Skip to content

Commit beb5c6b

Browse files
doujiang24thibaultcha
doujiang24
authored and
thibaultcha
committed
bugfix: allow the use of spaces in 'ngx.req.set_uri()'.
Signed-off-by: Thibault Charbonnier <[email protected]>
1 parent 6d270c3 commit beb5c6b

10 files changed

+71
-93
lines changed

‎src/ngx_http_lua_control.c

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -239,8 +239,8 @@ ngx_http_lua_ngx_redirect(lua_State *L)
239239
"the headers");
240240
}
241241

242-
if (ngx_http_lua_check_unsafe_header(r, p, len) != NGX_OK) {
243-
return luaL_error(L, "attempt to use unsafe uri");
242+
if (ngx_http_lua_check_unsafe_string(r, p, len, "redirect uri") != NGX_OK) {
243+
return luaL_error(L, "attempt to set unsafe redirect uri");
244244
}
245245

246246
uri = ngx_palloc(r->pool, len);

‎src/ngx_http_lua_headers_in.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -658,8 +658,10 @@ ngx_http_lua_set_input_header(ngx_http_request_t *r, ngx_str_t key,
658658

659659
dd("set header value: %.*s", (int) value.len, value.data);
660660

661-
if (ngx_http_lua_check_unsafe_header(r, key.data, key.len) != NGX_OK
662-
|| ngx_http_lua_check_unsafe_header(r, value.data, value.len) != NGX_OK)
661+
if (ngx_http_lua_check_unsafe_string(r, key.data, key.len,
662+
"header name") != NGX_OK
663+
|| ngx_http_lua_check_unsafe_string(r, value.data, value.len,
664+
"header value") != NGX_OK)
663665
{
664666
return NGX_ERROR;
665667
}

‎src/ngx_http_lua_headers_out.c

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -491,8 +491,10 @@ ngx_http_lua_set_output_header(ngx_http_request_t *r, ngx_http_lua_ctx_t *ctx,
491491

492492
dd("set header value: %.*s", (int) value.len, value.data);
493493

494-
if (ngx_http_lua_check_unsafe_header(r, key.data, key.len) != NGX_OK
495-
|| ngx_http_lua_check_unsafe_header(r, value.data, value.len) != NGX_OK)
494+
if (ngx_http_lua_check_unsafe_string(r, key.data, key.len,
495+
"header name") != NGX_OK
496+
|| ngx_http_lua_check_unsafe_string(r, value.data, value.len,
497+
"header value") != NGX_OK)
496498
{
497499
return NGX_ERROR;
498500
}

‎src/ngx_http_lua_uri.c

Lines changed: 2 additions & 56 deletions
Original file line numberDiff line numberDiff line change
@@ -16,8 +16,6 @@
1616

1717

1818
static int ngx_http_lua_ngx_req_set_uri(lua_State *L);
19-
static ngx_inline ngx_int_t ngx_http_lua_check_unsafe_uri(ngx_http_request_t *r,
20-
u_char *str, size_t len);
2119

2220

2321
void
@@ -57,8 +55,8 @@ ngx_http_lua_ngx_req_set_uri(lua_State *L)
5755
return luaL_error(L, "attempt to use zero-length uri");
5856
}
5957

60-
if (ngx_http_lua_check_unsafe_uri(r, p, len) != NGX_OK) {
61-
return luaL_error(L, "attempt to use unsafe uri");
58+
if (ngx_http_lua_check_unsafe_string(r, p, len, "uri") != NGX_OK) {
59+
return luaL_error(L, "attempt to set unsafe uri");
6260
}
6361

6462
if (n == 2) {
@@ -114,56 +112,4 @@ ngx_http_lua_ngx_req_set_uri(lua_State *L)
114112
}
115113

