Re: Mitigating XSS in the mod_perl API

[Geoffrey Young]

Matt Sergeant wrote:

Here's the patch in case anyone is interested in applying it to their own
apache. I think there's probably a bug in that \n might not always be the
right thing to look for (CRLF issues), so please send me corrections ;-)

I'm not a C guy, but there are some constants in httpd.h that may help with CRLF portability stuff (see below).

and just for my interest, can you explain the continuation logic? I don't get it :)

--Geoff

#ifndef CHARSET_EBCDIC
#define LF 10
#define CR 13
#define CRLF "\015\012"
#define OS_ASC(c) (c)
#else /* CHARSET_EBCDIC */
#include "ap_ebcdic.h"
/* OSD_POSIX uses the EBCDIC charset. The transition ASCII->EBCDIC is done in
* the buff package (bread/bputs/bwrite), so everywhere else, we use
* "native EBCDIC" CR and NL characters. These are therefore defined as
* '\r' and '\n'.
* NB: this is not the whole truth - sometimes \015 and \012 are contained
* in literal (EBCDIC!) strings, so these are not converted but passed.
*/
#define CR '\r'
#define LF '\n'
#define CRLF "\r\n"
#define OS_ASC(c) (os_toascii[c])
#endif /* CHARSET_EBCDIC */




---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]