From 785c131b957036dcedd462072eaf4771bee57f31 Mon Sep 17 00:00:00 2001
From: Michal Karm Babacek <karm@redhat.com>
Date: Mon, 2 Mar 2015 18:20:09 +0100
Subject: [PATCH] MODCLUSTER-453 - Messages containing apr_escape_entity or
 apr_escape_shell sensitive symbols are discarted.

---
 native/mod_manager/mod_manager.c | 68 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)

diff --git a/native/mod_manager/mod_manager.c b/native/mod_manager/mod_manager.c
index ce027e8..84b14af 100644
--- a/native/mod_manager/mod_manager.c
+++ b/native/mod_manager/mod_manager.c
@@ -26,6 +26,7 @@
  */
 
 #include "apr_strings.h"
+#include "apr_escape.h"
 #include "apr_lib.h"
 #include "apr_uuid.h"
 
@@ -80,6 +81,13 @@
 #define SMULCTB "SYNTAX: Only one Context in APP command"
 #define SREADER "SYNTAX: %s can't read POST data"
 
+#define MALIBAL "Illegal symbols in MCMP message Balancer field. Message was discarded."
+#define MALISCO "Illegal symbols in MCMP message StickySessionCookie field. Message was discarded."
+#define MALISPA "Illegal symbols in MCMP message StickySessionPath field. Message was discarded."
+#define MALIJVM "Illegal symbols in MCMP message JVMRoute field. Message was discarded."
+#define MALIALI "Illegal symbols in MCMP message Alias field. Message was discarded."
+#define MALICON "Illegal symbols in MCMP message Context field. Message was discarded."
+
 #define SJIDBIG "SYNTAX: JGroupUuid field too big"
 #define SJDDBIG "SYNTAX: JGroupData field too big"
 #define SJIDBAD "SYNTAX: JGroupUuid can't be empty"
@@ -843,6 +851,12 @@ static char * process_config(request_rec *r, char **ptr, int *errtype)
                 *errtype = TYPESYNTAX;
                 return SBALBIG;
             }
+            if (apr_escape_entity(NULL, ptr[i+1], strlen(ptr[i+1]), 0, NULL) != APR_NOTFOUND ||
+                apr_escape_shell(NULL, ptr[i+1], strlen(ptr[i+1]), NULL) != APR_NOTFOUND) {
+                ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "MALIBAL: %s", ptr[i+1]);
+                *errtype = TYPESYNTAX;
+                return MALIBAL;
+            }
             strcpy(nodeinfo.mess.balancer, ptr[i+1]);
             strcpy(balancerinfo.balancer, ptr[i+1]);
         }
@@ -855,6 +869,12 @@ static char * process_config(request_rec *r, char **ptr, int *errtype)
                 *errtype = TYPESYNTAX;
                 return SBAFBIG;
             }
+            if (apr_escape_entity(NULL, ptr[i+1], strlen(ptr[i+1]), 0, NULL) != APR_NOTFOUND ||
+                apr_escape_shell(NULL, ptr[i+1], strlen(ptr[i+1]), NULL) != APR_NOTFOUND) {
+                ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "MALISCO: %s", ptr[i+1]);
+                *errtype = TYPESYNTAX;
+                return MALISCO;
+            }
             strcpy(balancerinfo.StickySessionCookie, ptr[i+1]);
         }
         if (strcasecmp(ptr[i], "StickySessionPath") == 0) {
@@ -862,6 +882,12 @@ static char * process_config(request_rec *r, char **ptr, int *errtype)
                 *errtype = TYPESYNTAX;
                 return SBAFBIG;
             }
+            if (apr_escape_entity(NULL, ptr[i+1], strlen(ptr[i+1]), 0, NULL) != APR_NOTFOUND ||
+                apr_escape_shell(NULL, ptr[i+1], strlen(ptr[i+1]), NULL) != APR_NOTFOUND) {
+                ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "MALISPA: %s", ptr[i+1]);
+                *errtype = TYPESYNTAX;
+                return MALISPA;
+            }
             strcpy(balancerinfo.StickySessionPath, ptr[i+1]);
         }
         if (strcasecmp(ptr[i], "StickySessionRemove") == 0) {
@@ -886,6 +912,12 @@ static char * process_config(request_rec *r, char **ptr, int *errtype)
                 *errtype = TYPESYNTAX;
                 return SROUBIG;
             }
+            if (apr_escape_entity(NULL, ptr[i+1], strlen(ptr[i+1]), 0, NULL) != APR_NOTFOUND ||
+                apr_escape_shell(NULL, ptr[i+1], strlen(ptr[i+1]), NULL) != APR_NOTFOUND) {
+                ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "MALIJVM: %s", ptr[i+1]);
+                *errtype = TYPESYNTAX;