116114

117-
static ngx_inline ngx_int_t
118-
ngx_http_lua_check_unsafe_uri(ngx_http_request_t *r, u_char *str, size_t len)
119-
{
120-
size_t i, buf_len;
121-
u_char c;
122-
u_char *buf, *src = str;
123-
124-
/* %00-%1F, " ", %7F */
125-
126-
static uint32_t unsafe[] = {
127-
0xffffffff, /* 1111 1111 1111 1111 1111 1111 1111 1111 */
128-
129-
/* ?>=< ;:98 7654 3210 /.-, +*)( '&%$ #"! */
130-
0x00000001, /* 0000 0000 0000 0000 0000 0000 0000 0001 */
131-
132-
/* _^]\ [ZYX WVUT SRQP ONML KJIH GFED CBA@ */
133-
0x00000000, /* 0000 0000 0000 0000 0000 0000 0000 0000 */
134-
135-
/* ~}| {zyx wvut srqp onml kjih gfed cba` */
136-
0x80000000, /* 1000 0000 0000 0000 0000 0000 0000 0000 */
137-
138-
0x00000000, /* 0000 0000 0000 0000 0000 0000 0000 0000 */
139-
0x00000000, /* 0000 0000 0000 0000 0000 0000 0000 0000 */
140-
0x00000000, /* 0000 0000 0000 0000 0000 0000 0000 0000 */
141-
0x00000000 /* 0000 0000 0000 0000 0000 0000 0000 0000 */
142-
};
143-
144-
for (i = 0; i < len; i++, str++) {
145-
c = *str;
146-
if (unsafe[c >> 5] & (1 << (c & 0x1f))) {
147-
buf_len = ngx_http_lua_escape_log(NULL, src, len);
148-
buf = ngx_palloc(r->pool, buf_len);
149-
if (buf == NULL) {
150-
return NGX_ERROR;
151-
}
152-
153-
ngx_http_lua_escape_log(buf, src, len);
154-
155-
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
156-
"unsafe byte \"0x%uxd\" in uri \"%*s\"",
157-
(unsigned) c, buf_len, buf);
158-
159-
ngx_pfree(r->pool, buf);
160-
161-
return NGX_ERROR;
162-
}
163-
}
164-
165-
return NGX_OK;
166-
}
167-
168-
169115
/* vi:set ft=c ts=4 sw=4 et fdm=marker: */

‎src/ngx_http_lua_util.h

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -490,7 +490,8 @@ ngx_inet_get_port(struct sockaddr *sa)
490490

491491

492492
static ngx_inline ngx_int_t
493-
ngx_http_lua_check_unsafe_header(ngx_http_request_t *r, u_char *str, size_t len)
493+
ngx_http_lua_check_unsafe_string(ngx_http_request_t *r, u_char *str, size_t len,
494+
const char *name)
494495
{
495496
size_t i, buf_len;
496497
u_char c;
@@ -528,8 +529,8 @@ ngx_http_lua_check_unsafe_header(ngx_http_request_t *r, u_char *str, size_t len)
528529
ngx_http_lua_escape_log(buf, src, len);
529530

530531
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
531-
"unsafe byte \"0x%uxd\" in header \"%*s\"",
532-
(unsigned) c, buf_len, buf);
532+
"unsafe byte \"0x%uxd\" in %s \"%*s\"",
533+
(unsigned) c, name, buf_len, buf);
533534

