Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commitf86b24b

Browse files
asridharanYanshu Zhao
authored and
Yanshu Zhao
committed
Added support for RFC 5987 formatted HTTP headers. (microsoft#37)
* Added a helper function to decode RFC 5987 extended value representation in an HTTP header.* Added support for `filename*` attribute for `Content-Disposition` header in HTTP requests.* Updated .gitignore with a list of files to exclude.* Added error handling for badly formatted RFC 5987 HTTP headers.
1 parente1b821a commitf86b24b

File tree

4 files changed

+115
-11
lines changed

4 files changed

+115
-11
lines changed

‎.gitignore‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,7 @@
1-
*.obj
1+
.vscode
2+
*.swp
3+
*.stackdump
4+
*.obj
25
*.tlog
36
*.log
47
*.pdb

‎apache2/msc_multipart.c‎

Lines changed: 31 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -198,23 +198,44 @@ static int multipart_parse_content_disposition(modsec_rec *msr, char *c_d_value)
198198
log_escape_nq(msr->mp,value));
199199
}
200200
}
201-
else
202-
if (strcmp(name,"filename")==0){
201+
elseif ((strcmp(name,"filename")==0)|| (strcmp(name,"filename*")==0))
202+
{
203203

204-
validate_quotes(msr,value);
204+
char*decoded_filename=NULL;
205205

206-
msr->multipart_filename=apr_pstrdup(msr->mp,value);
206+
if (strcmp(name,"filename*")==0)
207+
{
208+
decoded_filename=rfc5987_decode(msr->mp,value);
209+
if (!decoded_filename)
210+
{
211+
msr_log(msr,4,"Multipart: Could not decode extended filename parameter in RFC 5987 format: %s",
212+
log_escape_nq(msr->mp,value));
213+
return-16;
214+
}
215+
msr->multipart_filename=decoded_filename;
216+
217+
// Make sure to turn of INVALID quoting since RFC 5987 expects quotes in the filename format.
218+
msr->mpd->flag_invalid_quoting=0;
219+
}
220+
else
221+
{
222+
decoded_filename=value;
223+
validate_quotes(msr,value);
224+
msr->multipart_filename=apr_pstrdup(msr->mp,decoded_filename);
225+
}
207226

208-
if (msr->mpd->mpp->filename!=NULL) {
227+
if (msr->mpd->mpp->filename!=NULL)
228+
{
209229
msr_log(msr,4,"Multipart: Warning: Duplicate Content-Disposition filename: %s",
210-
log_escape_nq(msr->mp,value));
230+
log_escape_nq(msr->mp,decoded_filename));
211231
return-15;
212232
}
213-
msr->mpd->mpp->filename=value;
233+
msr->mpd->mpp->filename=decoded_filename;
214234

215-
if (msr->txcfg->debuglog_level >=9) {
235+
if (msr->txcfg->debuglog_level >=9)
236+
{
216237
msr_log(msr,9,"Multipart: Content-Disposition filename: %s",
217-
log_escape_nq(msr->mp,value));
238+
log_escape_nq(msr->mp,decoded_filename));
218239
}
219240
}
220241
elsereturn-11;
@@ -307,7 +328,7 @@ static int multipart_process_part_header(modsec_rec *msr, char **error_msg) {
307328
* values from the C-D header. We need to check for the case where they
308329
* didn't understand C-D but we did.
309330
*/
310-
if (strstr(header_value,"filename=")==NULL) {
331+
if ((strstr(header_value,"filename=")==NULL)&& (strstr(header_value,"filename*=")==NULL)) {
311332
*error_msg=apr_psprintf(msr->mp,"Multipart: Invalid Content-Disposition header (filename).");
312333
return-1;
313334
}

‎apache2/msc_util.c‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1779,6 +1779,84 @@ int urldecode_nonstrict_inplace_ex(unsigned char *input, long int input_len, int
17791779
returncount;
17801780
}
17811781

