bugcgicc - Bugs: bug #32742, Malformed name/value pairs not...

 
 

bug #32742: Malformed name/value pairs not handled nicely in Cgicc.cpp

Submitted by:  None
Submitted on:  Thu 10 Mar 2011 08:19:07 PM UTC  
 
Category: NoneSeverity: 3 - Normal
Item Group: NoneStatus: None
Privacy: PublicAssigned to: None
Open/Closed: Closed

Add a New Comment (Rich MarkupRich Markup):
   

You are not logged in

Please log in, so followups can be emailed to you.

 

Thu 10 Mar 2011 08:19:07 PM UTC, original submission:

In the event, that someone sends a malformed name/value pair, Cgicc (IMHO) is not handling it nicely. This was introduced in 3.2.4 following the optimization of cgicc::Cgicc::parseFormInput().

If the NV pairs are perfect, there is no problem. In the event that someone does '?a=b&&c=d', parseFormInput generates ...

name = 'a', value = 'b'
name = '&c', value = 'd'

The supplied patch "fixes" this, as '&' is always supposed to be a sub delimiter, and reproduces the behavior as originally coded, and as seen in CGI.pm. The extra '&' gets dropped in this case, and the name becomes 'c'

After applying my patch, the name/value pairs in the following string ...

"&begin=1&normal=ok&&doubleamp=1&empty=&ampempty&two=2&&&&&last==ok"

Results in ...

[begin] [1]
[normal] [ok]
[doubleamp] [1]
[empty] []
[ampempty] []
[two] [2]
[last] [=ok]

This mimics CGI.pm which is the "outside" test I used as a common point of reference.

Anonymous

 

(Note: upload size limit is set to 16384 kB, after insertion of the required escape characters.)

Attach File(s):
   
   
Comment:
   

Attached Files
file #27260:  patch-Cgicc added by None (383B - application/octet-stream - The patch used double quotes, but the code uses single in another location (because developers don't compile with -Werror). The attached patch may be useful...)
file #22890:  HandleMalformedNVsNicer.diff added by None (1kB - text/plain)

 

Depends on the following items: None found

Items that depend on this one: None found

 

CC list is empty

 

Do you think this task is very important?
If so, you can click here to add your encouragement to it.
This task has 0 encouragements so far.

Only logged-in users can vote.

 

Please enter the title of George Orwell's famous dystopian book (it's a date):

 

 

Follow 3 latest changes.

Date Changed By Updated Field Previous Value => Replaced By
Mon 14 Jan 2013 06:01:06 PM UTCNoneAttached File-=>Added patch-Cgicc, #27260
Sat 12 Jan 2013 09:51:03 AM UTCsebdiazOpen/ClosedOpen=>Closed
Thu 10 Mar 2011 08:19:07 PM UTCNoneAttached File-=>Added HandleMalformedNVsNicer.diff, #22890

Back to the top


Powered by Savane 3.1-cleanup