svn commit: r1935016 - in httpd/httpd/trunk: include modules/mappers modules/metadata modules/proxy server
[email protected] Fri, 05 Jun 2026 10:27:35 -0000
| Newsgroups | gmane.comp.apache.cvs |
|---|---|
| Message-ID | <178065525501.3079319.18248648493066749953@svn03-he-fi> |
Author: covener
Date: Fri Jun 5 10:27:34 2026
New Revision: 1935016
Log:
restrict per-dir file funcs centrally
Modified:
httpd/httpd/trunk/include/ap_expr.h
httpd/httpd/trunk/modules/mappers/mod_rewrite.c
httpd/httpd/trunk/modules/metadata/mod_setenvif.c
httpd/httpd/trunk/modules/proxy/mod_proxy_fcgi.c
httpd/httpd/trunk/server/util_expr_eval.c
Modified: httpd/httpd/trunk/include/ap_expr.h
==============================================================================
--- httpd/httpd/trunk/include/ap_expr.h Fri Jun 5 10:26:23 2026 (r1935015)
+++ httpd/httpd/trunk/include/ap_expr.h Fri Jun 5 10:27:34 2026 (r1935016)
@@ -66,6 +66,8 @@ typedef struct {
#define AP_EXPR_FLAG_RESTRICTED 4
/** Expression evaluates to a string, not to a bool */
#define AP_EXPR_FLAG_STRING_RESULT 8
+/** Don't allow functions/vars that expose content from the filesystem. */
+#define AP_EXPR_FLAG_RESTRICTED_FILE_FUNC 16
/**
Modified: httpd/httpd/trunk/modules/mappers/mod_rewrite.c
==============================================================================
--- httpd/httpd/trunk/modules/mappers/mod_rewrite.c Fri Jun 5 10:26:23 2026 (r1935015)
+++ httpd/httpd/trunk/modules/mappers/mod_rewrite.c Fri Jun 5 10:27:34 2026 (r1935016)
@@ -3689,8 +3689,6 @@ static const char *cmd_rewritecond(cmd_p
int in_htaccess = cmd->pool == cmd->temp_pool;
unsigned int flags = newcond->flags & CONDFLAG_NOVARY ?
AP_EXPR_FLAG_DONT_VARY : 0;
- /* Use restricted ap_expr() parser in htaccess context. */
- if (in_htaccess) flags |= AP_EXPR_FLAG_RESTRICTED;
newcond->expr = ap_expr_parse_cmd(cmd, a2, flags, &err, NULL);
if (err)
return apr_psprintf(cmd->pool, "RewriteCond: cannot compile "
Modified: httpd/httpd/trunk/modules/metadata/mod_setenvif.c
==============================================================================
--- httpd/httpd/trunk/modules/metadata/mod_setenvif.c Fri Jun 5 10:26:23 2026 (r1935015)
+++ httpd/httpd/trunk/modules/metadata/mod_setenvif.c Fri Jun 5 10:27:34 2026 (r1935016)
@@ -437,11 +437,6 @@ static const char *add_setenvifexpr(cmd_
const char *err;
unsigned int flags = 0;
- /* Use restricted ap_expr() parser in htaccess context. */
- if (cmd->pool == cmd->temp_pool) {
- flags |= AP_EXPR_FLAG_RESTRICTED;
- }
-
/*
* Determine from our context into which record to put the entry.
