Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 544776 - www-servers/boa advertises insecure AddType directive
Summary: www-servers/boa advertises insecure AddType directive
Status: RESOLVED INVALID
Alias: None
Product: Gentoo Linux
Classification: Unclassified
Component: Current packages (show other bugs)
Hardware: All Linux
: Normal normal (vote)
Assignee: Michał Górny
URL:
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-03-28 17:03 UTC by Sebastian Pipping
Modified: 2015-03-28 20:04 UTC (History)
0 users

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Sebastian Pipping gentoo-dev 2015-03-28 17:03:41 UTC
Hi!

Apache AddType seems to have problems similar to AddHandler.

# fgrep -R AddType .
./files/boa.conf:# Comment out to avoid loading mime.types (better use AddType!)
./files/boa.conf:# AddType: adds types without editing mime.types
./files/boa.conf:# Example: AddType type extension [extension ...]
./files/boa.conf:#AddType application/x-httpd-cgi cgi

It would be cool, if we could move this to a FilesMatch/SetHandler/ForceType based approach.

Thanks!
Comment 1 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2015-03-28 17:23:10 UTC
Could you elaborate a bit, please? I don't see how Apache's AddType applies to boa configuration...
Comment 2 Sebastian Pipping gentoo-dev 2015-03-28 17:30:19 UTC
Are we dealing with Apache directive names like DefaultType, ScriptAlias, AddType for things that boa implements themselves here?

Does "AddType application/x-httpd-cgi cgi" match file "index.cgi.png" (as with Apache), too?
Comment 3 Sebastian Pipping gentoo-dev 2015-03-28 20:04:07 UTC
I had a look quick at boa source code now (version 0.94.14_rc21-r1).

Boa's AddType results in a new type map entry.
That entry is compared against the very last file extension, only:

  extension = strrchr(filename, '.');
  if (!extension || extension[1] == '\0')
    return default_type;
  ++extension;
  hash = get_mime_hash_value(extension);
  current = hash_find(mime_hashtable, extension, hash);
  return (current ? current->value : default_type);

The looked up MIME type is used for two things only:

 * Comparison to "application/x-httpd-cgi" for CGI execution

 * Generation of a Content-Type response header

So that's both safe and not what Apache is doing.
Since Boa has a doc section "Unexpected behavior", I have opened a ticket to ask upstream for documentation of the differences to AddType of Apache: https://sourceforge.net/p/boa/bugs/41/ .

Best, Sebastian