Skip to content

mod_rewrite: Check UNCList before prefix_stat() probes a UNC path - #828

Open
arturobernalg wants to merge 1 commit into
apache:trunkfrom
arturobernalg:fix/httpd-70210-rewrite-unc-check
Open

arturobernalg wants to merge 1 commit into
apache:trunkfrom
arturobernalg:fix/httpd-70210-rewrite-unc-check

Conversation

@arturobernalg

Copy link
Copy Markdown
Member

On Windows, prefix_stat() calls apr_filepath_root() with APR_FILEPATH_TRUENAME on the result of a server-context RewriteRule before any UNC check. For a UNC path this makes APR call GetDriveTypeW() on the \\host\share\ root, which contacts the host. With UNCList unset (all UNC access denied), a RewriteRule that produces a UNC path therefore still triggers a network lookup, and a worker waits for it, before the path is rejected.

This calls ap_stat_check() first, like the file tests of RewriteCond already do since r1927033. ap_stat_check() is a no-op on other platforms. If the check refuses the path, prefix_stat() returns 0, the same result as when the root probe failed, so the final response is unchanged (404) but without the network access. An allowed host still takes the old path.

PR 70210.

The test is Windows only (UNCList does not exist elsewhere), so it is skipped on Unix. I could only check the Unix side locally: mod_rewrite builds and the pytest_suite rewrite tests give the same results as before.


  • This PR does not report or address a security vulnerability
    (see SECURITY.md and
    https://www.apache.org/security/#reporting-a-vulnerability).
  • Code follows the httpd style guide.
  • New log messages (level debug or higher) use an empty APLOGNO() tag;
    numbers are assigned by a committer at merge time (see docs/log-message-tags/README).
    (No new log messages with a tag; the new rewritelog() line has none.)
  • If the change is user-visible, a changes-entries/*.txt file is included,
    following the template in README.CHANGES (not needed otherwise).
  • Test cases based on pyhttpd are included where appropriate, in the
    test/modules/xxx directory matching the modules/xxx module source,
    or test/modules/core for core server changes. On Unix, verify these
    pass locally with e.g. make check-pytest PYTEST_DIRS=test/modules/xxx.

On Windows, prefix_stat() calls apr_filepath_root() with
APR_FILEPATH_TRUENAME on the substitution result before any UNC check.
For a UNC path this contacts the host, so a RewriteRule producing one
could cause a network lookup even though UNCList denies it.

Call ap_stat_check() first, like the file tests of RewriteCond do.

PR 70210.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant