https://bz.apache.org/bugzilla/show_bug.cgi?id=70204
Bug ID: 70204
Summary: Make sensitive ap_expr file functions deny-by-default
for new callers
Product: Apache httpd-2
Version: 2.5-HEAD
Hardware: All
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Core
Assignee: [email protected]
Reporter: [email protected]
Target Milestone: ---
Created attachment 40213
--> https://bz.apache.org/bugzilla/attachment.cgi?id=40213&action=edit
Secure-by-default ap_expr file functions: deny file()/filesize()/filemod()
unless the caller opts in with ALLOW_FILE_FUNC; server-scope configs unchanged.
Trunk 8be3ef87, 5 files, +50/-3.
ap_expr_parse() hands every caller the file() capability unless that caller
remembers to restrict it. This patch flips the default: filesystem functions
are denied unless the caller explicitly opts in.
The same failure mode already cost two rounds of fixes -- hand-rolled
per-caller checks, then a central flag for _cmd callers in r1935016 -- yet raw
ap_expr_parse() callers stayed outside any gate. I verified on current trunk
(8be3ef87) that .htaccess "SSLRequire filesize(...)" still evaluates (HTTP
200). A future caller using the obvious unrestricted flags = 0 path could
therefore silently inherit file access as the httpd user.
What changed (5 files, +50/-3):
ap_expr_parse() applies RESTRICTED_FILE_FUNC by default; new ALLOW_FILE_FUNC
bit opts back in
ap_expr_parse_cmd_mi() opts in automatically for server-scope config only
(.htaccess stays restricted)
SSLRequire gets the same scope rule -- it is .htaccess-reachable
Lua r intentionally takes the restricted default; docs updated
Testing: fresh checkout, patch, full build, plus pristine-vs-patched A/B.
10-assertion matrix, 10/10 PASS (forgetful caller allowed to denied, Lua
allowed to denied, server-scope uses identical, .htaccess behavior identical).
SSLRequire: server scope 200 -> 200; .htaccess 200 -> 500 with "filesize not
available in restricted context".
Compatibility: intended behavior changes are limited to Lua r file functions,
.htaccess SSLRequire file functions, and future callers. Third-party raw
callers that genuinely need file() can add the one-line opt-in. No API/ABI
break.
Patch attached for review.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
