bugcgicc - Bugs: bug #32742, Malformed name/value pairs not...

 
 

bug #32742: Malformed name/value pairs not handled nicely in Cgicc.cpp

Submitter:  None
Submitted:  Thu 10 Mar 2011 08:19:07 PM UTC
   
 
Category:  None Severity:  3 - Normal
Item Group:  None Status:  None
Privacy:  Public Assigned to:  None
Open/Closed:  Closed
* Mandatory Fields

Add a New Comment Rich Markup
   

Thu 10 Mar 2011 08:19:07 PM UTC, original submission:  

In the event, that someone sends a malformed name/value pair, Cgicc (IMHO) is not handling it nicely. This was introduced in 3.2.4 following the optimization of cgicc::Cgicc::parseFormInput().

If the NV pairs are perfect, there is no problem. In the event that someone does '?a=b&&c=d', parseFormInput generates ...

name = 'a', value = 'b'
name = '&c', value = 'd'

The supplied patch "fixes" this, as '&' is always supposed to be a sub delimiter, and reproduces the behavior as originally coded, and as seen in CGI.pm. The extra '&' gets dropped in this case, and the name becomes 'c'

After applying my patch, the name/value pairs in the following string ...

"&begin=1&normal=ok&&doubleamp=1&empty=&ampempty&two=2&&&&&last==ok"

Results in ...

[begin] [1]
[normal] [ok]
[doubleamp] [1]
[empty] []
[ampempty] []
[two] [2]
[last] [=ok]

This mimics CGI.pm which is the "outside" test I used as a common point of reference.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach Files:
   
   
Comment:
   

Attached Files
file #27260:  patch-Cgicc added by None (383B - application/octet-stream - The patch used double quotes, but the code uses single in another location (because developers don't compile with -Werror). The attached patch may be useful...)
file #22890:  HandleMalformedNVsNicer.diff added by None (1KiB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

There are 0 votes so far. Votes easily highlight which items people would like to see resolved in priority, independently of the priority of the item set by tracker managers.

Only logged-in users can vote.

 

Follow 3 latest changes.

Date Changed by Updated Field Previous Value => Replaced by
2013-01-14 None Attached File- Added patch-Cgicc, #27260
2013-01-12 sebdiaz Open/ClosedOpen Closed
2011-03-10 None Attached File- Added HandleMalformedNVsNicer.diff, #22890

Back to the top

Powered by Savane 3.13-f8d8.
Corresponding source code