Ticket #536: mod_ssi_recursion-1.4.15.2.patch

src/mod_ssi.c

@@ -36 +36 @@
 #include <sys/filio.h>
 #endif
 
+#define DEFAULT_MAX_SSI_RECURSION 25
+
 /* init the plugin data */
 INIT_FUNC(mod_ssi_init) {
         plugin_data *p;
@@ -94 +96 @@
 #endif
 
         config_values_t cv[] = {
-                { "ssi.extension",              NULL, T_CONFIG_ARRAY, T_CONFIG_SCOPE_CONNECTION },       /* 0 */
-                { NULL,                         NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
+                { "ssi.extension",                              NULL, T_CONFIG_ARRAY, T_CONFIG_SCOPE_CONNECTION },               /* 0 */
+                { "ssi.max_recursion",                  NULL, T_CONFIG_SHORT, T_CONFIG_SCOPE_CONNECTION },               /* 1 */
+                { NULL,                                                 NULL, T_CONFIG_UNSET, T_CONFIG_SCOPE_UNSET }
         };
 
         if (!p) return HANDLER_ERROR;
@@ -107 +110 @@
 
                 s = calloc(1, sizeof(plugin_config));
                 s->ssi_extension  = array_init();
+                s->ssi_max_recursion  = DEFAULT_MAX_SSI_RECURSION;
 
                 cv[0].destination = s->ssi_extension;
+                cv[1].destination = &(s->ssi_max_recursion);
 
                 p->config_storage[i] = s;
 
@@ -546 +551 @@
                 }
 
                 if (0 == stat(p->stat_fn->ptr, &st)) {
+                        buffer *tmp = NULL;
                         time_t t = st.st_mtime;
 
                         switch (ssicmd) {
@@ -574 +580 @@
                                 }
                                 break;
                         case SSI_INCLUDE:
-                                chunkqueue_append_file(con->write_queue, p->stat_fn, 0, st.st_size);
+                                /* do recursive SSI expansion */
+
+                                /* prevents infinite loop */
+                                if (buffer_is_equal(con->physical.path, p->stat_fn)) {
+                                        buffer_copy_string(srv->tmp_buf, "<!-- your include directives create an infinite loop; aborting -->");
+                                        chunkqueue_append_buffer(con->write_queue, srv->tmp_buf);
+                                        break;
+                                }
+
+                                /* only allow predefined recursion depth */
+                                if (con->loops_per_request > p->conf.ssi_max_recursion) {
+                                        buffer_copy_string(srv->tmp_buf, "<!-- your include directives recurse deeper than pre-defined max_recursion; aborting -->");
+                                        chunkqueue_append_buffer(con->write_queue, srv->tmp_buf);
+                                        break;
+                                }
+
+                                tmp = buffer_init();
+                                /* save path of current document */
+                                buffer_copy_string_buffer(tmp, con->physical.path);
+                                /* next sub-document to parse */
+                                buffer_copy_string_buffer(con->physical.path, p->stat_fn);
+                                if (mod_ssi_physical_path(srv,con,p) != HANDLER_FINISHED) {
+                                        /* the document was not processed, so write it as is */
+                                        chunkqueue_append_file(con->write_queue, con->physical.path, 0, st.st_size);
+                                }
+                                /* restore saved path */
+                                buffer_copy_string_buffer(con->physical.path, tmp);
+                                buffer_free(tmp);
                                 break;
                         }
                 } else {
@@ -1023 +1056 @@
         plugin_config *s = p->config_storage[0];
 
         PATCH(ssi_extension);
+        PATCH(ssi_max_recursion);
 
         /* skip the first, the global context */
         for (i = 1; i < srv->config_context->used; i++) {
@@ -1039 +1073 @@
                         if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssi.extension"))) {
                                 PATCH(ssi_extension);
                         }
+                        if (buffer_is_equal_string(du->key, CONST_STR_LEN("ssi.max_recursion"))) {
+                                PATCH(ssi_max_recursion);
+                        }
                 }
         }
 
@@ -1051 +1088 @@
         size_t k;
 
         if (con->physical.path->used == 0) return HANDLER_GO_ON;
+
+        con->loops_per_request++;
 
         mod_ssi_patch_connection(srv, con, p);
 

src/mod_ssi.h

@@ -15 +15 @@
 
 typedef struct {
         array *ssi_extension;
+        unsigned short ssi_max_recursion;
 } plugin_config;
 
 typedef struct {