| Subject: | Catalyst::Engine::CGI and HTTP::Request::AsCGI not compatible to Apache CGI PATH_INFO escape |
| Date: | Mon, 28 Sep 2009 18:57:43 -0700 |
| To: | bug-Catalyst-Runtime [...] rt.cpan.org |
| From: | Tatsuhiko Miyagawa <miyagawa [...] gmail.com> |
See https://issues.apache.org/bugzilla/show_bug.cgi?id=35256 and RFC
3875: In Apache,
lighttpd and many web servers PATH_INFO are always decoded, including
URI reserved
characters.
Looking at the tickets and svn logs in the past, Catalyst has dealt
with this bug by masking
the bug: fixing HTTP::Request::AsCGI so it won't escape %2c etc. which
is not compatible to
what Apache does.
The partial decoding makes the situation worse since now you can't
tell foo%2cbar vs
foo%252cbar, and that could become a security hole with double decoding.
You can reproduce this bug by creating a CGI file that does
TestApp->run from Catalyst-
Runtime/t/lib, and access
catalyst_test.cgi/chained/capture%2Farg%3B/return_arg/foo%2Fbar%3B
which would fail with
UNKNOWN_RESOURCE error.
Attached patch makes HTTP::Request::AsCGI to decode all characters
including URI reserved
characters, and let Catalyst::Engine::CGI figure out the original
encoded path from
$ENV{REQUEST_URI} which unfortunately is not part of CGI RFC 3875, but
is available
universally (and works with HTTP::Request::AsCGI too).
--
Tatsuhiko Miyagawa
Message body is not shown because sender requested not to inline it.
Message body is not shown because sender requested not to inline it.