ea7d310ad
Denys Vlasenko
2026-01-24
Subject
httpd: allow static files in /cgi-bin/, do not search for interpreter twice
Binary
No binary (build failed)
Architecture & Compiler Flags
gcc -Wp,-MD,applets/.usage.d -Wall -Wstrict-prototypes -O2 -fomit-frame-pointer -Iinclude -Iinclude -o applets/usage applets/usage.c
Build Log
(log yok)
Commit Diff GitHub →
networking/httpd.c+25 -24
| @@ -1773,21 +1773,11 @@ static void send_cgi_and_exit( | |
| argv[1] = NULL; | |
| # if ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR | |
| - | { |
| - | char *suffix = strrchr(script, '.'); |
| - | |
| - | if (suffix) { |
| - | Htaccess *cur; |
| - | for (cur = script_i; cur; cur = cur->next) { |
| - | if (strcmp(cur->before_colon + 1, suffix) == 0) { |
| - | /* found interpreter name */ |
| - | argv[0] = cur->after_colon; |
| - | argv[1] = script; |
| - | argv[2] = NULL; |
| - | break; |
| - | } |
| - | } |
| - | } |
| + | if (script_i != NULL) { |
| + | /* found interpreter name */ |
| + | argv[0] = script_i->after_colon; |
| + | argv[1] = script; |
| + | argv[2] = NULL; |
| } | |
| # endif | |
| if (VERBOSE_2) | |
| @@ -2550,13 +2540,22 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr) | |
| #if ENABLE_FEATURE_HTTPD_CGI | |
| if (is_prefixed_with(tptr, "cgi-bin/")) { | |
| - | if (tptr[8] == '\0') { |
| - | /* protect listing "cgi-bin/" */ |
| - | send_headers_and_exit(HTTP_FORBIDDEN); |
| - | } |
| + | script_i = NULL; /* no interpreter */ |
| cgi_type = CGI_NORMAL; | |
| - | } /* why "else": do not check "cgi-bin/SCRIPT/something" for cases below: */ |
| - | else |
| + | if (stat(tptr, &sb) == 0) { |
| + | /* disallow anything but ordinary files in cgi-bin/ */ |
| + | if (!S_ISREG(sb.st_mode)) |
| + | send_headers_and_exit(HTTP_FORBIDDEN); |
| + | /* If non-executable, send it as a file: |
| + | * apache compat: not every /cgi-bin/XYZ must be a script, |
| + | * _can_ be just a data file */ |
| + | if (!(sb.st_mode & (S_IXUSR | S_IXGRP | S_IXOTH))) { |
| + | cgi_type = CGI_NONE; |
| + | goto exists; |
| + | } /* else: CGI_NORMAL, will attempt executing */ |
| + | } /* else: CGI_NORMAL, will attempt executing */ |
| + | } |
| + | else /* why "else": do not check "cgi-bin/SCRIPT/something" for cases below: */ |
| #endif | |
| { | |
| if (urlp[-1] == '/') { | |
| @@ -2578,15 +2577,17 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr) | |
| #if ENABLE_FEATURE_HTTPD_CONFIG_WITH_SCRIPT_INTERPR | |
| char *suffix = strrchr(tptr, '.'); | |
| if (suffix) { | |
| - | Htaccess *cur; |
| - | for (cur = script_i; cur; cur = cur->next) { |
| - | if (strcmp(cur->before_colon + 1, suffix) == 0) { |
| + | for (; script_i; script_i = script_i->next) { |
| + | if (strcmp(script_i->before_colon + 1, suffix) == 0) { |
| cgi_type = CGI_INTERPRETER; | |
| break; | |
| } | |
| } | |
| + | } else { |
| + | script_i = NULL; |
| } | |
| #endif | |
| + | exists: |
| file_size = sb.st_size; | |
| last_mod = sb.st_mtime; | |
| } | |