Mercurial > hg > nginx-quic
annotate conf/uwsgi_params @ 9075:b71e69247483 default
Variables: avoid possible buffer overrun with some "$sent_http_*".
The existing logic to evaluate multi header "$sent_http_*" variables,
such as $sent_http_cache_control, as previously introduced in 1.23.0,
doesn't take into account that one or more elements can be cleared,
yet still present in a linked list, pointed to by the next field.
Such elements don't contribute to the resulting variable length, an
attempt to append a separator for them ends up in out of bounds write.
This is not possible with standard modules, though at least one third
party module is known to override multi header values this way, so it
makes sense to harden the logic.
The fix restores a generic boundary check.
author | Sergey Kandaurov <pluknet@nginx.com> |
---|---|
date | Mon, 01 May 2023 19:16:05 +0400 |
parents | 62869a9b2e7d |
children |
rev | line source |
---|---|
3541
21452748d165
import original ngx_http_uwsgi_module version
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
1 |
21452748d165
import original ngx_http_uwsgi_module version
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
2 uwsgi_param QUERY_STRING $query_string; |
21452748d165
import original ngx_http_uwsgi_module version
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
3 uwsgi_param REQUEST_METHOD $request_method; |
21452748d165
import original ngx_http_uwsgi_module version
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
4 uwsgi_param CONTENT_TYPE $content_type; |
21452748d165
import original ngx_http_uwsgi_module version
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
5 uwsgi_param CONTENT_LENGTH $content_length; |
21452748d165
import original ngx_http_uwsgi_module version
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
6 |
21452748d165
import original ngx_http_uwsgi_module version
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
7 uwsgi_param REQUEST_URI $request_uri; |
3542
9bf51b3fc1c1
style fix: remove tabs and trailing spaces
Igor Sysoev <igor@sysoev.ru>
parents:
3541
diff
changeset
|
8 uwsgi_param PATH_INFO $document_uri; |
3541
21452748d165
import original ngx_http_uwsgi_module version
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
9 uwsgi_param DOCUMENT_ROOT $document_root; |
21452748d165
import original ngx_http_uwsgi_module version
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
10 uwsgi_param SERVER_PROTOCOL $server_protocol; |
6168
62869a9b2e7d
Added the REQUEST_SCHEME parameter.
Maxim Dounin <mdounin@mdounin.ru>
parents:
4333
diff
changeset
|
11 uwsgi_param REQUEST_SCHEME $scheme; |
4333
352a7b025f2e
Added HTTPS param with Apache-like behaviour to fastcgi/scgi/uwsgi_params (fixes #38).
Valentin Bartenev <vbart@nginx.com>
parents:
3542
diff
changeset
|
12 uwsgi_param HTTPS $https if_not_empty; |
3541
21452748d165
import original ngx_http_uwsgi_module version
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
13 |
21452748d165
import original ngx_http_uwsgi_module version
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
14 uwsgi_param REMOTE_ADDR $remote_addr; |
21452748d165
import original ngx_http_uwsgi_module version
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
15 uwsgi_param REMOTE_PORT $remote_port; |
21452748d165
import original ngx_http_uwsgi_module version
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
16 uwsgi_param SERVER_PORT $server_port; |
21452748d165
import original ngx_http_uwsgi_module version
Igor Sysoev <igor@sysoev.ru>
parents:
diff
changeset
|
17 uwsgi_param SERVER_NAME $server_name; |