Commit fa6b49d1 authored by Rainer Jung's avatar Rainer Jung
Browse files

mod_negotiation: Escape filenames in variant list 

to prevent an possible XSS for a site where untrusted
users can upload files to a location with MultiViews
enabled.

SECURITY: CVE-2012-2687 (cve.mitre.org):

Submitted by: Niels Heinen <heinenn google.com>

Reviewed by: trawick, wrowe
Backported by: rjung


git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/branches/2.2.x@1374421 13f79535-47bb-0310-9956-ffa450edef68
parent 768a27a9

CHANGES

+5 −0
Original line number Diff line number Diff line
@@ -5,6 +5,11 @@ Changes with Apache 2.2.23 
     envvars: Fix insecure handling of LD_LIBRARY_PATH that could lead to the

     current working directory to be searched for DSOs. [Stefan Fritsch]



  *) SECURITY: CVE-2012-2687 (cve.mitre.org)

     mod_negotiation: Escape filenames in variant list to prevent an

     possible XSS for a site where untrusted users can upload files to

     a location with MultiViews enabled. [Niels Heinen <heinenn google.com>]



  *) mod_proxy_ajp: Add support for 'ProxyErrorOverride on'. PR 50945.

     [Peter Pramberger <peter pramberger.at>, Jim Jagielski]

STATUS

+0 −9
Original line number Diff line number Diff line
@@ -93,15 +93,6 @@ RELEASE SHOWSTOPPERS: 
PATCHES ACCEPTED TO BACKPORT FROM TRUNK:

  [ start all new proposals below, under PATCHES PROPOSED. ]



   * mod_negotiation: Escape filenames in variant list to prevent an

     possible XSS for a site where untrusted users can upload files to a

     location with MultiViews enabled.

     SECURITY: CVE-2012-2687 (cve.mitre.org):

     Submitted by: Niels Heinen <heinenn google.com>

     trunk patch: http://svn.apache.org/viewvc?view=revision&revision=1349905

     2.4.x patch: http://svn.apache.org/viewvc?view=revision&revision=1356889

     2.2.x patch: trunk patch applies

     +1: rjung, trawick, wrowe



PATCHES PROPOSED TO BACKPORT FROM TRUNK:

  [ New proposals should be added at the end of the list ]

modules/mappers/mod_negotiation.c

+2 −2
Original line number Diff line number Diff line
@@ -2658,9 +2658,9 @@ static char *make_variant_list(request_rec *r, negotiation_state *neg) 
         * need to change the calculation of max_vlist_array above.

         */

        *((const char **) apr_array_push(arr)) = "<li><a href=\"";

        *((const char **) apr_array_push(arr)) = filename;

        *((const char **) apr_array_push(arr)) = ap_escape_path_segment(r->pool, filename);

        *((const char **) apr_array_push(arr)) = "\">";

        *((const char **) apr_array_push(arr)) = filename;

        *((const char **) apr_array_push(arr)) = ap_escape_html(r->pool, filename);

        *((const char **) apr_array_push(arr)) = "</a> ";

        *((const char **) apr_array_push(arr)) = description;