* cmd->path == NULL means we're in server-wide context; otherwise,
Modified: httpd/httpd/trunk/modules/proxy/mod_proxy_fcgi.c
==============================================================================
--- httpd/httpd/trunk/modules/proxy/mod_proxy_fcgi.c Fri Jun 5 10:26:23 2026 (r1935015)
+++ httpd/httpd/trunk/modules/proxy/mod_proxy_fcgi.c Fri Jun 5 10:27:34 2026 (r1935016)
@@ -1344,11 +1344,6 @@ static const char *cmd_setenv(cmd_parms
const char *envvar = arg2;
unsigned int flags = 0;
- /* Use restricted ap_expr() parser in htaccess context. */
- if (cmd->pool == cmd->temp_pool) {
- flags |= AP_EXPR_FLAG_RESTRICTED;
- }
-
new = apr_array_push(dconf->env_fixups);
new->cond = ap_expr_parse_cmd(cmd, arg1, flags, &err, NULL);
if (err) {
Modified: httpd/httpd/trunk/server/util_expr_eval.c
==============================================================================
--- httpd/httpd/trunk/server/util_expr_eval.c Fri Jun 5 10:26:23 2026 (r1935015)
+++ httpd/httpd/trunk/server/util_expr_eval.c Fri Jun 5 10:27:34 2026 (r1935016)
@@ -639,6 +639,12 @@ AP_DECLARE(ap_expr_info_t*) ap_expr_pars
info->line_number = cmd->directive->line_num;
info->flags = flags;
info->module_index = module_index;
+
+ /* Use restricted-contents ap_expr() parser in htaccess context. */
+ if (cmd->pool == cmd->temp_pool) {
+ info->flags |= AP_EXPR_FLAG_RESTRICTED_FILE_FUNC;
+ }
+
*err = ap_expr_parse(cmd->pool, cmd->temp_pool, info, expr, lookup_fn);
if (*err)
@@ -2079,11 +2085,15 @@ static int op_strcmatch(ap_expr_eval_ctx
return (APR_SUCCESS == apr_fnmatch(arg2, arg1, APR_FNM_CASE_BLIND));
}
+#define RESTRICTED_FILE_TEST 0x01
+#define RESTRICTED_FILE_FUNC 0x02
+#define RESTRICTED_ALL (RESTRICTED_FILE_TEST | RESTRICTED_FILE_FUNC)
+
struct expr_provider_single {
const void *func;
const char *name;
ap_expr_lookup_fn_t *arg_parsing_func;
- int restricted;
+ unsigned int restricted;
};
struct expr_provider_multi {
@@ -2113,9 +2123,9 @@ static const struct expr_provider_single
{ toupper_func, "toupper", NULL, 0 },
{ escape_func, "escape", NULL, 0 },
{ unescape_func, "unescape", NULL, 0 },
- { file_func, "file", NULL, 1 },
- { filesize_func, "filesize", NULL, 1 },
- { filemod_func, "filemod", NULL, 1 },
+ { file_func, "file", NULL, RESTRICTED_FILE_FUNC },
+ { filesize_func, "filesize", NULL, RESTRICTED_FILE_FUNC },
+ { filemod_func, "filemod", NULL, RESTRICTED_FILE_FUNC },
{ base64_func, "base64", NULL, 0 },
{ unbase64_func, "unbase64", NULL, 0 },
{ sha1_func, "sha1", NULL, 0 },
@@ -2133,13 +2143,13 @@ static const struct expr_provider_single
{ op_nz, "z", NULL, 0 },
{ op_R, "R", subnet_parse_arg, 0 },
{ op_T, "T", NULL, 0 },
- { op_file_min, "d", NULL, 1 },
- { op_file_min, "e", NULL, 1 },
- { op_file_min, "f", NULL, 1 },
- { op_file_min, "s", NULL, 1 },
- { op_file_link, "L", NULL, 1 },
- { op_file_link, "h", NULL, 1 },
- { op_file_xbit, "x", NULL, 1 },
+ { op_file_min, "d", NULL, RESTRICTED_FILE_TEST },
+ { op_file_min, "e", NULL, RESTRICTED_FILE_TEST },
+ { op_file_min, "f", NULL, RESTRICTED_FILE_TEST },
+ { op_file_min, "s", NULL, RESTRICTED_FILE_TEST },
+ { op_file_link, "L", NULL, RESTRICTED_FILE_TEST },
+ { op_file_link, "h", NULL, RESTRICTED_FILE_TEST },
+ { op_file_xbit, "x", NULL, RESTRICTED_FILE_TEST },
{ op_file_subr, "F", NULL, 0 },
{ op_url_subr, "U", NULL, 0 },
{ op_url_subr, "A", NULL, 0 },
@@ -2197,8 +2207,10 @@ static int core_expr_lookup(ap_expr_look
else
match = !ap_cstr_casecmp(prov->name, parms->name);
if (match) {
- if ((parms->flags & AP_EXPR_FLAG_RESTRICTED)
- && prov->restricted) {
+ if (((parms->flags & AP_EXPR_FLAG_RESTRICTED)
+ && (prov->restricted & RESTRICTED_ALL))
+ || ((parms->flags & AP_EXPR_FLAG_RESTRICTED_FILE_FUNC)
+ && (prov->restricted & RESTRICTED_FILE_FUNC))) {
*parms->err =
apr_psprintf(parms->ptemp,
"%s%s not available in restricted context",