www/apache
1
0
Fork 0
mirror of https://github.com/apache/httpd.git synced 2026-10-23 22:49:01 +03:00
Code Activity
29,900 Commits 62 Branches 313 Tags
httpdunit
Commit Graph

282 Commits

Author SHA1 Message Date
Jacob Champion
f50be63ee1 Revert new base64 function and tests 
This should be trunk-only, not part of the backport branch.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/httpdunit@1799376 13f79535-47bb-0310-9956-ffa450edef68
 2017-06-20 23:34:18 +00:00
Jacob Champion
6a1008ee10 util.c: add a strict Base64 decoding function 
ap_pbase64decode_strict() adds to the functionality of
ap_pbase64decode() in two ways:

- the length of the decoded buffer is returned, allowing embedded NULLs
  to be retained by the caller
- the input string is strictly checked for Base64 validity, including
  correct zero-padding at the end of the string

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/httpdunit@1796208 13f79535-47bb-0310-9956-ffa450edef68
 2017-05-25 21:18:42 +00:00
Nick Kew
38e269322b Introduce request taint-checking concept. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1792169 13f79535-47bb-0310-9956-ffa450edef68
 2017-04-21 08:44:06 +00:00
William A. Rowe Jr
138746eb14 When redrawing the parser, ap_get_http_token looked to be useful, but there's 
no application for this yet in httpd, so hold off adding this function when
we backport the enhancements. ap_scan_http_token was entirely sufficient.
If the community wants this new function, we can add it when backporting
work is complete.

This patch, and the earlier patches Friday actually demanded an mmn major
bump due to struct member changes. In any final backport, new members must
be added to the end of the struct to retain an mmn minor designation.




git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1765451 13f79535-47bb-0310-9956-ffa450edef68
 2016-10-18 14:56:07 +00:00
William A. Rowe Jr
84ce5d25db Dropped the never-released ap_has_cntrls() as it had very limited 
and inefficient application at that, added ap_scan_vchar_obstext()
to accomplish a similar purpose.

Dropped HttpProtocolOptions StrictURL option, this will be better
handled in the future with a specific directive and perhaps multiple
levels of scrutiny, use ap_scan_vchar_obstext() to simply ensure there
are no control characters or whitespace within the URI.

Changed the scanning of the response header table by check_headers()
to follow the same rulesets as reading request headers. Disallow any
CTL character within a response header value, and any CTL or whitespace
in response header field name, even in strict mode.

Apply HttpProtocolOptions Strict to chunk header parsing, invalid
whitespace is invalid, line termination must follow CRLF convention.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1764961 13f79535-47bb-0310-9956-ffa450edef68
 2016-10-14 20:48:43 +00:00
William A. Rowe Jr
b9a6a0ee7b Introduce StrictURI|UnsafeURI for RFC3986 enforcement 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1756959 13f79535-47bb-0310-9956-ffa450edef68
 2016-08-19 19:48:58 +00:00
William A. Rowe Jr
e5e3ac5668 With NUL as a TOKEN_STOP, this code is more efficient 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1754544 13f79535-47bb-0310-9956-ffa450edef68
 2016-07-29 16:06:23 +00:00
William A. Rowe Jr
b167818f7d Introduce ap_scan_http_field_content, ap_scan_http_token 
and ap_get_http_token for more efficient string handling.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1754541 13f79535-47bb-0310-9956-ffa450edef68
 2016-07-29 15:56:54 +00:00
William A. Rowe Jr
865e5dd2ab Have to walk it back, but somewhere along the way, I missed a critical edit 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1747483 13f79535-47bb-0310-9956-ffa450edef68
 2016-06-09 02:40:08 +00:00
William A. Rowe Jr
3844c66c2c Rename ap_casecmpstr[n]() to ap_cstr_casecmp[n](), update with APR doxygen 
This time, with merge-ability back into 2.4.x


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1747478 13f79535-47bb-0310-9956-ffa450edef68
 2016-06-09 01:05:45 +00:00
William A. Rowe Jr
8b48a3686b Major issue with these two specific edits falling into r1747469 
is that it becomes impossible to cleanly merge into branches/2.4.x.

Reverting this one functional/historical edit, to recommit for merging.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1747477 13f79535-47bb-0310-9956-ffa450edef68
 2016-06-09 01:04:47 +00:00
William A. Rowe Jr
f4cc76ee71 Rename ap_casecmpstr[n]() to ap_cstr_casecmp[n](), update with APR doxygen 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1747469 13f79535-47bb-0310-9956-ffa450edef68
 2016-06-09 00:06:42 +00:00
William A. Rowe Jr
a3142bb870 Update code to mirror r1747461 of apr-2.0 apr_cstr.c. 
More legible, slightly more performant.  Based on the
compiler in use and -O flags, YMWV.



