You are viewing a plain text version of this content. The canonical link for it is here.
Posted to bugs@httpd.apache.org by bu...@apache.org on 2026/09/04 19:01:18 UTC
[Bug 70204] New: Make sensitive ap_expr file functions deny-by-default for new callers
https://bz.apache.org/bugzilla/show_bug.cgi?id=70204
Bug ID: 70204
Summary: Make sensitive ap_expr file functions deny-by-default
for new callers
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: All
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Core
Assignee: bugs@httpd.apache.org
Reporter: ixtro99@gmail.com
Target Milestone: ---
Created attachment 40213
--> https://bz.apache.org/bugzilla/attachment.cgi?id=40213&action=edit
Secure-by-default ap_expr file functions: deny file()/filesize()/filemod()
unless the caller opts in with ALLOW_FILE_FUNC; server-scope configs unchanged.
Trunk 8be3ef87, 5 files, +50/-3.
ap_expr_parse() hands every caller the file() capability unless that caller
remembers to restrict it. This patch flips the default: filesystem functions
are denied unless the caller explicitly opts in.
The same failure mode already cost two rounds of fixes -- hand-rolled
per-caller checks, then a central flag for _cmd callers in r1935016 -- yet raw
ap_expr_parse() callers stayed outside any gate. I verified on current trunk
(8be3ef87) that .htaccess "SSLRequire filesize(...)" still evaluates (HTTP
200). A future caller using the obvious unrestricted flags = 0 path could
therefore silently inherit file access as the httpd user.
What changed (5 files, +50/-3):
ap_expr_parse() applies RESTRICTED_FILE_FUNC by default; new ALLOW_FILE_FUNC
bit opts back in
ap_expr_parse_cmd_mi() opts in automatically for server-scope config only
(.htaccess stays restricted)
SSLRequire gets the same scope rule -- it is .htaccess-reachable
Lua r intentionally takes the restricted default; docs updated
Testing: fresh checkout, patch, full build, plus pristine-vs-patched A/B.
10-assertion matrix, 10/10 PASS (forgetful caller allowed to denied, Lua
allowed to denied, server-scope uses identical, .htaccess behavior identical).
SSLRequire: server scope 200 -> 200; .htaccess 200 -> 500 with "filesize not
available in restricted context".
Compatibility: intended behavior changes are limited to Lua r file functions,
.htaccess SSLRequire file functions, and future callers. Third-party raw
callers that genuinely need file() can add the one-line opt-in. No API/ABI
break.
Patch attached for review.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 70204] Make sensitive ap_expr file functions deny-by-default for new callers
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=70204
ixtro99@gmail.com changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |PatchAvailable
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org
[Bug 70204] Make sensitive ap_expr file functions deny-by-default for new callers
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=70204
Joe Orton <jo...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |WONTFIX
Status|NEW |RESOLVED
--- Comment #1 from Joe Orton <jo...@apache.org> ---
Thanks for the patch, but I don't think we'll change this again. Under the
(newly adopted) security policy we likely wouldn't have accepted these bugs as
security issues in the first place.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: bugs-unsubscribe@httpd.apache.org
For additional commands, e-mail: bugs-help@httpd.apache.org