diff options
| author |   Ingo Schwarze <schwarze@openbsd.org> | 2014-07-18 19:03:39 +0000 |
|---|---|---|
| committer | Ingo Schwarze <schwarze@openbsd.org> | 2014-07-18 19:03:39 +0000 |
| commit | 6d9b8bc9ac9935024b9c1b5d06d4f294d7fce3d1 (patch) | |
| tree | f4c7415fe3497c57c28588f04fe7d6f6687331f9 | |
| parent | 0065e1541bdf9d7132fd54e83dfeab0ed1f86f25 (diff) | |
| download | mandoc-6d9b8bc9ac9935024b9c1b5d06d4f294d7fce3d1.tar.gz mandoc-6d9b8bc9ac9935024b9c1b5d06d4f294d7fce3d1.tar.zst mandoc-6d9b8bc9ac9935024b9c1b5d06d4f294d7fce3d1.zip | |
Do not use the HTTP_HOST CGI variable,
just make the HTTP redirect Location: relative.
Less user input is good, it reduces the attack surface.
Besides, this removes one global variable and 4 lines of code.
Patch from Sebastien Marie <semarie-openbsd at latrappe dot fr>.
| -rw-r--r-- | cgi.c | 10 | ||||
| -rw-r--r-- | man.cgi.8 | 9 |
2 files changed, 5 insertions, 14 deletions
@@ -1,4 +1,4 @@ -/* $Id: cgi.c,v 1.74 2014/07/18 14:46:25 schwarze Exp $ */ +/* $Id: cgi.c,v 1.75 2014/07/18 19:03:39 schwarze Exp $ */ /* * Copyright (c) 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv> * Copyright (c) 2014 Ingo Schwarze <schwarze@usta.de> @@ -79,7 +79,6 @@ static void resp_searchform(const struct req *); static void resp_show(const struct req *, const char *); static const char *scriptname; /* CGI script name */ -static const char *httphost; /* hostname used in the URIs */ static const int sec_prios[] = {1, 4, 5, 8, 6, 3, 7, 2, 9}; static const char *const sec_numbers[] = { @@ -530,8 +529,8 @@ pg_searchres(const struct req *req, struct manpage *r, size_t sz) * without any delay. */ printf("Status: 303 See Other\r\n"); - printf("Location: http://%s%s/%s/%s?", - httphost, scriptname, req->q.manpath, r[0].file); + printf("Location: %s/%s/%s?", + scriptname, req->q.manpath, r[0].file); http_printquery(req); printf("\r\n" "Content-Type: text/html; charset=utf-8\r\n" @@ -907,9 +906,6 @@ main(void) if (NULL == (scriptname = getenv("SCRIPT_NAME"))) scriptname = ""; - if (NULL == (httphost = getenv("HTTP_HOST"))) - httphost = "localhost"; - /* * First we change directory into the MAN_DIR so that * subsequent scanning for manpath directories is rooted @@ -1,4 +1,4 @@ -.\" $Id: man.cgi.8,v 1.6 2014/07/13 15:38:36 schwarze Exp $ +.\" $Id: man.cgi.8,v 1.7 2014/07/18 19:03:39 schwarze Exp $ .\" .\" Copyright (c) 2014 Ingo Schwarze <schwarze@openbsd.org> .\" @@ -14,7 +14,7 @@ .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. .\" -.Dd $Mdocdate: July 13 2014 $ +.Dd $Mdocdate: July 18 2014 $ .Dt MAN.CGI 8 .Os .Sh NAME @@ -266,11 +266,6 @@ is supported as an alias for The web server may pass the following CGI variables to .Nm : .Bl -tag -width Ds -.It Ev HTTP_HOST -The FQDN of the (possibly virtual) host the HTTP server is running on. -This is used for -.Ic Location: -headers in HTTP 303 responses. .It Ev PATH_INFO The final part of the URI path passed from the client to the server, starting after the |