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1747468 13f79535-47bb-0310-9956-ffa450edef68
 2016-06-08 23:46:13 +00:00
Jim Jagielski
f970bc8d99 New support function: ap_getword_conf2[_nc] which acts 
just like ap_getword_conf[_nc] but allows for {} to be
used as word quotes. That is:

   {Hello World} Foo Bar
   "Hello World" Foo Bar

are equiv.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1722321 13f79535-47bb-0310-9956-ffa450edef68
 2015-12-30 12:03:01 +00:00
Jim Jagielski
7bb1b911a1 revert... hold off for now. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1722245 13f79535-47bb-0310-9956-ffa450edef68
 2015-12-29 22:54:23 +00:00
Jim Jagielski
d8838f491b Ok... allow for getting "words" by also allowing the 
use of curlies... That is:

   "Hello World" Foo Bar

and

   {Hello World} Foo Bar

will both return the same if using ap_getword_conf2()

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1722243 13f79535-47bb-0310-9956-ffa450edef68
 2015-12-29 22:40:21 +00:00
Yann Ylavic
8d90136009 Small changes to ap_casecmpstr[n]() for better performances, see: 
http://mail-archives.apache.org/mod_mbox/httpd-dev/201511.mbox/%3CCAKQ1sVOU7xmY-_PaQb0et0GXO-NxtTPBsD4ZU_UbtUzWYOUVTg%40mail.gmail.com%3E

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1722194 13f79535-47bb-0310-9956-ffa450edef68
 2015-12-29 17:13:15 +00:00
Yann Ylavic
e30575b0b0 More ap_casecmpstr[n]() usages (follow up to r1715876). 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715880 13f79535-47bb-0310-9956-ffa450edef68
 2015-11-23 16:48:35 +00:00
Yann Ylavic
c80e6b2a34 Use new ap_casecmpstr[n]() functions where appropriate (not exhaustive). 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715876 13f79535-47bb-0310-9956-ffa450edef68
 2015-11-23 16:46:01 +00:00
Yann Ylavic
3c9ddf44bf Revert r1715789: will re-commit without spurious functional changes. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715869 13f79535-47bb-0310-9956-ffa450edef68
 2015-11-23 16:28:36 +00:00
Yann Ylavic
29843dc73f Use new ap_casecmpstr[n]() functions where appropriate (not exhaustive). 
[Reverted by r1715869]


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715789 13f79535-47bb-0310-9956-ffa450edef68
 2015-11-23 12:33:09 +00:00
Yann Ylavic
7ebe2d558b Before they are used, rename ap_str[n]casecmp() to ap_casecmpstr[n]() to match 
what will probably be their APR names, avoiding any confusion wrt <strings.h>'s
functions (semantic).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715736 13f79535-47bb-0310-9956-ffa450edef68
 2015-11-23 08:36:35 +00:00
William A. Rowe Jr
02a930c9e0 Introduce an ascii-like sortation for EBCDIC, case folding US-ASCII alpha only 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715632 13f79535-47bb-0310-9956-ffa450edef68
 2015-11-22 15:28:27 +00:00
Eric Covener
e6a504c52d revert until these functions are used. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715587 13f79535-47bb-0310-9956-ffa450edef68
 2015-11-21 22:52:10 +00:00
Eric Covener
1bede0ff13 stick with underlying strcasecmp on EBCDIC builds 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715554 13f79535-47bb-0310-9956-ffa450edef68
 2015-11-21 19:35:24 +00:00
Jim Jagielski
0bb8e80ae1 move to simpler while loop and reduce number of returns 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715526 13f79535-47bb-0310-9956-ffa450edef68
 2015-11-21 13:57:48 +00:00
Jim Jagielski
90442165b4 typo 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715524 13f79535-47bb-0310-9956-ffa450edef68
 2015-11-21 13:47:42 +00:00
Jim Jagielski
897b8d4fab make bill happy (if possible!) 
Note that these are ascii specific.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715404 13f79535-47bb-0310-9956-ffa450edef68
 2015-11-20 18:57:36 +00:00
Jim Jagielski
113a01b8f8 Provide our own impl of str[n]casecmp() 
This simply provides it. Next step is to change all uses of
str[n]casecmp to ap_str[n]casecmp and *then* remove those silly
logic paths where we check the 1st char of a string before
we do the strcasecmp (since this is no longer expensive).


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1715401 13f79535-47bb-0310-9956-ffa450edef68
 2015-11-20 18:49:38 +00:00
Stefan Eissing
d84e8bfef6 final final change to the new ap_array_str_* functions after review 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1700968 13f79535-47bb-0310-9956-ffa450edef68
 2015-09-03 09:39:59 +00:00
Stefan Eissing
c6170479d3 giving ap_array_index a start parameter, adding ap_array_contains 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1698133 13f79535-47bb-0310-9956-ffa450edef68
 2015-08-27 12:13:59 +00:00
Stefan Eissing
e005a156f4 creating ap_array_index in util, forwarding scheme into request processing, enabling SSL vars only when scheme is not http:, delayed connection creation until task worker assignment 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1696428 13f79535-47bb-0310-9956-ffa450edef68
 2015-08-18 14:33:55 +00:00
Stefan Eissing
d0ca4ab131 introducing ap_array_index in util, used in protocol and mod_h2 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1696264 13f79535-47bb-0310-9956-ffa450edef68
 2015-08-17 12:45:57 +00:00
Eric Covener
e0b79f44a9 Configuration files with long lines and continuation characters 
are not read properly. PR 55910. 

