NetBSD Problem Report #58713
From www@netbsd.org Wed Oct 2 13:59:07 2024
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
key-exchange X25519 server-signature RSA-PSS (2048 bits)
client-signature RSA-PSS (2048 bits))
(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
by mollari.NetBSD.org (Postfix) with ESMTPS id BC27B1A923B
for <gnats-bugs@gnats.NetBSD.org>; Wed, 2 Oct 2024 13:59:06 +0000 (UTC)
Message-Id: <20241002135905.AEB101A923D@mollari.NetBSD.org>
Date: Wed, 2 Oct 2024 13:59:05 +0000 (UTC)
From: nia@pkgsrc.org
Reply-To: nia@pkgsrc.org
To: gnats-bugs@NetBSD.org
Subject: httpd: CGIs have wrong cwd
X-Send-Pr-Version: www-1.0
>Number: 58713
>Category: bin
>Synopsis: httpd: CGIs have wrong cwd
>Confidential: no
>Severity: serious
>Priority: medium
>Responsible: mrg
>State: open
>Class: sw-bug
>Submitter-Id: net
>Arrival-Date: Wed Oct 02 14:00:05 +0000 2024
>Last-Modified: Wed Oct 07 14:40:01 +0000 2026
>Originator: nia
>Release: NetBSD 10.0_STABLE
>Organization:
The NetBSD Foundation, Inc
>Environment:
>Description:
When running CGIs, I use relative paths inside the scripts to load my
Lua dependencies. In thttpd, this works fine. In bozo, it fails.
According to RFC 3875:
The current working directory for the script SHOULD be set to the
directory containing the script.
>How-To-Repeat:
>Fix:
>Release-Note:
>Audit-Trail:
Responsible-Changed-From-To: bin-bug-people->mrg
Responsible-Changed-By: riastradh@NetBSD.org
Responsible-Changed-When: Wed, 02 Oct 2024 14:03:18 +0000
Responsible-Changed-Why:
over to bozo maintainer (not that I'm calling mrg a bozo, though)
From: Sunil Nimmagadda <sunil@nimmagadda.net>
To: nia@pkgsrc.org
Cc: gnats-admin@netbsd.org, netbsd-bugs@netbsd.org, gnats-bugs@netbsd.org
Subject: Re: bin/58713: httpd: CGIs have wrong cwd
Date: Sun, 06 Oct 2024 17:19:55 +0530
nia@pkgsrc.org writes:
>>Number: 58713
>>Category: bin
>>Synopsis: httpd: CGIs have wrong cwd
>>Confidential: no
>>Severity: serious
>>Priority: medium
>>Responsible: bin-bug-people
>>State: open
>>Class: sw-bug
>>Submitter-Id: net
>>Arrival-Date: Wed Oct 02 14:00:05 +0000 2024
>>Originator: nia
>>Release: NetBSD 10.0_STABLE
>>Organization:
> The NetBSD Foundation, Inc
>>Environment:
>>Description:
> When running CGIs, I use relative paths inside the scripts to load my
> Lua dependencies. In thttpd, this works fine. In bozo, it fails.
>
> According to RFC 3875:
> The current working directory for the script SHOULD be set to the
> directory containing the script.
>>How-To-Repeat:
>
>>Fix:
This diff changes the working directory of the cgi process to the user
specified cgi-bin.
diff --git a/libexec/httpd/cgi-bozo.c b/libexec/httpd/cgi-bozo.c
index b04c89979351..b2cf1308f63e 100644
--- a/libexec/httpd/cgi-bozo.c
+++ b/libexec/httpd/cgi-bozo.c
@@ -608,6 +608,9 @@ bozo_process_cgi(bozo_httpreq_t *request)
closelog();
bozo_daemon_closefds(httpd);
+ if (httpd->cgibin && chdir(httpd->cgibin) == -1)
+ bozoerr(httpd, 1, "failed to chdir(2)");
+
if (-1 == execve(path, argv, envp)) {
int saveerrno = errno;
bozo_http_error(httpd, 404, request,
From: nia <nia@NetBSD.org>
To: gnats-bugs@NetBSD.org
Cc:
Subject: Re: bin/58713: httpd: CGIs have wrong cwd
Date: Tue, 6 Oct 2026 23:36:59 +0000
--gFozmR4EQ2aGyEcT
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
This patch is not enough for my use case, you also need to set the PWD
environment variable, e.g.
