clearsilver bug in cgi-parse, form posting with explicit chartset...
David Jeske <[email protected]> Sat, 7 Apr 2012 14:57:40 -0700
| Newsgroups | gmane.text.clearsilver.general |
|---|---|
| Message-ID | <CA+CP9O5h_YM4282e-TXnO5qvA1ze=CpRKYGytTdB2DNsFD8fFg@mail.gmail.com> |
--bcaec5396dfed4f07804bd1ddd7d
Content-Type: text/plain; charset=ISO-8859-1
I just ran into a bug in clearsilver that I'm surprised has existed for so
long.
The problem occured because Firefox is specifying a character set in the
content type of form posts, ala...
application/x-www-form-urlencoded; charset=UTF-8
Clearsilver cgi_parse was expecting an exact match for
"application/x-www-form-urlencoded"..
I fixed this by having clearsilver check only the prefix of content type,
as you can see in my patch below. There is probably a better way to fix
this, by having clearsilver properly parse the content type for it's parts
according to the spec. Though perhaps this fix is enough...
root@w5:/home/hassan# diff -c clearsilver-0.10.5-orig/cgi/cgi.c
clearsilver-0.10.5/cgi/cgi.c
*** clearsilver-0.10.5-orig/cgi/cgi.c 2007-07-11 19:38:03.000000000 -0700
--- clearsilver-0.10.5/cgi/cgi.c 2012-04-07 14:52:12.742725038 -0700
***************
*** 640,646 ****
if (!strcmp(method, "POST"))
{
! if (type && !strcmp(type, "application/x-www-form-urlencoded"))
{
err = _parse_post_form(cgi);
if (err != STATUS_OK) return nerr_pass (err);
--- 640,647 ----
if (!strcmp(method, "POST"))
{
! const char *formType = "application/x-www-form-urlencoded";
! if (type && !strncmp(type, formType, strlen(formType)-1 ))
{
err = _parse_post_form(cgi);
if (err != STATUS_OK) return nerr_pass (err);
--bcaec5396dfed4f07804bd1ddd7d
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/htm=
l4/strict.dtd">
<html>
<head>
</head>
<body style=3D"background-color: #fff;">
<span style=3D"display:none"> </span>
<!--~-|**|PrettyHtmlStartT|**|-~-->
<div id=3D"ygrp-mlmsg" style=3D"position:relative;">
<div id=3D"ygrp-msg" style=3D"z-index: 1;">
<!--~-|**|PrettyHtmlEndT|**|-~-->
<div id=3D"ygrp-text" >
=20=20=20=20=20=20
=20=20=20=20=20=20
<p><div>I just ran into a bug in clearsilver that I'm surprised h=
as existed for so long.</div><div><br>The problem occured because Firefox i=
s specifying a character set in the content type of form posts, ala...</div=
><div>
<br></div><div>=A0 =A0application/x-www-form-urlencoded; charset=3DUTF-8</d=
iv><div><br></div><div>Clearsilver cgi_parse was expecting an exact match f=
or "application/x-www-form-urlencoded"..</div><div><br></div><div=
>
I fixed this by having clearsilver check only the prefix of content type, a=
s you can see in my patch below. There is probably a better way to fix this=
, by having clearsilver properly parse the content type for it's parts =
according to the spec. Though perhaps this fix is enough...</div>
<div><br></div><div><br></div><div><br></div><div><br></div><div>root@w5:/h=
ome/hassan# diff -c clearsilver-0.10.5-orig/cgi/cgi.c clearsilver-0.10.5/cg=
