Mercurial > hg > nginx-quic
annotate src/http/modules/ngx_http_stub_status_module.c @ 4664:356c91151658 stable-1.2
Merge of r4618: rewrite escaping fix (ticket #162).
The following code resulted in incorrect escaping of uri and possible
segfault:
location / {
rewrite ^(.*) $1?c=$1;
return 200 "$uri";
}
If there were arguments in a rewrite's replacement string, and length was
actually calculated (due to duplicate captures as in the example above,
or variables present), the is_args flag was set and incorrectly copied
after length calculation. This resulted in escaping applied to the uri part
of the replacement, resulting in incorrect escaping. Additionally, buffer
was allocated without escaping expected, thus this also resulted in buffer
overrun and possible segfault.
author | Maxim Dounin <mdounin@mdounin.ru> |
---|---|
date | Mon, 04 Jun 2012 11:07:19 +0000 |
parents | f12d474f0d5e |
children | 1c472e3b8c10 |
rev | line source |
---|---|
577 | 1 |
2 /* | |
3 * Copyright (C) Igor Sysoev | |
4412 | 4 * Copyright (C) Nginx, Inc. |
577 | 5 */ |
6 | |
487 | 7 |
8 #include <ngx_config.h> | |
9 #include <ngx_core.h> | |
10 #include <ngx_http.h> | |
11 | |
12 | |
13 static char *ngx_http_set_status(ngx_conf_t *cf, ngx_command_t *cmd, | |
14 void *conf); | |
577 | 15 |
487 | 16 static ngx_command_t ngx_http_status_commands[] = { |
17 | |
18 { ngx_string("stub_status"), | |
19 NGX_HTTP_SRV_CONF|NGX_HTTP_LOC_CONF|NGX_CONF_FLAG, | |
20 ngx_http_set_status, | |
21 0, | |
22 0, | |
23 NULL }, | |
24 | |
25 ngx_null_command | |
577 | 26 }; |
487 | 27 |
28 | |
577 | 29 |
667 | 30 static ngx_http_module_t ngx_http_stub_status_module_ctx = { |
509 | 31 NULL, /* preconfiguration */ |
32 NULL, /* postconfiguration */ | |
487 | 33 |
34 NULL, /* create main configuration */ | |
35 NULL, /* init main configuration */ | |
577 | 36 |
487 | 37 NULL, /* create server configuration */ |
38 NULL, /* merge server configuration */ | |
577 | 39 |
487 | 40 NULL, /* create location configuration */ |
41 NULL /* merge location configuration */ | |
42 }; | |
43 | |
44 | |
45 ngx_module_t ngx_http_stub_status_module = { | |
509 | 46 NGX_MODULE_V1, |
487 | 47 &ngx_http_stub_status_module_ctx, /* module context */ |
48 ngx_http_status_commands, /* module directives */ | |
49 NGX_HTTP_MODULE, /* module type */ | |
541 | 50 NULL, /* init master */ |
487 | 51 NULL, /* init module */ |
541 | 52 NULL, /* init process */ |
53 NULL, /* init thread */ | |
54 NULL, /* exit thread */ | |
55 NULL, /* exit process */ | |
56 NULL, /* exit master */ | |
57 NGX_MODULE_V1_PADDING | |
487 | 58 }; |
59 | |
60 | |
61 static ngx_int_t ngx_http_status_handler(ngx_http_request_t *r) | |
62 { | |
495 | 63 size_t size; |
64 ngx_int_t rc; | |
65 ngx_buf_t *b; | |
66 ngx_chain_t out; | |
67 ngx_atomic_int_t ap, hn, ac, rq, rd, wr; | |
577 | 68 |
487 | 69 if (r->method != NGX_HTTP_GET && r->method != NGX_HTTP_HEAD) { |
