NetBSD Problem Report #58713

From www@netbsd.org  Wed Oct  2 13:59:07 2024
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits)
	 client-signature RSA-PSS (2048 bits))
	(Client CN "mail.NetBSD.org", Issuer "mail.NetBSD.org CA" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id BC27B1A923B
	for <gnats-bugs@gnats.NetBSD.org>; Wed,  2 Oct 2024 13:59:06 +0000 (UTC)
Message-Id: <20241002135905.AEB101A923D@mollari.NetBSD.org>
Date: Wed,  2 Oct 2024 13:59:05 +0000 (UTC)
From: nia@pkgsrc.org
Reply-To: nia@pkgsrc.org
To: gnats-bugs@NetBSD.org
Subject: httpd: CGIs have wrong cwd
X-Send-Pr-Version: www-1.0

>Number:         58713
>Category:       bin
>Synopsis:       httpd: CGIs have wrong cwd
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    mrg
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Wed Oct 02 14:00:05 +0000 2024
>Last-Modified:  Sun Oct 06 11:55:01 +0000 2024
>Originator:     nia
>Release:        NetBSD 10.0_STABLE
>Organization:
The NetBSD Foundation, Inc
>Environment:
>Description:
When running CGIs, I use relative paths inside the scripts to load my
Lua dependencies. In thttpd, this works fine. In bozo, it fails.

According to RFC 3875:
The current working directory for the script SHOULD be set to the
directory containing the script.
>How-To-Repeat:

>Fix:

>Release-Note:

>Audit-Trail:

Responsible-Changed-From-To: bin-bug-people->mrg
Responsible-Changed-By: riastradh@NetBSD.org
Responsible-Changed-When: Wed, 02 Oct 2024 14:03:18 +0000
Responsible-Changed-Why:
over to bozo maintainer (not that I'm calling mrg a bozo, though)


From: Sunil Nimmagadda <sunil@nimmagadda.net>
To: nia@pkgsrc.org
Cc: gnats-admin@netbsd.org, netbsd-bugs@netbsd.org,  gnats-bugs@netbsd.org
Subject: Re: bin/58713: httpd: CGIs have wrong cwd
Date: Sun, 06 Oct 2024 17:19:55 +0530

 nia@pkgsrc.org writes:

 >>Number:         58713
 >>Category:       bin
 >>Synopsis:       httpd: CGIs have wrong cwd
 >>Confidential:   no
 >>Severity:       serious
 >>Priority:       medium
 >>Responsible:    bin-bug-people
 >>State:          open
 >>Class:          sw-bug
 >>Submitter-Id:   net
 >>Arrival-Date:   Wed Oct 02 14:00:05 +0000 2024
 >>Originator:     nia
 >>Release:        NetBSD 10.0_STABLE
 >>Organization:
 > The NetBSD Foundation, Inc
 >>Environment:
 >>Description:
 > When running CGIs, I use relative paths inside the scripts to load my
 > Lua dependencies. In thttpd, this works fine. In bozo, it fails.
 >
 > According to RFC 3875:
 > The current working directory for the script SHOULD be set to the
 > directory containing the script.
 >>How-To-Repeat:
 >
 >>Fix:

 This diff changes the working directory of the cgi process to the user
 specified cgi-bin.

 diff --git a/libexec/httpd/cgi-bozo.c b/libexec/httpd/cgi-bozo.c
 index b04c89979351..b2cf1308f63e 100644
 --- a/libexec/httpd/cgi-bozo.c
 +++ b/libexec/httpd/cgi-bozo.c
 @@ -608,6 +608,9 @@ bozo_process_cgi(bozo_httpreq_t *request)
  		closelog();
  		bozo_daemon_closefds(httpd);

 +		if (httpd->cgibin && chdir(httpd->cgibin) == -1)
 +			bozoerr(httpd, 1, "failed to chdir(2)");
 +
  		if (-1 == execve(path, argv, envp)) {
  			int saveerrno = errno;
  			bozo_http_error(httpd, 404, request,

>Unformatted:

Home	PR Database Search