r67389 - in /branches/squeeze/libcgi-simple-perl: debian/changelog lib/CGI/Simple.pm t/050.simple.t t/070.standard.t t/headers.t

ntyni at users.alioth.debian.org ntyni at users.alioth.debian.org
Fri Jan 14 19:41:00 UTC 2011


Author: ntyni
Date: Fri Jan 14 19:40:41 2011
New Revision: 67389

URL: http://svn.debian.org/wsvn/pkg-perl/?sc=1&rev=67389
Log:
[SECURITY] CVE-2010-2761 CVE-2010-4410 CVE-2010-4411:
backport MIME boundary and multiline header vulnerabilities fixes.
(Closes: #606379)

Added:
    branches/squeeze/libcgi-simple-perl/t/headers.t
Modified:
    branches/squeeze/libcgi-simple-perl/debian/changelog
    branches/squeeze/libcgi-simple-perl/lib/CGI/Simple.pm
    branches/squeeze/libcgi-simple-perl/t/050.simple.t
    branches/squeeze/libcgi-simple-perl/t/070.standard.t

Modified: branches/squeeze/libcgi-simple-perl/debian/changelog
URL: http://svn.debian.org/wsvn/pkg-perl/branches/squeeze/libcgi-simple-perl/debian/changelog?rev=67389&op=diff
==============================================================================
--- branches/squeeze/libcgi-simple-perl/debian/changelog (original)
+++ branches/squeeze/libcgi-simple-perl/debian/changelog Fri Jan 14 19:40:41 2011
@@ -1,3 +1,11 @@
+libcgi-simple-perl (1.111-2) UNRELEASED; urgency=low
+
+  * [SECURITY] CVE-2010-2761 CVE-2010-4410 CVE-2010-4411:
+    backport MIME boundary and multiline header vulnerabilities fixes.
+    (Closes: #606379)
+
+ -- Niko Tyni <ntyni at debian.org>  Fri, 14 Jan 2011 21:32:40 +0200
+
 libcgi-simple-perl (1.111-1) unstable; urgency=low
 
   * New upstream release

Modified: branches/squeeze/libcgi-simple-perl/lib/CGI/Simple.pm
URL: http://svn.debian.org/wsvn/pkg-perl/branches/squeeze/libcgi-simple-perl/lib/CGI/Simple.pm?rev=67389&op=diff
==============================================================================
--- branches/squeeze/libcgi-simple-perl/lib/CGI/Simple.pm (original)
+++ branches/squeeze/libcgi-simple-perl/lib/CGI/Simple.pm Fri Jan 14 19:40:41 2011
@@ -986,6 +986,31 @@
     ],
     @params
    );
+
+  my $CRLF = $self->crlf;
+
+  # CR escaping for values, per RFC 822
+  for my $header (
+    $type, $status,  $cookie,     $target, $expires,
+    $nph,  $charset, $attachment, $p3p,    @other
+   ) {
+    if ( defined $header ) {
+      # From RFC 822:
+      # Unfolding  is  accomplished  by regarding   CRLF   immediately
+      # followed  by  a  LWSP-char  as equivalent to the LWSP-char.
+      $header =~ s/$CRLF(\s)/$1/g;
+
+      # All other uses of newlines are invalid input.
+      if ($header =~ m/$CRLF|\015|\012/) {
+        # shorten very long values in the diagnostic
+        $header = substr( $header, 0, 72 ) . '...'
+         if ( length $header > 72 );
+        die
+         "Invalid header value contains a newline not followed by whitespace: $header";
+      }
+    }
+  }
+
   $nph ||= $self->{'.globals'}->{'NPH'};
   $charset = $self->charset( $charset )
    ;    # get charset (and set new charset if supplied)
@@ -1042,7 +1067,6 @@
    if $attachment;
   push @header, @other;
   push @header, "Content-Type: $type" if $type;
-  my $CRLF = $self->crlf;
   my $header = join $CRLF, @header;
   $header .= $CRLF . $CRLF;    # add the statutory two CRLFs
 