i/cgi.c</div><div>*** clearsilver-0.10.5-orig/cgi/cgi.c =A0 2007-07-11 19:3=
8:03.000000000 -0700</div>
<div>--- clearsilver-0.10.5/cgi/cgi.c =A0 =A0 =A0 =A02012-04-07 14:52:12.74=
2725038 -0700</div><div>***************</div><div>*** 640,646 ****</div><di=
v><br></div><div>=A0 =A0 if (!strcmp(method, "POST"))</div><div>=
=A0 =A0 {</div>
<div>! =A0 =A0 if (type && !strcmp(type, "application/x-www-fo=
rm-urlencoded"))</div><div>=A0 =A0 =A0 {</div><div>=A0 =A0 =A0 =A0 err=
=3D _parse_post_form(cgi);</div><div>=A0 =A0 =A0 =A0 if (err !=3D STATUS_O=
K) return nerr_pass (err);</div>
<div>--- 640,647 ----</div><div><br></div><div>=A0 =A0 if (!strcmp(method, =
"POST"))</div><div>=A0 =A0 {</div><div>! =A0 =A0 const char *form=
Type =3D "application/x-www-form-urlencoded";</div><div>! =A0 =A0=
if (type && !strncmp(type, formType, strlen(formType)-1 ))</div>
<div>=A0 =A0 =A0 {</div><div>=A0 =A0 =A0 =A0 err =3D _parse_post_form(cgi);=
</div><div>=A0 =A0 =A0 =A0 if (err !=3D STATUS_OK) return nerr_pass (err);<=
/div><div><br></div>
</p>
</div>
=20=20=20=20=20
<!--~-|**|PrettyHtmlStart|**|-~-->
<div style=3D"color: #fff; height: 0;">__._,_.___</div>
=20=20=20=20=20=20=20=20
=20=20
=20=20=20
<div id=3D"ygrp-actbar" style=3D"clear: both; margin-bottom: 10px; whit=
e-space: nowrap; color: #666; padding-top: 15px;">
<div>
<a href=3D"mailto:[email protected]?subject=3DRe%3A%20clearsilver%20=
bug%20in%20cgi-parse%2C%20form%20posting%20with%20explicit%20chartset%2E%2E=
%2E" style=3D"margin-right: 0; padding-right: 0;">
Reply to <span style=3D"font-weight: 700;">sender</span></a> |
<a href=3D"mailto:[email protected]?subject=3DRe%3A%20cle=
arsilver%20bug%20in%20cgi-parse%2C%20form%20posting%20with%20explicit%20cha=
rtset%2E%2E%2E">
Reply to <span style=3D"font-weight: 700;">group</span></a> |
<a href=3D"http://groups.yahoo.com/group/ClearSilver/post;_ylc=
=3DX3oDMTJwM3Vncm43BF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3Mjgx=
OTQyBG1zZ0lkAzE0MzgEc2VjA2Z0cgRzbGsDcnBseQRzdGltZQMxMzMzODM1ODgz?act=3Drepl=
y&messageNum=3D1438">Reply <span style=3D"font-weight: 700;">via web post</=
span></a> |
<a href=3D"http://groups.yahoo.com/group/ClearSilver/post;_ylc=
=3DX3oDMTJlMXVoMWpvBF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3Mjgx=
OTQyBHNlYwNmdHIEc2xrA250cGMEc3RpbWUDMTMzMzgzNTg4Mw--" style=3D"font-weight:=
700;">Start a New Topic</a>
</div>
<a href=3D"http://groups.yahoo.com/group/ClearSilver/messag=
e/1438;_ylc=3DX3oDMTM0bmNkZXZhBF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZ=
AMxNzA3MjgxOTQyBG1zZ0lkAzE0MzgEc2VjA2Z0cgRzbGsDdnRwYwRzdGltZQMxMzMzODM1ODgz=
BHRwY0lkAzE0Mzg-">Messages in this topic</a>
(<span style=3D"font-weight: 700;">1</span>)
</div>=20
<!------- Start Nav Bar ------>
<!-- |**|begin egp html banner|**| -->
<div id=3D"ygrp-vital" style=3D"background-color: #e0ecee; font-family: Ver=
dana; font-size: 10px; margin-bottom: 10px; padding: 10px;">
<span id=3D"vithd" style=3D"font-weight: bold; color: #333; text-tran=
sform: uppercase; ">Recent Activity:</span>
