Mailing List Archive: Bug in 0.8.10 and 0.8.8 : multiple //// with cgi-scripts (fwd)

Bug in 0.8.10 and 0.8.8 : multiple //// with cgi-scripts (fwd)

Aug 20, 1995, 10:42 AM

Post #1 of 3 (366 views)

Forwarded message:
> From s.oosthoek@student.utwente.nl Sun Aug 20 02:35:14 1995
> Message-Id: <199508200935.AA26869@student.utwente.nl>
> Date: Sun, 20 Aug 95 11:35:08 0200
> From: Simon Oosthoek <s.oosthoek@student.utwente.nl>
> X-Mailer: Mozilla 1.2b5 (Windows; I; 32bit)
> Mime-Version: 1.0
> To: apache-bugs@apache.org
> Subject: Bug in 0.8.10 and 0.8.8 : multiple //// with cgi-scripts
> Content-Transfer-Encoding: 7bit
> Content-Type: text/plain; charset=us-ascii
>
> Hello People,
>
> I have very recently started using the apache web-server (first 0.8.8, now
> 0.8.10).
>
> I have noticed that unlike ncsa, multiple slashes are converted nicely to a
> single /, however that doesn't go for cgi-scripts.
> I use a line like this:
>
> <IMG
> SRC="cgi-bin/nph-count?width=5&link=http://cal003109.student.utwente.nl/ind
> ex.html">
>
> if I call the page with http://cal003109.student.utwente.nl////tmp.html the
> counter shows up in the error_log:
>
> [Sun Aug 20 11:18:47 1995] access to /WWW/httpdocs////cgi-bin failed for
> cal003105.student.utwente.nl, reason: File does not exist
>
> but only the counter, everything else is fine!
>
> I hope you can do something with this info.
>
> anyway, thanks for sharing apache with the world!
>
> Simon
>
> (the system is a 398dx33 (8MB) with linux (slackware) 1.2.11
> if you need more details, just ask.)
>
>
>

Re: Bug in 0.8.10 and 0.8.8 : multiple //// with cgi-scripts (fwd) [ In reply to ]

paul at netcraft

Aug 20, 1995, 10:59 AM

Post #2 of 3 (362 views)

Permalink

In reply to Rob Hartill who said
>
> >
> > <IMG
> > SRC="cgi-bin/nph-count?width=5&link=http://cal003109.student.utwente.nl/ind
> > ex.html">
> >
> > if I call the page with http://cal003109.student.utwente.nl////tmp.html the
> > counter shows up in the error_log:
> >
> > [Sun Aug 20 11:18:47 1995] access to /WWW/httpdocs////cgi-bin failed for
> > cal003105.student.utwente.nl, reason: File does not exist
> >

I'm not sure what Apache is outputting, guess I should go and look, but this
looks like a Linux bug anyway. The OS should collapse multiple / in paths
and find the file even if Apache is leaving multiple / in them.

The file does exist and is readable? It'd be worth checking pilot error
before looking for non-existent bugs.

--
Paul Richards, Bluebird Computer Systems. FreeBSD core team member.
Internet: paul@FreeBSD.org, http://www.freebsd.org/~paul
Phone: 0370 462071 (Mobile), +44 1222 457651 (home)

Re: Bug in 0.8.10 and 0.8.8 : multiple //// with cgi-scripts (fwd) [ In reply to ]

rst at ai

Aug 20, 1995, 2:06 PM

Post #3 of 3 (363 views)

Permalink

> >
> > <IMG
> > SRC="cgi-bin/nph-count?width=5&link=http://cal003109.student.utwente.nl/ind
> > ex.html">
> >
> > if I call the page with http://cal003109.student.utwente.nl////tmp.html the
> > counter shows up in the error_log:
> >
> > [Sun Aug 20 11:18:47 1995] access to /WWW/httpdocs////cgi-bin failed for
> > cal003105.student.utwente.nl, reason: File does not exist
>
I'm not sure what Apache is outputting, guess I should go and look, but this
looks like a Linux bug anyway. The OS should collapse multiple / in paths
and find the file even if Apache is leaving multiple / in them.

It's not an OS problem --- the bug is that we get a request for
the URI '///cgi-bin/...' (because of the relative link in the original
document, '<img src="cgi-bin/...">', which was requested as '///tmp.html',
or something like that), and 0.8.x isn't matching a request for ///cgi-bin
with an alias for /cgi-bin.

(Why? Well, way back when we decided that smashing multiple slashes in
PATH_INFO was a bug. However, you don't know where PATH_INFO starts until
you've translated the URI, so you've got to preserve them through Alias
translation at least --- and that module does all of its comparisons via
strcmp()).

At any rate, one workaround for this particular guy, at least, is to
add the initial '/' himself --- <img src="/cgi-bin/...">, thereby gaining
for himself a document which will work somewhere other than DocumentRoot...

rst