@@ -1105,7 +1129,14 @@
   my ( $self, @p ) = @_;
   use CGI::Simple::Util qw(rearrange);
   my ( $boundary, @other ) = rearrange( ['BOUNDARY'], @p );
-  $boundary = $boundary || '------- =_aaaaaaaaaa0';
+  if ( !$boundary ) {
+    $boundary = '------- =_';
+    my @chrs = ( '0' .. '9', 'A' .. 'Z', 'a' .. 'z' );
+    for ( 1 .. 17 ) {
+      $boundary .= $chrs[ rand( scalar @chrs ) ];
+    }
+  }
+
   my $CRLF = $self->crlf;    # get CRLF sequence
   my $warning
    = "WARNING: YOUR BROWSER DOESN'T SUPPORT THIS SERVER-PUSH TECHNOLOGY.";

Modified: branches/squeeze/libcgi-simple-perl/t/050.simple.t
URL: http://svn.debian.org/wsvn/pkg-perl/branches/squeeze/libcgi-simple-perl/t/050.simple.t?rev=67389&op=diff
==============================================================================
--- branches/squeeze/libcgi-simple-perl/t/050.simple.t (original)
+++ branches/squeeze/libcgi-simple-perl/t/050.simple.t Fri Jan 14 19:40:41 2011
@@ -1,4 +1,4 @@
-use Test::More tests => 318;
+use Test::More tests => 319;
 use Carp;
 use strict;
 use vars qw(%field %in);
@@ -940,17 +940,25 @@
 is( $sv, $header, 'redirect() - nph, 1' );
 ################# Server Push Methods #################
 
-$q = new CGI::Simple;
+$q = CGI::Simple->new;
 
 $sv = $q->multipart_init();
 like(
   $sv,
-  qr|Content-Type: multipart/x-mixed-replace;boundary="------- =_aaaaaaaaaa0"|,
+  qr|Content-Type: multipart/x-mixed-replace;boundary="------- =_[a-zA-Z0-9]{17}"|,
   'multipart_init(), 1'
 );
-like( $sv, qr/--------- =_aaaaaaaaaa0$CRLF/, 'multipart_init(), 2' );
+like( $sv, qr/--------- =_[a-zA-Z0-9]{17}$CRLF/,
+  'multipart_init(), 2' );
 $sv = $q->multipart_init( 'this_is_the_boundary' );
 like( $sv, qr/boundary="this_is_the_boundary"/, 'multipart_init(), 3' );
+{
+  my $sv1 = $q->multipart_init;
+  my $sv2 = $q->multipart_init;
+  isnt( $sv1, $sv2,
+    "due to random boundaries, multiple calls produce different results"
+  );
+}
 $sv = $q->multipart_init( -boundary => 'this_is_another_boundary' );
 like(
   $sv,

Modified: branches/squeeze/libcgi-simple-perl/t/070.standard.t
URL: http://svn.debian.org/wsvn/pkg-perl/branches/squeeze/libcgi-simple-perl/t/070.standard.t?rev=67389&op=diff
==============================================================================
--- branches/squeeze/libcgi-simple-perl/t/070.standard.t (original)
+++ branches/squeeze/libcgi-simple-perl/t/070.standard.t Fri Jan 14 19:40:41 2011
@@ -1,4 +1,4 @@
-use Test::More tests => 288;
+use Test::More tests => 289;
 use Carp;
 use strict;
 use vars qw(%field %in);
@@ -953,12 +953,21 @@
 $sv = multipart_init();
 like(
   $sv,
-  qr|Content-Type: multipart/x-mixed-replace;boundary="------- =_aaaaaaaaaa0"|,
+  qr|Content-Type: multipart/x-mixed-replace;boundary="------- =_[a-zA-Z0-9]{17}"|,
   'multipart_init(), 1'
 );
-like( $sv, qr/--------- =_aaaaaaaaaa0$CRLF/, 'multipart_init(), 2' );
+
+like( $sv, qr/--------- =_[a-zA-Z0-9]{17}$CRLF/,
+  'multipart_init(), 2' );
 $sv = multipart_init( 'this_is_the_boundary' );
 like( $sv, qr/boundary="this_is_the_boundary"/, 'multipart_init(), 3' );
+{
+  my $sv1 = multipart_init();
+  my $sv2 = multipart_init();
+  isnt( $sv1, $sv2,
+    "due to random boundaries, multiple calls produce different results"
+  );
+}
 $sv = multipart_init( -boundary => 'this_is_another_boundary' );
 like(
   $sv,