534535
ngx_pfree(r->pool, buf);
535536

‎t/016-resp-header.t

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1982,7 +1982,7 @@ header:
19821982
foo:
19831983
bar:
19841984
--- error_log
1985-
unsafe byte "0xd" in header "value\x0Dfoo:bar\x0Abar:foo"
1985+
unsafe byte "0xd" in header value "value\x0Dfoo:bar\x0Abar:foo"
19861986
failed to set header
19871987
19881988
@@ -2003,7 +2003,7 @@ header:
20032003
foo:
20042004
bar:
20052005
--- error_log
2006-
unsafe byte "0xa" in header "value\x0Afoo:bar\x0Dbar:foo"
2006+
unsafe byte "0xa" in header value "value\x0Afoo:bar\x0Dbar:foo"
20072007
failed to set header
20082008
20092009
@@ -2024,7 +2024,7 @@ header:
20242024
foo:
20252025
bar:
20262026
--- error_log
2027-
unsafe byte "0xd" in header "header: value\x0Dfoo:bar\x0Abar:foo"
2027+
unsafe byte "0xd" in header name "header: value\x0Dfoo:bar\x0Abar:foo"
20282028
failed to set header
20292029
20302030
@@ -2045,7 +2045,7 @@ header:
20452045
foo:
20462046
bar:
20472047
--- error_log
2048-
unsafe byte "0xa" in header "header: value\x0Afoo:bar\x0Dbar:foo"
2048+
unsafe byte "0xa" in header name "header: value\x0Afoo:bar\x0Dbar:foo"
20492049
failed to set header
20502050
20512051
@@ -2066,7 +2066,7 @@ header:
20662066
foo:
20672067
bar:
20682068
--- error_log
2069-
unsafe byte "0xd" in header "\x0Dheader: value\x0Dfoo:bar\x0Abar:foo"
2069+
unsafe byte "0xd" in header name "\x0Dheader: value\x0Dfoo:bar\x0Abar:foo"
20702070
failed to set header
20712071
20722072
@@ -2087,7 +2087,7 @@ header:
20872087
foo:
20882088
bar:
20892089
--- error_log
2090-
unsafe byte "0xa" in header "\x0Aheader: value\x0Afoo:bar\x0Dbar:foo"
2090+
unsafe byte "0xa" in header name "\x0Aheader: value\x0Afoo:bar\x0Dbar:foo"
20912091
failed to set header
20922092
20932093
@@ -2111,5 +2111,5 @@ foo:
21112111
xx:
21122112
xxx:
21132113
--- error_log
2114-
unsafe byte "0xa" in header "foo\x0Axx:bar"
2114+
unsafe byte "0xa" in header value "foo\x0Axx:bar"
21152115
failed to set header

‎t/022-redirect.t

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -339,8 +339,8 @@ Location:
339339
foo:
340340
bar:
341341
--- error_log
342-
unsafe byte "0xd" in header "http://agentzh.org/foo\x0Dfoo:bar\x0Abar:foo"
343-
attempt to use unsafe uri
342+
unsafe byte "0xd" in redirect uri "http://agentzh.org/foo\x0Dfoo:bar\x0Abar:foo"
343+
attempt to set unsafe redirect uri
344344

345345

346346

@@ -360,8 +360,8 @@ Location:
360360
foo:
361361
bar:
362362
--- error_log
363-
unsafe byte "0xa" in header "http://agentzh.org/foo\x0Afoo:bar\x0Dbar:foo"
364-
attempt to use unsafe uri
363+
unsafe byte "0xa" in redirect uri "http://agentzh.org/foo\x0Afoo:bar\x0Dbar:foo"
364+
attempt to set unsafe redirect uri
365365

366366

367367

@@ -380,8 +380,8 @@ GET /t
380380
Location:
381381
foo:
382382
--- error_log
383-
unsafe byte "0xa" in header "\x0Afoo:http://agentzh.org/foo"
384-
attempt to use unsafe uri
383+
unsafe byte "0xa" in redirect uri "\x0Afoo:http://agentzh.org/foo"
384+
attempt to set unsafe redirect uri
385385

386386

387387

@@ -400,8 +400,8 @@ GET /t
400400
Location:
401401
foo:
402402
--- error_log
403-
unsafe byte "0xd" in header "\x0Dfoo:http://agentzh.org/foo"
404-
attempt to use unsafe uri
403+
unsafe byte "0xd" in redirect uri "\x0Dfoo:http://agentzh.org/foo"
404+
attempt to set unsafe redirect uri
405405

406406

407407

@@ -420,5 +420,5 @@ GET /t
420420
Location:
421421
foo:
422422
--- error_log
423-
unsafe byte "0xd" in header "\x0Dhttp\x5C://\x22agentzh.org\x22/foo"
424-
attempt to use unsafe uri
423+
unsafe byte "0xd" in redirect uri "\x0Dhttp\x5C://\x22agentzh.org\x22/foo"
424+
attempt to set unsafe redirect uri