70 return NGX_HTTP_NOT_ALLOWED; | |
71 } | |
72 | |
1370
cc114c85be0f
rename ngx_http_discard_body() to ngx_http_discard_request_body()
Igor Sysoev <igor@sysoev.ru>
parents:
667
diff
changeset
|
73 rc = ngx_http_discard_request_body(r); |
487 | 74 |
1374 | 75 if (rc != NGX_OK) { |
487 | 76 return rc; |
77 } | |
78 | |
3516
dd1570b6f237
ngx_str_set() and ngx_str_null()
Igor Sysoev <igor@sysoev.ru>
parents:
1563
diff
changeset
|
79 ngx_str_set(&r->headers_out.content_type, "text/plain"); |
487 | 80 |
81 if (r->method == NGX_HTTP_HEAD) { | |
82 r->headers_out.status = NGX_HTTP_OK; | |
83 | |
84 rc = ngx_http_send_header(r); | |
85 | |
86 if (rc == NGX_ERROR || rc > NGX_OK || r->header_only) { | |
87 return rc; | |
88 } | |
89 } | |
90 | |
495 | 91 size = sizeof("Active connections: \n") + NGX_ATOMIC_T_LEN |
487 | 92 + sizeof("server accepts handled requests\n") - 1 |
495 | 93 + 6 + 3 * NGX_ATOMIC_T_LEN |
94 + sizeof("Reading: Writing: Waiting: \n") + 3 * NGX_ATOMIC_T_LEN; | |
487 | 95 |
501 | 96 b = ngx_create_temp_buf(r->pool, size); |
97 if (b == NULL) { | |
487 | 98 return NGX_HTTP_INTERNAL_SERVER_ERROR; |
99 } | |
100 | |
101 out.buf = b; | |
102 out.next = NULL; | |
103 | |
104 ap = *ngx_stat_accepted; | |
495 | 105 hn = *ngx_stat_handled; |
487 | 106 ac = *ngx_stat_active; |
107 rq = *ngx_stat_requests; | |
108 rd = *ngx_stat_reading; | |
109 wr = *ngx_stat_writing; | |
110 | |
509 | 111 b->last = ngx_sprintf(b->last, "Active connections: %uA \n", ac); |
487 | 112 |
113 b->last = ngx_cpymem(b->last, "server accepts handled requests\n", | |
114 sizeof("server accepts handled requests\n") - 1); | |
115 | |
509 | 116 b->last = ngx_sprintf(b->last, " %uA %uA %uA \n", ap, hn, rq); |
487 | 117 |
509 | 118 b->last = ngx_sprintf(b->last, "Reading: %uA Writing: %uA Waiting: %uA \n", |
493 | 119 rd, wr, ac - (rd + wr)); |
487 | 120 |
121 r->headers_out.status = NGX_HTTP_OK; | |
122 r->headers_out.content_length_n = b->last - b->pos; | |
123 | |
4659
f12d474f0d5e
Merge of r4612: proper subrequest handling in various modules.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4412
diff
changeset
|
124 b->last_buf = (r == r->main) ? 1 : 0; |
487 | 125 |
126 rc = ngx_http_send_header(r); | |
127 | |
128 if (rc == NGX_ERROR || rc > NGX_OK || r->header_only) { | |
129 return rc; | |
130 } | |
131 | |
1563
022ec9420f80
style fix: remove double semicolons
Igor Sysoev <igor@sysoev.ru>
parents:
1374
diff
changeset
|
132 return ngx_http_output_filter(r, &out); |
487 | 133 } |
134 | |
135 | |
136 static char *ngx_http_set_status(ngx_conf_t *cf, ngx_command_t *cmd, void *conf) | |
137 { | |
138 ngx_http_core_loc_conf_t *clcf; | |
139 | |
140 clcf = ngx_http_conf_get_module_loc_conf(cf, ngx_http_core_module); | |
141 clcf->handler = ngx_http_status_handler; | |
142 | |
143 return NGX_CONF_OK; | |
144 } |