am adding CDT to Eclipse. I'll post again if someone
more familiar with the code does not.
solprovider
---------------------------------------------------------------------
The official User-To-User support forum of the Apache HTTP Server Project.
See <URL:http://httpd.apache.org/userslist.html> for more info.
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
" from the digest: users-digest-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org