You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@httpd.apache.org by Geoffrey Young <ge...@modperlcookbook.org> on 2004/01/07 21:30:16 UTC
Re: log_error_core escaping change broke things
> Stas, we have closed a well known and remotely exploitable security leak. This
> goes straight over comfort. If you don't like it, provide an alternative
> solution. Just nagging or trying to talk the problem away doesn't help.
is creating a compile-time flag to disable the new-default behavior a simple
solution that might make everyone happy?
--Geoff
Re: log_error_core escaping change broke things
Posted by Joe Orton <jo...@redhat.com>.
On Fri, Jan 09, 2004 at 03:32:29PM +0100, André Malo wrote:
> * Geoffrey Young <ge...@modperlcookbook.org> wrote:
>
> > > However, is it wise to add a configure option for it?
> >
> > how do you mean? I was trying to make it just a compile time option,
> > similar to -DBIG_SECURITY_HOLE (which seems to me a bigger risk than
> > this).
> > do you mean to require users to change a define in the code itself?
>
> No no. I wanted to say "would it be wise, to add a configure option", such
> as --without-escaping-errorlog or so.
I don't think it's appropriate to add configure switches to turn off
security features: users may not understand the implications of the
switch if they just see it in the --help output.
CFLAGS=-DUNSAFE_LOG_ESCAPING ./configure
is just as easy to document as
./configure --disable-errorlog-escaping
in any case.
Regards,
joe
Re: log_error_core escaping change broke things
Posted by André Malo <nd...@perlig.de>.
* Geoffrey Young <ge...@modperlcookbook.org> wrote:
> > However, is it wise to add a configure option for it?
>
> how do you mean? I was trying to make it just a compile time option,
> similar to -DBIG_SECURITY_HOLE (which seems to me a bigger risk than
> this).
> do you mean to require users to change a define in the code itself?
No no. I wanted to say "would it be wise, to add a configure option", such
as --without-escaping-errorlog or so.
nd
Re: log_error_core escaping change broke things
Posted by Geoffrey Young <ge...@modperlcookbook.org>.
André Malo wrote:
> * Stas Bekman <st...@stason.org> wrote:
>
>
>>Though since it really affects any logging it probably should be called
>>UNESCAPED_LOGGING or similar. And probably a similar patch applied to 1.3.
>
>
> It only affects error logging.
that was my intent.
> What do you mean by any logging?
>
> I can live with it in general (wouldn't make the scratch definition twice).
sorry, that was me trying to make it compile under -Werror with my only
passable C skills :)
> However, is it wise to add a configure option for it?
how do you mean? I was trying to make it just a compile time option,
similar to -DBIG_SECURITY_HOLE (which seems to me a bigger risk than this).
do you mean to require users to change a define in the code itself?
--Geoff
Re: log_error_core escaping change broke things
Posted by André Malo <nd...@perlig.de>.
* Stas Bekman <st...@stason.org> wrote:
> Though since it really affects any logging it probably should be called
> UNESCAPED_LOGGING or similar. And probably a similar patch applied to 1.3.
It only affects error logging. What do you mean by any logging?
I can live with it in general (wouldn't make the scratch definition twice).
However, is it wise to add a configure option for it?
nd
Re: log_error_core escaping change broke things
Posted by Stas Bekman <st...@stason.org>.
Geoffrey Young wrote:
>>Stas, we have closed a well known and remotely exploitable security leak. This
>>goes straight over comfort. If you don't like it, provide an alternative
>>solution. Just nagging or trying to talk the problem away doesn't help.
>
> is creating a compile-time flag to disable the new-default behavior a simple
> solution that might make everyone happy?
That works for me. What do others think?
Though since it really affects any logging it probably should be called
UNESCAPED_LOGGING or similar. And probably a similar patch applied to 1.3.
> +#ifdef UNESCAPED_ERROR_LOG
> + len += apr_vsnprintf(errstr + len, MAX_STRING_LEN - len, fmt, args);
> +
> + if (r && (referer = apr_table_get(r->headers_in, "Referer"))) {
> + len += apr_snprintf(errstr + len, MAX_STRING_LEN - len,
> + ", referer: %s", referer);
> + }
> +#else
__________________________________________________________________
Stas Bekman JAm_pH ------> Just Another mod_perl Hacker
http://stason.org/ mod_perl Guide ---> http://perl.apache.org
mailto:stas@stason.org http://use.perl.org http://apacheweek.com
http://modperlbook.org http://apache.org http://ticketmaster.com