On Thu, Jun 07, 2012 at 01:23:29PM -0400, Eric Covener wrote:
> e.g. RewriteOptions +"I know I'm running this regex against something
> that's not guaranteed to look like a URL-path, and I'll write a regex
> that carefully matches/captures the input"
How about this? I'm not sure how to put the right level of fear into
the name. AllowUnsafeURI? AllowInsecureURIMatch?
(This patch works for the CONNECT rewriting case, I haven't tested the
other problematic cases.)
Index: modules/mappers/mod_rewrite.c
===================================================================
--- modules/mappers/mod_rewrite.c (revision 1347667)
+++ modules/mappers/mod_rewrite.c (working copy)
@@ -190,6 +190,7 @@
#define OPTION_INHERIT 1<<1
#define OPTION_INHERIT_BEFORE 1<<2
#define OPTION_NOSLASH 1<<3
+#define OPTION_ANYURI 1<<4
#ifndef RAND_MAX
#define RAND_MAX 32767
@@ -2895,6 +2896,9 @@
"LimitInternalRecursion directive and will be "
"ignored.");
}
+ else if (!strcasecmp(w, "allowanyuri")) {
+ options |= OPTION_ANYURI;
+ }
else {
return apr_pstrcat(cmd->pool, "RewriteOptions: unknown option '",
w, "'", NULL);
@@ -4443,8 +4447,14 @@
return DECLINED;
}
- if ((r->unparsed_uri[0] == '*' && r->unparsed_uri[1] == '\0')
- || !r->uri || r->uri[0] != '/') {
+ /* Unless the anyuri option is set, ensure that the input to the
+ * first rule really is a URL-path, avoiding security issues with
+ * poorly configured rules. See CVE-2011-3368, CVE-2011-4317. */
+ if ((dconf->options & OPTION_ANYURI) == 0
+ && ((r->unparsed_uri[0] == '*' && r->unparsed_uri[1] == '\0')
+ || !r->uri || r->uri[0] != '/')) {
+ rewritelog((r, 8, NULL, "Declining, request-URI '%s' is not a
URL-path",
+ r->uri));
return DECLINED;
}
Index: docs/manual/mod/mod_rewrite.xml
===================================================================
--- docs/manual/mod/mod_rewrite.xml (revision 1347667)
+++ docs/manual/mod/mod_rewrite.xml (working copy)
@@ -188,6 +188,37 @@
later.</p>
</dd>
+ <dt><code>AllowAnyURI</code></dt>
+ <dd>
+
+ <p>When <directive module="mod_rewrite">RewriteRule</directive>
+ is used in <code>VirtualHost</code> or server context with
+ version 2.2.22 or later of httpd, <module>mod_rewrite</module>
+ will only process the rewrite rules if the request URI is a <a
+ href="./directive-dict.html#Syntax">URL-path</a>. This avoids
+ some security issues where particular rules could allow
+ "surprising" pattern expansions (see <a
+
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-3368";>CVE-2011-3368</a>
+ and <a
+
href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4317";>CVE-2011-4317</a>).
+ To lift the restriction on matching a URL-path, the
+ <code>AllowAnyURI</code> option can be enabled, and
+ <module>mod_rewrite</module> will apply the rule set to any
+ request URI string, regardless of whether that string matches
+ the URL-path grammar required by the HTTP specification.</p>
+
+ <note type="warning">
+ <title>Security Warning</title>
+
+ <p>Enabling this option will make the server vulnerable to
+ security issues if used with rewrite rules which are not
+ carefully authored. It is <strong>strongly recommended</strong>
+ that this option is not used. In particularly, beware of input
+ strings containing the '<code>@</code>' character which could
+ change the interpretation of the transformed URI.</p>
+ </note>
+ </dd>
+
</dl>
</usage>