<ul style=3D"list-style-type: none; margin: 0; padding: 0; display: inl=
ine;">
</ul>
=20=20=20=20
<div style=3D"clear: both; padding-top: 2px; color: #1e66ae;">
<a href=3D"http://groups.yahoo.com/group/ClearSilver;_ylc=3DX3oDMTJldG5=
pb3B1BF9TAzk3MzU5NzE0BGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwN2dG=
wEc2xrA3ZnaHAEc3RpbWUDMTMzMzgzNTg4Mw--" style=3D"text-decoration: none;">Vi=
sit Your Group</a>
</div>
</div>
=20=20
<div id=3D"ft" style=3D"font-family: Arial; font-size: 11px; margin-top: 5p=
x; padding: 0 2px 0 0; clear: both;">
<a href=3D"http://groups.yahoo.com/;_ylc=3DX3oDMTJkbTVqdTFxBF9TAzk3NDc2NT=
kwBGdycElkAzM1NjQxMzcEZ3Jwc3BJZAMxNzA3MjgxOTQyBHNlYwNmdHIEc2xrA2dmcARzdGltZ=
QMxMzMzODM1ODgz" style=3D"float: left;"><img src=3D"http://l.yimg.com/a/i/u=
s/yg/logo/us.gif" height=3D"15" width=3D"137" alt=3D"Yahoo! Groups" style=
=3D"border: 0;"/></a>
<div style=3D"color: #747575; float: right;">Switch to: <a href=3D"mailto=
:[email protected]?subject=3DChange Delivery Format: =
Traditional" style=3D"text-decoration: none;">Text-Only</a>, <a href=3D"mai=
lto:[email protected]?subject=3DEmail Delivery: Digest" cl=
ass=3D"margin-rt" style=3D"text-decoration: none;">Daily Digest</a> • =
<a href=3D"mailto:[email protected]?subject=3DUnsubsc=
ribe" style=3D"text-decoration: none;">Unsubscribe</a> • <a href=3D"ht=
tp://docs.yahoo.com/info/terms/" style=3D"text-decoration: none;">Terms of =
Use</a></div>
</div>
<!-- |**|end egp html banner|**| -->
</div> <!-- ygrp-msg -->
<!-- Sponsor -->
<!-- |**|begin egp html banner|**| -->
<div id=3D"ygrp-sponsor" style=3D"width:160px; float:right; clear:none; m=
argin:0 0 25px 0; background: #fff;">
<!-- Start Recommendations -->
<div id=3D"ygrp-reco">
</div>
<!-- End Recommendations -->
</div> <!-- |**|end egp html banner|**| -->
<div style=3D"clear:both; color: #FFF; font-size:1px;">.</div>
</div>
<img src=3D"http://geo.yahoo.com/serv?s=3D97359714/grpId=3D3564137/grpspI=
d=3D1707281942/msgId=3D1438/stime=3D1333835883/nc1=3D5522124/nc2=3D4507179/=
nc3=3D3848640" width=3D"1" height=3D"1"> <br>
<div style=3D"color: #fff; height: 0;">__,_._,___</div>
<!--~-|**|PrettyHtmlEnd|**|-~-->
</body>
<!--~-|**|PrettyHtmlStart|**|-~-->
<head>
<style type=3D"text/css">
<!--
#ygrp-mkp {
border: 1px solid #d8d8d8;
font-family: Arial;
margin: 10px 0;
padding: 0 10px;
}
#ygrp-mkp hr {
border: 1px solid #d8d8d8;
}
#ygrp-mkp #hd {
color: #628c2a;
font-size: 85%;
font-weight: 700;
line-height: 122%;
margin: 10px 0;
}
#ygrp-mkp #ads {
margin-bottom: 10px;
}
#ygrp-mkp .ad {
padding: 0 0;
}
#ygrp-mkp .ad p {
margin: 0;
}
#ygrp-mkp .ad a {
color: #0000ff;
text-decoration: none;
}
#ygrp-sponsor #ygrp-lc {
font-family: Arial;
}
#ygrp-sponsor #ygrp-lc #hd {
margin: 10px 0px;
font-weight: 700;
font-size: 78%;
line-height: 122%;
}
#ygrp-sponsor #ygrp-lc .ad {
margin-bottom: 10px;
padding: 0 0;
}
a {
color: #1e66ae;
}
#actions {
font-family: Verdana;
font-size: 11px;
padding: 10px 0;
}
#activity {
background-color: #e0ecee;
float: left;
font-family: Verdana;
font-size: 10px;
padding: 10px;
