[PATCH] CGIWrap Problems

["Roy T. Fielding" <fi...@kiwi.ICS.UCI.EDU>]

>> That may be the reason for doing it this way, but it doesn't change
>> the fact that it results in the wrong information being given to
>> the script.  It is not a feature if it breaks the definition of SCRIPT_NAME,
>> which is exactly what it is doing.
>
>Yeah, and the old "correct" way of creating SCRIPT_NAME, which would
>result in things like "/cgi-b" or a core dump, was much better... ;)

A solution to one bug does not justify creating another bug and calling it
a feature.  We can fix this without breaking existing CGI scripts
at all, and the only justification not to fix it is to preserve some
theoretical notion that SCRIPT_NAME and PATH_INFO always correspond to
the Request-URI.  If that were true, these CGI scripts wouldn't work
on any platform, so clearly they don't depend on that notion.
Since the fix would only affect these scripts and no others, it doesn't
make any sense to break them.  I have compromised on other protocol issues
far more significant than this, and CGI isn't even a standard, so I cannot
accept "protocol purity" as a rational defense.

The bottom line is that some CGI scripts that work fine on NCSA httpd and
Apache 1.1.x don't work at all on Apache 1.2b, without any reason for
this breakage given to the user.  The patch below will fix this problem,
without affecting any other scripts, and without the core dump that
was the reason for the earlier change.  It also provides the real
Request-URI, undoctored by our unescape mangling, which is far more
reliable for scripts that want to be Apache-specific.

.....Roy

Index: util_script.c
===================================================================
RCS file: /export/home/cvs/apache/src/util_script.c,v
retrieving revision 1.56
diff -c -r1.56 util_script.c
*** util_script.c	1997/04/29 04:45:52	1.56
--- util_script.c	1997/04/30 22:21:28
***************
*** 238,243 ****
--- 238,257 ----
      return lu;
  }
  
+ static char *original_uri(request_rec *r)
+ {
+     char *last;
+     char *first = r->the_request;
+ 
+     while (*first && !isspace(*first)) ++first;
+     while (isspace(*first)) ++first;
+ 
+     last = first;
+     while (*last && !isspace(*last)) ++last;
+     
+     return pstrndup(r->pool, first, last - first);
+ }
+ 
  void add_cgi_vars(request_rec *r)
  {
      table *e = r->subprocess_env;
***************
*** 246,252 ****
      table_set (e, "SERVER_PROTOCOL", r->protocol);
      table_set (e, "REQUEST_METHOD", r->method);
      table_set (e, "QUERY_STRING", r->args ? r->args : "");
!     
      /* Note that the code below special-cases scripts run from includes,
       * because it "knows" that the sub_request has been hacked to have the
       * args and path_info of the original request, and not any that may have
--- 260,267 ----
      table_set (e, "SERVER_PROTOCOL", r->protocol);
      table_set (e, "REQUEST_METHOD", r->method);
      table_set (e, "QUERY_STRING", r->args ? r->args : "");
!     table_set (e, "REQUEST_URI", original_uri(r));
! 
      /* Note that the code below special-cases scripts run from includes,
       * because it "knows" that the sub_request has been hacked to have the
       * args and path_info of the original request, and not any that may have
***************
*** 264,283 ****
  
  	table_set (e, "SCRIPT_NAME", pstrndup(r->pool, r->uri,
  					      path_info_start));
! 	table_set (e, "PATH_INFO", r->uri + path_info_start);
      }
  	
-     /* Some CGI apps need the old-style PATH_INFO (taken from the
-      * filename, not the URL), so we provide it in a different env
-      * variable. CGI scripts can use something like (in Perl)
-      * $path_info = $ENV{'FILEPATH_INFO'} || $ENV{'PATH_INFO'};
-      * to get the right information with both old and new
-      * versions of Apache (and other servers).
-      */
- 
-     if (r->path_info && *r->path_info)
- 	table_set (e, "FILEPATH_INFO", r->path_info);
- 
      if (r->path_info && r->path_info[0]) {
  	/*
   	 * To get PATH_TRANSLATED, treat PATH_INFO as a URI path.
--- 279,288 ----
  
  	table_set (e, "SCRIPT_NAME", pstrndup(r->pool, r->uri,
  					      path_info_start));
! 
! 	table_set (e, "PATH_INFO", r->path_info);
      }
  	
      if (r->path_info && r->path_info[0]) {
  	/*
   	 * To get PATH_TRANSLATED, treat PATH_INFO as a URI path.

Re: [PATCH] CGIWrap Problems

[Dean Gaudet <dg...@arctic.org>]

I haven't analysed this problem at all yet.  But removing FILEPATH_INFO
could be a bad thing since it has been there since before 1.2b0 I think. 
There now may be scripts that rely on it. 

Dean