Re: svn commit: r1189985 - in /httpd/httpd/trunk: include/httpd.h include/util_varbuf.h modules/filters/mod_substitute.c server/util.c

[Stefan Fritsch <sf...@sfritsch.de>]

> On 10/27/2011 3:15 PM, sf@apache.org wrote:
>> Use apr_pregsub_ex() and maxlen = 0 for unlimited in mod_substitute.
>
> Uhm... wha?

This was not intended as a final solution. Besides, one case already had 
unlimited (but using argument APR_SIZE_MAX instead of 0).

> Not acceptable.  Choose a bound.  unlimited is not acceptable.
>
> Yes, that is a veto.

What can a content filter do to handle the error? Does returning 
AP_FILTER_ERROR do any good? The headers may have been sent already.

Re: svn commit: r1189985 - in /httpd/httpd/trunk: include/httpd.h include/util_varbuf.h modules/filters/mod_substitute.c server/util.c

["William A. Rowe Jr." <wr...@rowe-clan.net>]

On 11/3/2011 1:29 AM, Stefan Fritsch wrote:
> 
>> Not acceptable.  Choose a bound.  unlimited is not acceptable.
> 
> What can a content filter do to handle the error? Does returning AP_FILTER_ERROR do any
> good? The headers may have been sent already.

I'd suggest a top bound of 1MB, if the admin configures mod_substitute
such that they approach it, /shrug.  If they surpass it... obviously
some noise at [error] level and yes, it seems we would need to abort.