Skip Menu |
 

This queue is for tickets about the CGI-SSI CPAN distribution.

Report information
The Basics
Id: 41899
Status: rejected
Worked: 1 min
Priority: 0/
Queue: CGI-SSI

People
Owner: Nobody in particular
Requestors: jarich [...] perltraining.com.au
Cc:
AdminCc:

Bug Information
Severity: Critical
Broken in: 0.92
Fixed in: (no value)



Subject: CGI::SSI mishandles #if expr directives
Download (untitled) / with headers
text/plain 1.9k
It appears that CGI::SSI attempts to solve #if expr="..." directives by wrapping them in a Perl eval string. This can cause security issues (as well as lots of warnings) when the directive is something like: <!--#if expr="$HTTP_USER_AGENT=/Mozilla\/[1-4].[0-9]+/ && $HTTP_USER_AGENT != /MSIE [5-9].[0-9]+/" --> since the user can then set their user agent to something that will be evaled and thus have more privileges than they should have. The code responsible is: # line 463 sub _test { my($self,$test) = @_; my $retval = eval($test); return undef if $@; return defined $retval ? $retval : 0; } # line 513 sub if { my($self,$expr,$test) = @_; $expr = $test if @_ == 3; $self->_entering_if(); if($self->_test($expr)) { $self->_true(); } else { $self->_suspend(); } return ''; } Note that evaling this isn't the correct thing to do for any test of equality as it will instead test for ability to assign. So a more simple expression: <!--#if expr="${var}=1" --> will always return true if ${var} is changeable even if it was originally not 1. I expect that it will fail for regular expressions for the same reason. I realise that the correct behaviour (de-constructing what kind of test it is) will be a lot harder to implement, but it would be great to be able to handle apparently simple SSI such as: <!--#if expr="(${HTTP_USER_AGENT} = /Mozilla\/4/) && (${HTTP_USER_AGENT} != /MSIE/)" --> Netscape styles <!--#elif expr="(${HTTP_USER_AGENT} = /Mozilla\/4/) && (${HTTP_USER_AGENT} = /MSIE/)" --> <!--#if expr="${DOCUMENT_URI}=/flashy-site/" --> Flasy MSIE stlyes <!--#elif expr="${DOCUMENT_URI}=/plain-site/" --> Plain MSIE styles <!--#endif --> <!--#else --> You must be using Opera or sumfin? <!--#endif --> My understanding of SSI #if expr structures come from http://www.ssi-developer.net/ssi/conditional-expressions.shtml and a few other on-line tutorials. Thanks!
Download (untitled) / with headers
text/plain 385b
Hi, In the docs, you'll find it noted that "CGI::SSI has it's own flavor of SSI. Test expressions are Perlish." If you would like to submit a patch for the functionality you're asking for, that would be great! Otherwise, please make do with the current implementation if that works for you, or find another solution. What you're asking for is beyond what I can offer. Best, James
Download (untitled) / with headers
text/plain 1.3k
On Tue Dec 23 02:28:11 2008, jarich perltraining.com.au wrote: Show quoted text
> It appears that CGI::SSI attempts to solve #if expr="..." directives by > wrapping them in a Perl eval string. This can cause security issues
[...] Show quoted text
> > I realise that the correct behaviour (de-constructing what kind of test > it is) will be a lot harder to implement, but it would be great to be > able to handle apparently simple SSI
[...] Show quoted text
> My understanding of SSI #if expr structures come from > http://www.ssi-developer.net/ssi/conditional-expressions.shtml and a few > other on-line tutorials.
hi Jarich (and everyone else desperately wanting this functionality), I too had this need, and though its been 5 years since your request, I have taken it upon myself to try to implement this.. it is actually much harder than it seems, because apache is VERY quirky in how it does its expr parsing and resolution, and I keep finding instances where it just makes no sense to how you would think it should work, and trying to make it as faithful to the original has been really tedious. In any case, just to let you know that it /is/ being worked on. I haven't heard back from JAMES, the original author, and if by the time I'm done with this I still haven't heard back, I just might create a fork of this package with my changes. -- -insaner http://www.insaner.com
Download (untitled) / with headers
text/plain 1.5k
Hello, I am unable to maintain this project. If you would like to take over maintainership, just let me know what I need to do to facilitate that process. Many Thanks, James On Sat Oct 26 09:39:49 2013, INSANER wrote: Show quoted text
> On Tue Dec 23 02:28:11 2008, jarich perltraining.com.au wrote:
> > It appears that CGI::SSI attempts to solve #if expr="..." directives > > by > > wrapping them in a Perl eval string. This can cause security issues
> > [...] >
> > > > I realise that the correct behaviour (de-constructing what kind of > > test > > it is) will be a lot harder to implement, but it would be great to be > > able to handle apparently simple SSI
> > [...] >
> > My understanding of SSI #if expr structures come from > > http://www.ssi-developer.net/ssi/conditional-expressions.shtml and a > > few > > other on-line tutorials.
> > hi Jarich (and everyone else desperately wanting this functionality), > I too had this need, and though its been 5 years since your request, I > have taken it upon myself to try to implement this.. it is actually > much harder than it seems, because apache is VERY quirky in how it > does its expr parsing and resolution, and I keep finding instances > where it just makes no sense to how you would think it should work, > and trying to make it as faithful to the original has been really > tedious. In any case, just to let you know that it /is/ being worked > on. > > I haven't heard back from JAMES, the original author, and if by the > time I'm done with this I still haven't heard back, I just might > create a fork of this package with my changes.


This service is sponsored and maintained by Best Practical Solutions and runs on Perl.org infrastructure.

Please report any issues with rt.cpan.org to rt-cpan-admin@bestpractical.com.