Commit a34a19e4 authored by Joe Orton's avatar Joe Orton
Browse files

Bring forward the fix for CVE-2005-3352 already on the branches: 

* modules/mappers/mod_imagemap.c (imap_url): Escape the referer.

* server/util.c (ap_escape_html): Escape the " character.

Submitted by: mjc
Reviewed by: fielding, jorton


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@357161 13f79535-47bb-0310-9956-ffa450edef68
parent 5b06674e

modules/mappers/mod_imagemap.c

+1 −1
Original line number Diff line number Diff line
@@ -342,7 +342,7 @@ static char *imap_url(request_rec *r, const char *base, const char *value) 
    if (!strcasecmp(value, "referer")) {

        referer = apr_table_get(r->headers_in, "Referer");

        if (referer && *referer) {

            return apr_pstrdup(r->pool, referer);

            return ap_escape_html(r->pool, referer);

        }

        else {

            /* XXX:  This used to do *value = '\0'; ... which is totally bogus

server/util.c

+6 −0
Original line number Diff line number Diff line
@@ -1748,6 +1748,8 @@ AP_DECLARE(char *) ap_escape_html(apr_pool_t *p, const char *s) 
            j += 3;

        else if (s[i] == '&')

            j += 4;

        else if (s[i] == '"')

            j += 5;



    if (j == 0)

        return apr_pstrmemdup(p, s, i);
@@ -1766,6 +1768,10 @@ AP_DECLARE(char *) ap_escape_html(apr_pool_t *p, const char *s) 
            memcpy(&x[j], "&", 5);

            j += 4;

        }

        else if (s[i] == '"') {

            memcpy(&x[j], """, 6);

            j += 5;

        }

        else

            x[j] = s[i];