1782+
// RFC 5987 allows HTTP values to be non-ASCII characters.
1783+
// As per RFC 5987 the value can be encoded as UTF-8 or ISO-8859-1. Since HTTP doesn't support non-ASCII characters,
1784+
// when using the extended value format specified by RFC 5987 the value is double encoded.
1785+
// The value is first encoded into an octet stream in the format specified in the extended format (UTF-8 or ISO-8859-1)
1786+
// and then the octet stream itself is encoded using URL encoding.
1787+
// RFC 5987 specifies the extended value format to be as follows:
1788+
// `value = <utf-8|iso-8859-1>'<language>'<URL encoded octect stream>.
1789+
// The function, takes in a RFC 5987 encoded value and decodes it to a UTF-8 encoded string (even if the RFC 5987 was encoded using ISO-8859-1).
1790+
char*rfc5987_decode(apr_pool_t*mptmp,char*value)
1791+
{
1792+
constcharutf8[]="utf-8";
1793+
constchariso88591[]="iso-8859-1";
1794+
constcharrfc5987Delimiter[]="'";
1795+
intlen=strlen(value);
1796+
char*urlEncodedValue=strstr(value,rfc5987Delimiter);
1797+
1798+
if (!urlEncodedValue)
1799+
{
1800+
returnNULL;
1801+
}
1802+
1803+
// Find the URL encoded string. 'URLEncodedValue' is already set to the first occurence of the quote, the format of the extended value as per RFC 5987 is
1804+
// `value = <utf-8|iso-8859-1>'<language>'<URL encoded octect stream>
1805+
if (strlen(urlEncodedValue)>0)
1806+
{
1807+
// Remove the leading single quotes.
1808+
urlEncodedValue++;
1809+
urlEncodedValue=strstr(urlEncodedValue,rfc5987Delimiter);
1810+
1811+
if (!urlEncodedValue)
1812+
{
1813+
returnNULL;
1814+
}
1815+
1816+
// Remove the terminating single quotes.
1817+
urlEncodedValue++;
1818+
}
1819+
1820+
// The decode that we perform will be in place, hence lets allocate a new buffer for URL encoded value that we are processing.
1821+
urlEncodedValue=apr_pstrdup(mptmp,urlEncodedValue);
1822+
1823+
if (strncmp(value,utf8,strlen(utf8))==0)
1824+
{
1825+
// The value is an extended value with UTF-8 encoding.
1826+
intinvalid_count;
1827+
intchanged;
1828+
if (urldecode_nonstrict_inplace_ex(urlEncodedValue,strlen(urlEncodedValue),&invalid_count,&changed)>0)
1829+
{
1830+
returnurlEncodedValue;
1831+
}
1832+
}
1833+
elseif (strncmp(value,iso88591,strlen(iso88591))==0)
1834+
{
1835+
// The value is an extended value with ISO-8859-1 encoding.
1836+
intinvalid_count;
1837+
intchanged;
1838+
intisoCount=0;
1839+
char*utf8EncodedValue=NULL;
1840+
intoutLen=0;
1841+
if ((isoCount=urldecode_nonstrict_inplace_ex(urlEncodedValue,strlen(urlEncodedValue),&invalid_count,&changed))>0)
1842+
{
1843+
// The URLdecoded string is in ISO-8859-1 format, convert it to UTF-8.
1844+
outLen=2*isoCount;
1845+
utf8EncodedValue=apr_palloc(mptmp,outLen);
1846+
1847+
if (isolat1ToUTF8(utf8EncodedValue,&outLen, (constunsignedchar*)urlEncodedValue,&isoCount)>0)
1848+
{
1849+
// We want a null-terminated UTF-8 string.
1850+
utf8EncodedValue[outLen+1]='\0';
1851+
returnutf8EncodedValue;
1852+
}
1853+
}
1854+
}
1855+
1856+
// Error
1857+
returnNULL;
1858+
}
1859+
17821860
/**
17831861
*
17841862
* IMP1 Assumes NUL-terminated

‎apache2/msc_util.h‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -126,6 +126,8 @@ int DSOLOCAL urldecode_uni_nonstrict_inplace_ex(unsigned char *input, long int i
126126

127127
intDSOLOCALurldecode_nonstrict_inplace_ex(unsignedchar*input,longintinput_length,int*invalid_count,int*changed);
128128

129+
char*DSOLOCALrfc5987_decode(apr_pool_t*mptmp,char*value);
130+
129131
intDSOLOCALhtml_entities_decode_inplace(apr_pool_t*mp,unsignedchar*input,intlen);
130132

131133
intDSOLOCALansi_c_sequences_decode_inplace(unsignedchar*input,intlen);

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp