[mapserver-commits] r10319 - trunk/mapserver
svn at osgeo.org
svn at osgeo.org
Thu Jul 8 17:30:02 EDT 2010
Author: dmorissette
Date: 2010-07-08 21:30:02 +0000 (Thu, 08 Jul 2010)
New Revision: 10319
Modified:
trunk/mapserver/HISTORY.TXT
trunk/mapserver/README.CONFIGURE
trunk/mapserver/configure
trunk/mapserver/configure.in
trunk/mapserver/mapserv.c
Log:
Disable insecure mapserv cgi command-line debug params by default (#3485)
Modified: trunk/mapserver/HISTORY.TXT
===================================================================
--- trunk/mapserver/HISTORY.TXT 2010-07-08 21:26:54 UTC (rev 10318)
+++ trunk/mapserver/HISTORY.TXT 2010-07-08 21:30:02 UTC (rev 10319)
@@ -14,6 +14,12 @@
Current Version (SVN trunk):
----------------------------
+- Disabled some insecure (and potentially exploitable) mapserv command-line
+ debug arguments (#3485). The --enable-cgi-cl-debug-args configure switch
+ can be used to re-enable them for devs who really cannot get away without
+ them and who understand the potential security risk (not recommended for
+ production servers or those who don't understand the security implications).
+
- Fixed possible buffer overflow in msTmpFile() (#3484)
- Fixed Using STYLEITEM AUTO, loadExpression fails when the label text contains a double quote (#3481)
Modified: trunk/mapserver/README.CONFIGURE
===================================================================
--- trunk/mapserver/README.CONFIGURE 2010-07-08 21:26:54 UTC (rev 10318)
+++ trunk/mapserver/README.CONFIGURE 2010-07-08 21:30:02 UTC (rev 10319)
@@ -54,6 +54,12 @@
--disable-fast-nint Use safe MS_NINT with reliable rounding
--enable-debug Include "-g" in CFLAGS for debugging.
--disable-debug Do not include "-g" in CFLAGS (the default).
+ --enable-cgi-cl-debug-args
+ Enable mapserv CGI command-line debug arguments
+ (disabled by default). These command-line args may
+ be insecure and should be enabled only on
+ development servers and only if you understand the
+ security implications.
--enable-gcov Enable source code coverage testing using gcov
--enable-perlv-ld-detect (applies to --with-php only)
Use perl -V output to figure the command to use to
@@ -673,6 +679,15 @@
::
+ --enable-cgi-cl-debug-args
+ Enable mapserv CGI command-line debug arguments
+ (disabled by default). These command-line args may
+ be insecure and should be enabled only on
+ development servers and only if you understand the
+ security implications.
+
+::
+
--enable-gcov Enable source code coverage testing using gcov
::
Modified: trunk/mapserver/configure
===================================================================
--- trunk/mapserver/configure 2010-07-08 21:26:54 UTC (rev 10318)
+++ trunk/mapserver/configure 2010-07-08 21:30:02 UTC (rev 10319)
@@ -857,6 +857,12 @@
--disable-fast-nint Use safe MS_NINT with reliable rounding
--enable-debug Include "-g" in CFLAGS for debugging.
--disable-debug Do not include "-g" in CFLAGS (the default).
+ --enable-cgi-cl-debug-args
+ Enable mapserv CGI command-line debug arguments
+ (disabled by default). These command-line args may
+ be insecure and should be enabled only on
+ development servers and only if you understand the
+ security implications.
--enable-gcov Enable source code coverage testing using gcov
--enable-perlv-ld-detect
(applies to --with-php only)
@@ -12979,6 +12985,21 @@
CFLAGS=`echo "$CFLAGS " | sed "s/-g //"`
fi
+
+{ echo "$as_me:$LINENO: checking whether we should enable mapserv CGI command-line debug arguments..." >&5
+echo "$as_me: checking whether we should enable mapserv CGI command-line debug arguments..." >&6;}
+# Check whether --enable-cgi-cl-debug-args or --disable-cgi-cl-debug-args was given.
+if test "${enable_cgi_cl_debug_args+set}" = set; then
+ enableval="$enable_cgi_cl_debug_args"
+
+fi;
+
+if test "$enable_cgi_cl_debug_args" = "yes" ; then
+ DEBUG_FLAGS="$DEBUG_FLAGS -DMS_ENABLE_CGI_CL_DEBUG_ARGS"
+ echo "$as_me:$LINENO: result: Enabling (potentially insecure) mapserv CGI command-line debug arguments: -DMS_ENABLE_CGI_CL_DEBUG_ARGS." >&5
+echo "${ECHO_T} Enabling (potentially insecure) mapserv CGI command-line debug arguments: -DMS_ENABLE_CGI_CL_DEBUG_ARGS." >&6
+fi
+
DEBUG_FLAGS=$DEBUG_FLAGS
ALL_ENABLED="$DEBUG_FLAGS $ALL_ENABLED"
Modified: trunk/mapserver/configure.in
===================================================================
--- trunk/mapserver/configure.in 2010-07-08 21:26:54 UTC (rev 10318)
+++ trunk/mapserver/configure.in 2010-07-08 21:30:02 UTC (rev 10319)
@@ -2447,6 +2447,24 @@
CFLAGS=`echo "$CFLAGS " | sed "s/-g //"`
fi
+dnl ---------------------------------------------------------------------
+dnl Check --enable-cgi-cl-debug-args option (OFF by default)
+dnl ---------------------------------------------------------------------
+
+AC_CHECKING(whether we should enable mapserv CGI command-line debug arguments)
+AC_ARG_ENABLE(cgi-cl-debug-args,
+[ --enable-cgi-cl-debug-args
+ Enable mapserv CGI command-line debug arguments
+ (disabled by default). These command-line args may
+ be insecure and should be enabled only on
+ development servers and only if you understand the
+ security implications.],,)
+
+if test "$enable_cgi_cl_debug_args" = "yes" ; then
+ DEBUG_FLAGS="$DEBUG_FLAGS -DMS_ENABLE_CGI_CL_DEBUG_ARGS"
+ AC_MSG_RESULT([ Enabling (potentially insecure) mapserv CGI command-line debug arguments: -DMS_ENABLE_CGI_CL_DEBUG_ARGS.])
+fi
+
AC_SUBST(DEBUG_FLAGS, $DEBUG_FLAGS)
ALL_ENABLED="$DEBUG_FLAGS $ALL_ENABLED"
Modified: trunk/mapserver/mapserv.c
===================================================================
--- trunk/mapserver/mapserv.c 2010-07-08 21:26:54 UTC (rev 10318)
+++ trunk/mapserver/mapserv.c 2010-07-08 21:30:02 UTC (rev 10319)
@@ -1139,13 +1139,23 @@
/* purposes, and to query the version info. */
/* -------------------------------------------------------------------- */
for( iArg = 1; iArg < argc; iArg++ ) {
+ /* Keep only "-v", "-nh" and "QUERY_STRING=..." enabled by default.
+ * The others will require an explicit -DMS_ENABLE_CGI_CL_DEBUG_ARGS
+ * at compile time.
+ */
if( strcmp(argv[iArg],"-v") == 0 ) {
printf("%s\n", msGetVersion());
fflush(stdout);
exit(0);
} else if(strcmp(argv[iArg], "-nh") == 0) {
sendheaders = MS_FALSE;
- } else if( iArg < argc-1 && strcmp(argv[iArg], "-tmpbase") == 0) {
+ } else if( strncmp(argv[iArg], "QUERY_STRING=", 13) == 0 ) {
+ /* Debugging hook... pass "QUERY_STRING=..." on the command-line */
+ putenv( "REQUEST_METHOD=GET" );
+ putenv( argv[iArg] );
+ }
+#ifdef MS_ENABLE_CGI_CL_DEBUG_ARGS
+ else if( iArg < argc-1 && strcmp(argv[iArg], "-tmpbase") == 0) {
msForceTmpFileBase( argv[++iArg] );
} else if( iArg < argc-1 && strcmp(argv[iArg], "-t") == 0) {
char **tokens;
@@ -1161,16 +1171,13 @@
}
exit(0);
- } else if( strncmp(argv[iArg], "QUERY_STRING=", 13) == 0 ||
- strncmp(argv[iArg], "XMLPOST_QUERY_STRING=", 13) == 0) {
- /* Debugging hook... pass "QUERY_STRING=..." on the command-line */
- putenv( "REQUEST_METHOD=GET" );
- putenv( argv[iArg] );
} else if( strncmp(argv[iArg], "MS_ERRORFILE=", 13) == 0 ) {
msSetErrorFile( argv[iArg] + 13 );
} else if( strncmp(argv[iArg], "MS_DEBUGLEVEL=", 14) == 0) {
msSetGlobalDebugLevel( atoi(argv[iArg] + 14) );
- } else {
+ }
+#endif /* MS_ENABLE_CGI_CL_DEBUG_ARGS */
+ else {
/* we don't produce a usage message as some web servers pass junk arguments */
}
}
More information about the mapserver-commits
mailing list