}
#activity span {
font-weight: 700;
}
#activity span:first-child {
text-transform: uppercase;
}
#activity span a {
color: #5085b6;
text-decoration: none;
}
#activity span span {
color: #ff7900;
}
#activity span .underline {
text-decoration: underline;
}
.attach {
clear: both;
display: table;
font-family: Arial;
font-size: 12px;
padding: 10px 0;
width: 400px;
}
.attach div a {
text-decoration: none;
}
.attach img {
border: none;
padding-right: 5px;
}
.attach label {
display: block;
margin-bottom: 5px;
}
.attach label a {
text-decoration: none;
}
=20=20
blockquote {
margin: 0 0 0 4px;
}
.bold {
font-family: Arial;
font-size: 13px;
font-weight: 700;
}
.bold a {
text-decoration: none;
}
dd.last p a {
font-family: Verdana;
font-weight: 700;
}
dd.last p span {
margin-right: 10px;
font-family: Verdana;
font-weight: 700;
}
dd.last p span.yshortcuts {
margin-right: 0;
}
div.attach-table div div a {
text-decoration: none;
}
div.attach-table {
width: 400px;
}
div.file-title a, div.file-title a:active, div.file-title a:hover, div.fi=
le-title a:visited {
text-decoration: none;
}
div.photo-title a, div.photo-title a:active, div.photo-title a:hover, div=
.photo-title a:visited {
text-decoration: none;
}
div#ygrp-mlmsg #ygrp-msg p a span.yshortcuts {
font-family: Verdana;
font-size: 10px;
font-weight: normal;
}
.green {
color: #628c2a;
}
.MsoNormal {
margin: 0 0 0 0;
}
o {
font-size: 0;
}
#photos div {
float: left;
width: 72px;
}
#photos div div {
border: 1px solid #666666;
height: 62px;
overflow: hidden;
width: 62px;
}
#photos div label {
color: #666666;
font-size: 10px;
overflow: hidden;
text-align: center;
white-space: nowrap;
width: 64px;
}
#reco-category {
font-size: 77%;
}
#reco-desc {
font-size: 77%;
}
.replbq {
margin: 4px;
}
#ygrp-actbar div a:first-child {
/* border-right: 0px solid #000;*/
margin-right: 2px;
padding-right: 5px;
}
#ygrp-mlmsg {
font-size: 13px;
font-family: Arial, helvetica,clean, sans-serif;
*font-size: small;
*font: x-small;
}
#ygrp-mlmsg table {
font-size: inherit;
font: 100%;
}
#ygrp-mlmsg select, input, textarea {
font: 99% Arial, Helvetica, clean, sans-serif;
}
#ygrp-mlmsg pre, code {
font:115% monospace;
*font-size:100%;
}
#ygrp-mlmsg * {
line-height: 1.22em;
}
#ygrp-mlmsg #logo {
padding-bottom: 10px;
}
#ygrp-mlmsg a {
color: #1E66AE;
}
#ygrp-msg p a {
font-family: Verdana;
}
#ygrp-msg p#attach-count span {
color: #1E66AE;
font-weight: 700;
}
#ygrp-reco #reco-head {
color: #ff7900;
font-weight: 700;
}
#ygrp-reco {
margin-bottom: 20px;
padding: 0px;
}
#ygrp-sponsor #ov li a {
font-size: 130%;
text-decoration: none;
}
#ygrp-sponsor #ov li {
font-size: 77%;
list-style-type: square;
padding: 6px 0;
}=20
#ygrp-sponsor #ov ul {
margin: 0;
padding: 0 0 0 8px;
}
#ygrp-text {
font-family: Georgia;
}
#ygrp-text p {
margin: 0 0 1em 0;
}
#ygrp-text tt {
font-size: 120%;
}
#ygrp-vital ul li:last-child {
border-right: none !important;=20
}=20
-->
</style>
</head>
<!--~-|**|PrettyHtmlEnd|**|-~-->
</html>
<!-- end group email -->
--bcaec5396dfed4f07804bd1ddd7d--