Added: branches/squeeze/libcgi-simple-perl/t/headers.t
URL: http://svn.debian.org/wsvn/pkg-perl/branches/squeeze/libcgi-simple-perl/t/headers.t?rev=67389&op=file
==============================================================================
--- branches/squeeze/libcgi-simple-perl/t/headers.t (added)
+++ branches/squeeze/libcgi-simple-perl/t/headers.t Fri Jan 14 19:40:41 2011
@@ -1,0 +1,84 @@
+
+# Test that header generation is spec compliant.
+# References:
+#   http://www.w3.org/Protocols/rfc2616/rfc2616.html
+#   http://www.w3.org/Protocols/rfc822/3_Lexical.html
+
+use strict;
+use warnings;
+
+use Test::More 'no_plan';
+
+use CGI::Simple;
+
+my $cgi = CGI::Simple->new;
+
+like $cgi->header( -type => "text/html" ),
+ qr#Type: text/html#, 'known header, basic case: type => "text/html"';
+
+eval {
+  like $cgi->header(
+    -type => "text/html" . $cgi->crlf . "evil: stuff" ),
+   qr#Type: text/html evil: stuff#, 'known header';
+};
+like( $@, qr/contains a newline/, 'invalid header blows up' );
+
+like $cgi->header(
+  -type => "text/html" . $cgi->crlf . " evil: stuff " ),
+ qr#Content-Type: text/html evil: stuff#,
+ 'known header, with leading and trailing whitespace on the continuation line';
+
+eval {
+  like $cgi->header(
+    -foobar => "text/html" . $cgi->crlf . "evil: stuff" ),
+   qr#Foobar: text/htmlevil: stuff#, 'unknown header';
+};
+like(
+  $@,
+  qr/contains a newline/,
+  'unknown header with CRLF embedded blows up'
+);
+
+like $cgi->header( -foobar => "Content-type: evil/header" ),
+ qr#^Foobar: Content-type: evil/header#m,
+ 'unknown header with leading newlines';
+
+eval {
+  like $cgi->redirect(
+    -type => "text/html" . $cgi->crlf . "evil: stuff" ),
+   qr#Type: text/htmlevil: stuff#, 'redirect w/ known header';
+};
+like(
+  $@,
+  qr/contains a newline/,
+  'redirect with known header with CRLF embedded blows up'
+);
+
+eval {
+  like $cgi->redirect(
+    -foobar => "text/html" . $cgi->crlf . "evil: stuff" ),
+   qr#Foobar: text/htmlevil: stuff#, 'redirect w/ unknown header';
+};
+like(
+  $@,
+  qr/contains a newline/,
+  'redirect with unknown header with CRLF embedded blows up'
+);
+
+eval {
+  like $cgi->redirect(
+    $cgi->crlf . $cgi->crlf . "Content-Type: text/html" ),
+   qr#Location: Content-Type#, 'redirect w/ leading newline ';
+};
+like(
+  $@,
+  qr/contains a newline/,
+  'redirect with leading newlines blows up'
+);
+
+{
+    my $cgi = CGI::Simple->new('t=bogus%0A%0A<html>');
+    my $out;
+    eval { $out = $cgi->redirect( $cgi->param('t') ) };
+    like($@,qr/contains a newline/, "redirect does not allow double-newline injection");
+}




More information about the Pkg-perl-cvs-commits mailing list