Commit ea265396 authored by Mark J. Cox's avatar Mark J. Cox
Browse files

Fix moderate security issue CVE-2005-3352 mod_imap cross-site scripting flaw 

Submitted by: Mark Cox <mjc apache.org>
Reviewed by: jorton, mjc, fielding
PR: 37874



git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.0.x@356279 13f79535-47bb-0310-9956-ffa450edef68
parent 6e18f04e

CHANGES

+6 −0
Changes for CHANGES: 6 added lines, 0 removed lines.
Original line number Diff line number Diff line 
                                                         -*- coding: utf-8 -*-

Changes with Apache 2.0.56









  *) SECURITY: CVE-2005-3352 (cve.mitre.org)









     mod_imap: Escape untrusted referer header before outputting in HTML









     to avoid potential cross-site scripting.  Change also made to









     ap_escape_html so we escape quotes.  Reported by JPCERT.









     [Mark Cox]

















  *) mod_cgi(d): Remove block on OPTIONS method so that scripts can









     respond to OPTIONS directly rather than via server default.









     [Roy Fielding] PR 15242


































modules/mappers/mod_imap.c



+1
−1



























Changes for modules/mappers/mod_imap.c: 1 added line, 1 removed line.



Original line number
Diff line number
Diff line







@@ -342,7 +342,7 @@ static char *imap_url(request_rec *r, const char *base, const char *value)







    if (!strcasecmp(value, "referer")) {









        referer = apr_table_get(r->headers_in, "Referer");









        if (referer && *referer) {









	    return apr_pstrdup(r->pool, referer);









	    return ap_escape_html(r->pool, referer);









        }









        else {









	    /* XXX:  This used to do *value = '\0'; ... which is totally bogus


































server/util.c



+6
−0



























Changes for server/util.c: 6 added lines, 0 removed lines.



Original line number
Diff line number
Diff line







@@ -1762,6 +1762,8 @@ AP_DECLARE(char *) ap_escape_html(apr_pool_t *p, const char *s)







            j += 3;









        else if (s[i] == '&')









            j += 4;









        else if (s[i] == '"')









            j += 5;



















    if (j == 0)









        return apr_pstrmemdup(p, s, i);










@@ -1780,6 +1782,10 @@ AP_DECLARE(char *) ap_escape_html(apr_pool_t *p, const char *s)







            memcpy(&x[j], "&amp;", 5);









            j += 4;









        }









        else if (s[i] == '"') {









            memcpy(&x[j], "&quot;", 6);









            j += 5;









        }









        else









            x[j] = s[i];