[git commit] httpd: do not percent-decode URI if proxying

[Denys Vlasenko]

commit: https://git.busybox.net/busybox/commit/?id=bae8f7eaf2997938615ed4282d6d93d3aa1f3fc1
branch: https://git.busybox.net/busybox/commit/?id=refs/heads/master

The proxying is documented as follows:

P:/url:[http://]hostname[:port]/new/path

Howeverm urlcopy is not a true copy anymore when it is fdprint'ed
to proxy_fd, this is because percent_decode_in_place() is called
after the copy is created.

This breaks reverse proxying all URIs containing percent
encoded spaces, e.g. - because a decoded URI will be printed out
to proxy_fd instead of the original.

The fix keeps the logic in place to canonicalize the uri first,
before reverse proxying (one could argue that the uri
should be proxied completely unaltered, except for the prefix
rewrite).

function                                             old     new   delta
handle_incoming_and_exit                            2752    2792     +40

Signed-off-by: Denys Vlasenko <vda.linux at googlemail.com>
---
 networking/httpd.c | 32 ++++++++++++++++++++++----------
 1 file changed, 22 insertions(+), 10 deletions(-)

diff --git a/networking/httpd.c b/networking/httpd.c
index c486197b8..bc0e386ea 100644
--- a/networking/httpd.c
+++ b/networking/httpd.c
@@ -1817,7 +1817,7 @@ static NOINLINE void send_file_and_exit(const char *url, int what)
 	log_and_exit();
 }
 
-static void send_HTTP_FORBIDDEN_and_exit_if_denied_ip(void)
+static void if_ip_denied_send_HTTP_FORBIDDEN_and_exit(void)
 {
 	Htaccess_IP *cur;
 
@@ -2195,6 +2195,24 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
 		send_headers_and_exit(HTTP_NOT_FOUND);
 	}
 
+#if ENABLE_FEATURE_HTTPD_PROXY
+	proxy_entry = find_proxy_entry(urlcopy);
+	if (proxy_entry)
+		header_buf = header_ptr = xmalloc(IOBUF_SIZE);
+	else
+#endif
+	{
+		/* (If not proxying,) decode URL escape sequences */
+		tptr = percent_decode_in_place(urlcopy, /*strict:*/ 1);
+		if (tptr == NULL)
+			send_headers_and_exit(HTTP_BAD_REQUEST);
+		if (tptr == urlcopy + 1) {
+			/* '/' or NUL is encoded */
+			send_headers_and_exit(HTTP_NOT_FOUND);
+		}
+//should path canonicalization also be conditional on not proxying?
+	}
+
 	/* Canonicalize path */
 	/* Algorithm stolen from libbb bb_simplify_path(),
 	 * but don't strdup, retain trailing slash, protect root */
@@ -2224,7 +2242,7 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
 			}
 		}
 		*++urlp = *tptr;
-		if (*urlp == '\0')
+		if (*tptr == '\0')
 			break;
  next_char:
 		tptr++;
@@ -2242,24 +2260,18 @@ static void handle_incoming_and_exit(const len_and_sockaddr *fromAddr)
 		bb_error_msg("url:%s", urlcopy);
 
 	tptr = urlcopy;
-	send_HTTP_FORBIDDEN_and_exit_if_denied_ip();
+	if_ip_denied_send_HTTP_FORBIDDEN_and_exit();
 	while ((tptr = strchr(tptr + 1, '/')) != NULL) {
 		/* have path1/path2 */
 		*tptr = '\0';
 		if (is_directory(urlcopy + 1, /*followlinks:*/ 1)) {
 			/* may have subdir config */
 			parse_conf(urlcopy + 1, SUBDIR_PARSE);
-			send_HTTP_FORBIDDEN_and_exit_if_denied_ip();
+			if_ip_denied_send_HTTP_FORBIDDEN_and_exit();
 		}
 		*tptr = '/';
 	}
 
-#if ENABLE_FEATURE_HTTPD_PROXY
-	proxy_entry = find_proxy_entry(urlcopy);
-	if (proxy_entry)
-		header_buf = header_ptr = xmalloc(IOBUF_SIZE);
-#endif
-
 	if (http_major_version >= '0') {
 		/* Request was with "... HTTP/nXXX", and n >= 0 */