‎t/028-req-header.t

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -2046,7 +2046,7 @@ new
20462046
GET /req-header
20472047
--- error_code: 500
20482048
--- error_log
2049-
unsafe byte "0xd" in header "Foo\x0Dfoo"
2049+
unsafe byte "0xd" in header name "Foo\x0Dfoo"
20502050
failed to set header
20512051
20522052
@@ -2064,7 +2064,7 @@ failed to set header
20642064
GET /req-header
20652065
--- error_code: 500
20662066
--- error_log
2067-
unsafe byte "0xa" in header "new\x0Avalue"
2067+
unsafe byte "0xa" in header value "new\x0Avalue"
20682068
failed to set header
20692069
20702070
@@ -2084,7 +2084,7 @@ failed to set header
20842084
GET /req-header
20852085
--- error_code: 500
20862086
--- error_log
2087-
unsafe byte "0xa" in header "new\x0Avalue"
2087+
unsafe byte "0xa" in header value "new\x0Avalue"
20882088
failed to set header
20892089
20902090
@@ -2104,5 +2104,5 @@ failed to set header
21042104
GET /req-header
21052105
--- error_code: 500
21062106
--- error_log
2107-
unsafe byte "0xa" in header "\x22new\x0Avalue\x5C\x22"
2107+
unsafe byte "0xa" in header value "\x22new\x0Avalue\x5C\x22"
21082108
failed to set header

‎t/030-uri-args.t

Lines changed: 33 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ log_level('warn');
99
repeat_each(2);
1010
#repeat_each(1);
1111

12-
plan tests => repeat_each() * (blocks() * 2 + 20);
12+
plan tests => repeat_each() * (blocks() * 2 + 21);
1313

1414
no_root_location();
1515

@@ -1571,15 +1571,15 @@ args: foo=%2C%24%40%7C%60&bar=-_.!~*'()
15711571
--- error_code: 500
15721572
--- error_log
15731573
unsafe byte "0x9" in uri "/foo\x09bar"
1574-
attempt to use unsafe uri
1574+
attempt to set unsafe uri
15751575

15761576

15771577

1578-
=== TEST 59: set_uri with unsafe uri (with ' ')
1578+
=== TEST 59: set_uri with unsafe uri (with '\0')
15791579
--- config
15801580
location /t {
15811581
content_by_lua_block {
1582-
local new_uri = "/foo bar"
1582+
local new_uri = '\0foo'
15831583
ngx.req.set_uri(new_uri)
15841584
ngx.say(ngx.var.uri)
15851585
}
@@ -1588,5 +1588,32 @@ attempt to use unsafe uri
15881588
GET /t
15891589
--- error_code: 500
15901590
--- error_log
1591-
unsafe byte "0x20" in uri "/foo bar"
1592-
attempt to use unsafe uri
1591+
unsafe byte "0x0" in uri "\x00foo"
1592+
attempt to set unsafe uri
1593+
1594+
1595+
1596+
=== TEST 60: set_uri with safe uri (with ' ')
1597+
--- config
1598+
location /t {
1599+
rewrite_by_lua_block {
1600+
local new_uri = "/foo bar"
1601+
ngx.req.set_uri(new_uri)
1602+
}
1603+
1604+
proxy_pass http://127.0.0.1:$TEST_NGINX_SERVER_PORT;
1605+
}
1606+
1607+
location /foo {
1608+
content_by_lua_block {
1609+
ngx.say("request_uri: ", ngx.var.request_uri)
1610+
ngx.say("uri: ", ngx.var.uri)
1611+
}
1612+
}
1613+
--- request
1614+
GET /t
1615+
--- response_body
1616+
request_uri: /foo%20bar
1617+
uri: /foo bar
1618+
--- no_error_log
1619+
[error]

‎t/113-req-header-cookie.t

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -265,7 +265,7 @@ Cookie: boo=123; foo=bar
265265
GET /t
266266
--- error_code: 500
267267
--- error_log
268-
unsafe byte "0xa" in header "boo=123\x0Afoo"
268+
unsafe byte "0xa" in header value "boo=123\x0Afoo"
269269
failed to set header
270270
--- no_error_log
271271
[crit]

0 commit comments

Comments
 (0)