bugcgicc - Bugs: bug #32742, Malformed name/value pairs not...


bug #32742: Malformed name/value pairs not handled nicely in Cgicc.cpp

Submitted by:  None
Submitted on:  Thu 10 Mar 2011 08:19:07 PM UTC  
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment(Rich Markup)

You are not logged in

Please log in, so followups can be emailed to you.


Thu 10 Mar 2011 08:19:07 PM UTC, original submission:

In the event, that someone sends a malformed name/value pair, Cgicc (IMHO) is not handling it nicely. This was introduced in 3.2.4 following the optimization of cgicc::Cgicc::parseFormInput().

If the NV pairs are perfect, there is no problem. In the event that someone does '?a=b&&c=d', parseFormInput generates ...

name = 'a', value = 'b'
name = '&c', value = 'd'

The supplied patch "fixes" this, as '&' is always supposed to be a sub delimiter, and reproduces the behavior as originally coded, and as seen in CGI.pm. The extra '&' gets dropped in this case, and the name becomes 'c'

After applying my patch, the name/value pairs in the following string ...


Results in ...

[begin] [1]
[normal] [ok]
[doubleamp] [1]
[empty] []
[ampempty] []
[two] [2]
[last] [=ok]

This mimics CGI.pm which is the "outside" test I used as a common point of reference.



(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):

Attached Files
file #27260:  patch-Cgicc added by None (383B - application/octet-stream - The patch used double quotes, but the code uses single in another location (because developers don't compile with -Werror). The attached patch may be useful...)
file #22890:  HandleMalformedNVsNicer.diff added by None (1KiB - text/plain)


Depends on the following items: None found

Items that depend on this one: None found


CC list is empty


Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.


Please enter the title of George Orwell's famous dystopian book (it's a date):



Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Mon 14 Jan 2013 06:01:06 PM UTCNoneAttached File-=>Added patch-Cgicc, #27260
Sat 12 Jan 2013 09:51:03 AM UTCsebdiazOpen/ClosedOpen=>Closed
Thu 10 Mar 2011 08:19:07 PM UTCNoneAttached File-=>Added HandleMalformedNVsNicer.diff, #22890

Back to the top

Powered by Savane 3.1-cleanup1