Stop reading (and writing) one byte past the end of a file
description when it ends inside an unterminated "&" entity or "<"
tag, as a ScanHTMLTitles title can.
* modules/generators/mod_autoindex.c (terminate_description): Check
for the terminating NUL before advancing past it when scanning an
unterminated "<" tag or "&" entity, and break out of the loop at
end of string rather than continuing past it.
* test/modules/generators/env.py (GeneratorsTestSetup.__init__): Load
mod_autoindex for the generators test suite.
* test/modules/generators/htdocs/autoindex/: New test content.
* test/modules/generators/test_002_autoindex.py (TestAutoindex): New
test that a ScanHTMLTitles description ending in a bare "&" is
rendered without reading past the end of the description.
Submitted by: arshiya tabasum <arshi bugqore.com>
GitHub: closes#812
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939181 13f79535-47bb-0310-9956-ffa450edef68
to a script from 256 to APACHE_ARG_MAX, and bound URI/query/env-value
lengths against the configured request limits rather than APR_PATH_MAX.
PR 70270.
* changes-entries/cgid-env-limit.txt: Add changelog entry.
* modules/generators/mod_cgid.c: Replace ENV_COUNT_MAX with ENV_VAL_MAX,
a sanity bound on the length of a single environment variable value.
(get_req): Take the main server_rec as an argument. Allow up to
APACHE_ARG_MAX environment variables; check uri_len and args_len
against the configured LimitRequestLine rather than APR_PATH_MAX;
check each environment variable value against ENV_VAL_MAX.
(send_req): Fail with APR_ENOSPC if more than APACHE_ARG_MAX
environment variables are present.
(cgid_server): Pass main_server to get_req.
* test/modules/generators/htdocs/cgi/: New tests scripts.
* test/modules/generators/test_001_cgid.py: New tests.
Submitted by: Emmanuel Dreyfus <manu netbsd.org>, jorton
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
GitHub: closes#850
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1939165 13f79535-47bb-0310-9956-ffa450edef68
* modules/generators/mod_cgid.c (cgid_server): Log the daemon's pid
at TRACE1 (so the tests can kill the daemon).
* test/modules/generators/: New test suite.
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
GitHub: closes#772
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1938602 13f79535-47bb-0310-9956-ffa450edef68