Submitted By: Manuel Mausz <manuel-as mausz.at>
Committed By: covener



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1648394 13f79535-47bb-0310-9956-ffa450edef68
 2014-12-29 17:27:46 +00:00
Joe Orton
bb2749fd6e SECURITY (CVE-2014-0117): Fix a crash in mod_proxy. In a reverse 
proxy configuration, a remote attacker could send a carefully crafted
request which could crash a server process, resulting in denial of
service.

Thanks to Marek Kroemeke working with HP's Zero Day Initiative for
reporting this issue.

* server/util.c (ap_parse_token_list_strict): New function.

* modules/proxy/proxy_util.c (find_conn_headers): Use it here.

* modules/proxy/mod_proxy_http.c (ap_proxy_http_process_response):
  Send a 400 for a malformed Connection header.

Submitted by: Edward Lu, breser, covener


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610674 13f79535-47bb-0310-9956-ffa450edef68
 2014-07-15 12:27:00 +00:00
Christophe Jaillet
3e6f39ae93 Remove some 'register' in variable declaration. 
Save a few cycles by calling 'apr_isalnum' instead of 'apr_isalpha' and 'apr_isdigit'.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1610353 13f79535-47bb-0310-9956-ffa450edef68
 2014-07-14 08:13:24 +00:00
Christophe Jaillet
075cd89e14 Follow up to r1384924 . 
Update comment and allocate one extra byte to be safe, even if not needed in the particular case described in r1384924.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1589599 13f79535-47bb-0310-9956-ffa450edef68
 2014-04-24 06:29:28 +00:00
Christophe Jaillet
1b6e2b3ebf s/apr_pstrndup/apr_pstrmemdup/ when applicable 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1563381 13f79535-47bb-0310-9956-ffa450edef68
 2014-02-01 08:26:33 +00:00
Christophe Jaillet
dfa5c28120 Use %pm in order to save 8k of stack in 'ap_pcfg_strerror' 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1563379 13f79535-47bb-0310-9956-ffa450edef68
 2014-02-01 07:55:58 +00:00
Christophe Jaillet
111f35f4e1 Be more clever when allocating memory for log item to be escaped. 
This should be faster and save about 70-100 bytes in the request pool with the default config.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1485409 13f79535-47bb-0310-9956-ffa450edef68
 2013-05-22 20:38:35 +00:00
Christophe Jaillet
7af3897b16 Revert change in order to apply a better solution. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1485379 13f79535-47bb-0310-9956-ffa450edef68
 2013-05-22 19:45:23 +00:00
Graham Leggett
9bc9d79079 core: Stop the HTTP_IN filter from attempting to write error buckets 
to the output filters, which is bogus in the proxy case. Create a
clean mapping from APR codes to HTTP status codes, and use it where
needed.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1482522 13f79535-47bb-0310-9956-ffa450edef68
 2013-05-14 18:58:06 +00:00
Graham Leggett
997e0f6d33 core: Add the ability to do explicit matching on weak and strong ETags 
as per RFC2616 Section 13.3.3.


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1479528 13f79535-47bb-0310-9956-ffa450edef68
 2013-05-06 11:41:10 +00:00
Christophe Jaillet
4ffceed48e Turn a int into a apr_size_t for a variabe used to compute a string length 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1468089 13f79535-47bb-0310-9956-ffa450edef68
 2013-04-15 14:17:39 +00:00
Daniel Ruggeri
8c101dfe70 Part two of r1467523 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1467792 13f79535-47bb-0310-9956-ffa450edef68
 2013-04-14 15:47:53 +00:00
Daniel Ruggeri
ee3815bda9 Static var not neccessary here 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1467523 13f79535-47bb-0310-9956-ffa450edef68
 2013-04-13 00:07:44 +00:00
Christophe Jaillet
86087766c6 Be more clever when allocating memory for log item to be escaped. 
This should save about 70-100 bytes in the request pool with the default config.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1461869 13f79535-47bb-0310-9956-ffa450edef68
 2013-03-27 21:57:44 +00:00
Christophe Jaillet
bb69ec6cfe Remove useless tests. 
Turn
   if (*x && apr_isspace(*x))
into
   if (apr_isspace(*x))

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1452128 13f79535-47bb-0310-9956-ffa450edef68
 2013-03-03 21:25:46 +00:00
Christophe Jaillet
3f42fb8b49 Can't figure out why we allocate len+2 bytes here. Len+1 should be enough. 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1442759 13f79535-47bb-0310-9956-ffa450edef68
 2013-02-05 21:32:51 +00:00
Daniel Ruggeri
023e47cb2f Add helper function to execute command w args and get one line of output. Allow AuthLDAPBindPassword to have exec: argument like SSLPassPhraseDialog 
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1433478 13f79535-47bb-0310-9956-ffa450edef68
 2013-01-15 16:00:44 +00:00