+                return MALIJVM;
+            }
             strcpy(nodeinfo.mess.JVMRoute, ptr[i+1]);
         }
         /* We renamed it LBGroup */
@@ -968,6 +1000,12 @@ static char * process_config(request_rec *r, char **ptr, int *errtype)
                 *errtype = TYPESYNTAX;
                 return SALIBAD;
             }
+            if (apr_escape_entity(NULL, ptr[i+1], strlen(ptr[i+1]), 0, NULL) != APR_NOTFOUND ||
+                apr_escape_shell(NULL, ptr[i+1], strlen(ptr[i+1]), NULL) != APR_NOTFOUND) {
+                ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "MALIALI: %s", ptr[i+1]);
+                *errtype = TYPESYNTAX;
+                return MALIALI;
+            }
             if (phost->host) {
                phost->next = apr_palloc(r->pool, sizeof(struct cluster_host));
                phost = phost->next;
@@ -983,6 +1021,12 @@ static char * process_config(request_rec *r, char **ptr, int *errtype)
                 *errtype = TYPESYNTAX;
                 return SCONBAD;
             }
+            if (apr_escape_entity(NULL, ptr[i+1], strlen(ptr[i+1]), 0, NULL) != APR_NOTFOUND ||
+                apr_escape_shell(NULL, ptr[i+1], strlen(ptr[i+1]), NULL) != APR_NOTFOUND) {
+                ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "MALICON: %s", ptr[i+1]);
+                *errtype = TYPESYNTAX;
+                return MALICON;
+            }
             phost->context = ptr[i+1];
         }
         i++;
@@ -1584,6 +1628,12 @@ static char * process_appl_cmd(request_rec *r, char **ptr, int status, int *errt
                 *errtype = TYPESYNTAX;
                 return SROUBIG;
             }
+            if (apr_escape_entity(NULL, ptr[i+1], strlen(ptr[i+1]), 0, NULL) != APR_NOTFOUND ||
+                apr_escape_shell(NULL, ptr[i+1], strlen(ptr[i+1]), NULL) != APR_NOTFOUND) {
+                ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "MALIJVM: %s", ptr[i+1]);
+                *errtype = TYPESYNTAX;
+                return MALIJVM;
+            }
             strcpy(nodeinfo.mess.JVMRoute, ptr[i+1]);
             nodeinfo.mess.id = 0;
         }
@@ -1592,6 +1642,12 @@ static char * process_appl_cmd(request_rec *r, char **ptr, int status, int *errt
                 *errtype = TYPESYNTAX;
                 return SMULALB;
             }
+            if (apr_escape_entity(NULL, ptr[i+1], strlen(ptr[i+1]), 0, NULL) != APR_NOTFOUND ||
+                apr_escape_shell(NULL, ptr[i+1], strlen(ptr[i+1]), NULL) != APR_NOTFOUND) {
+                ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "MALIALI: %s", ptr[i+1]);
+                *errtype = TYPESYNTAX;
+                return MALIALI;
+            }
             vhost->host = ptr[i+1];
         }
         if (strcasecmp(ptr[i], "Context") == 0) {
@@ -1599,6 +1655,12 @@ static char * process_appl_cmd(request_rec *r, char **ptr, int status, int *errt
                 *errtype = TYPESYNTAX;
                 return SMULCTB;
             }
+            if (apr_escape_entity(NULL, ptr[i+1], strlen(ptr[i+1]), 0, NULL) != APR_NOTFOUND ||
+                apr_escape_shell(NULL, ptr[i+1], strlen(ptr[i+1]), NULL) != APR_NOTFOUND) {
+                ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "MALICON: %s", ptr[i+1]);
+                *errtype = TYPESYNTAX;
+                return MALICON;
+            }
             vhost->context = ptr[i+1];
         }
         i++;
@@ -1962,6 +2024,12 @@ static char * process_status(request_rec *r, char **ptr, int *errtype)
                 *errtype = TYPESYNTAX;
                 return SROUBIG;
             }
+            if (apr_escape_entity(NULL, ptr[i+1], strlen(ptr[i+1]), 0, NULL) != APR_NOTFOUND ||
+                apr_escape_shell(NULL, ptr[i+1], strlen(ptr[i+1]), NULL) != APR_NOTFOUND) {
+                ap_log_error(APLOG_MARK, APLOG_DEBUG, 0, r->server, "MALIJVM: %s", ptr[i+1]);
+                *errtype = TYPESYNTAX;
+                return MALIJVM;
+            }
             strcpy(nodeinfo.mess.JVMRoute, ptr[i+1]);
             nodeinfo.mess.id = 0;
         }
-- 
1.9.3