--gFozmR4EQ2aGyEcT
Content-Type: text/x-diff; charset=us-ascii
Content-Disposition: attachment; filename=cgi-bozo.patch
Index: cgi-bozo.c
===================================================================
RCS file: /cvsroot/src/libexec/httpd/cgi-bozo.c,v
retrieving revision 1.57
diff -u -r1.57 cgi-bozo.c
--- cgi-bozo.c 11 Jun 2026 05:44:11 -0000 1.57
+++ cgi-bozo.c 6 Oct 2026 23:35:52 -0000
@@ -493,6 +493,7 @@
(request->hr_remotehost && *request->hr_remotehost ? 1 : 0) +
(request->hr_remoteaddr && *request->hr_remoteaddr ? 1 : 0) +
(cgihandler ? 1 : 0) +
+ (httpd->cgibin ? 1 : 0) +
bozo_auth_cgi_count(request) +
(request->hr_serverport && *request->hr_serverport ? 1 : 0);
@@ -568,6 +569,12 @@
bozo_setenv(httpd, "REMOTE_ADDR", request->hr_remoteaddr,
curenvp++);
/*
+ * RFC3875 The current working directory for the script SHOULD
+ * be set to the directory containing the script.
+ */
+ if (httpd->cgibin)
+ bozo_setenv(httpd, "PWD", httpd->cgibin, curenvp++);
+ /*
* Apache does this when invoking content handlers, and PHP
* 5.3 requires it as a "security" measure.
*/
@@ -608,6 +615,9 @@
closelog();
bozo_daemon_closefds(httpd);
+ if (httpd->cgibin && chdir(httpd->cgibin) == -1)
+ bozoerr(httpd, 1, "failed to chdir(2)");
+
if (-1 == execve(path, argv, envp)) {
int saveerrno = errno;
bozo_http_error(httpd, 404, request,
Index: bozohttpd.8
===================================================================
RCS file: /cvsroot/src/libexec/httpd/bozohttpd.8,v
retrieving revision 1.102
diff -u -r1.102 bozohttpd.8
--- bozohttpd.8 8 May 2026 16:46:40 -0000 1.102
+++ bozohttpd.8 6 Oct 2026 23:35:52 -0000
@@ -26,7 +26,7 @@
.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
.\" SUCH DAMAGE.
.\"
-.Dd May 8, 2026
+.Dd October 7, 2026
.Dt BOZOHTTPD 8
.Os
.Sh NAME
@@ -110,16 +110,21 @@
should be any normal file suffix, and the
.Ar cgihandler
should be a full path to an interpreter.
-This option is the only way to enable CGI programs that exist
-outside of the cgibin directory to be executed.
+This option is the only way to enable CGI programs to be executed
+outside of the
+.Ql /cgi-bin
+prefix.
Multiple
.Fl C
options may be passed.
+.Pp
+Note that ordinary script interpreters that are not CGI-aware can not
+be used directly, see the examples below.
.It Fl c Ar cgibin
Enables the CGI/1.1 interface.
-The
.Ar cgibin
-directory is expected to contain the CGI programs to be used.
+is an absolute path to a file system directory expected to contain
+the CGI programs to be used.
.Nm
looks for URLs in the form of
.Ql /cgi-bin/ Ns Ar scriptname
--gFozmR4EQ2aGyEcT--
From: "Nia Alarie" <nia@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/58713 CVS commit: src/libexec/httpd
Date: Wed, 7 Oct 2026 07:46:51 +0000
Module Name: src
Committed By: nia
Date: Wed Oct 7 07:46:51 UTC 2026
Modified Files:
src/libexec/httpd: cgi-bozo.c
Log Message:
httpd(8): Per RFC 3875, set the PWD of child CGI processes to the
location of the script that is being run.
Right now this only works with the -c option (where previously PWD would
have been unset in the child), processes invoked with -C already got a
PWD, and the wrapper script can also handle setting it to something
sensible.
"looks good" mrg
PR bin/58713 httpd: CGIs have wrong cwd
To generate a diff of this commit:
cvs rdiff -u -r1.57 -r1.58 src/libexec/httpd/cgi-bozo.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
From: "Nia Alarie" <nia@netbsd.org>
To: gnats-bugs@gnats.NetBSD.org
Cc:
Subject: PR/58713 CVS commit: src/libexec/httpd
Date: Wed, 7 Oct 2026 14:39:30 +0000
Module Name: src
Committed By: nia
Date: Wed Oct 7 14:39:30 UTC 2026
Modified Files:
src/libexec/httpd: cgi-bozo.c
Log Message:
httpd(8): Don't set the PWD environment for CGIs, just the actual
working directory. This was based on a misunderstanding on my part.
PR bin/58713 httpd: CGIs have wrong cwd
To generate a diff of this commit:
cvs rdiff -u -r1.58 -r1.59 src/libexec/httpd/cgi-bozo.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
>Unformatted:
(Contact us)
$NetBSD: query-full-pr,v 1.51 2026/08/10 02:28:17 riastradh Exp $
$NetBSD: gnats_config.sh,v 1.10 2026/05/13 22:00:09 riastradh Exp $
Copyright © 1994-2026
The NetBSD Foundation, Inc. ALL RIGHTS RESERVED.
Home