Author: mdounin
Date: 2012-02-13 15:35:48 +0000 (Mon, 13 Feb 2012)
New Revision: 4473

Log:
Core: protection from cycles with named locations and post_action.

Now redirects to named locations are counted against normal uri changes
limit, and post_action respects this limit as well. As a result at least
the following (bad) configurations no longer trigger infinite cycles:

1. Post action which recursively triggers post action:

location / {
post_action /index.html;
}

2. Post action pointing to nonexistent named location:

location / {
post_action @nonexistent;
}

3. Recursive error page for 500 (Internal Server Error) pointing to
a nonexistent named location:

location / {
recursive_error_pages on;
error_page 500 @nonexistent;
return 500;
}


Modified:
trunk/src/http/ngx_http_core_module.c
trunk/src/http/ngx_http_request.c

Modified: trunk/src/http/ngx_http_core_module.c
===================================================================
--- trunk/src/http/ngx_http_core_module.c 2012-02-13 15:33:08 UTC (rev 4472)
+++ trunk/src/http/ngx_http_core_module.c 2012-02-13 15:35:48 UTC (rev 4473)
@@ -2524,7 +2524,17 @@
ngx_http_core_main_conf_t *cmcf;

r->main->count++;
+ r->uri_changes--;

+ if (r->uri_changes == 0) {
+ ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+ "rewrite or internal redirection cycle "
+ "while redirect to named location \"%V\"", name);
+
+ ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
+ return NGX_DONE;
+ }
+
cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);

if (cscf->named_locations) {

Modified: trunk/src/http/ngx_http_request.c
===================================================================
--- trunk/src/http/ngx_http_request.c 2012-02-13 15:33:08 UTC (rev 4472)
+++ trunk/src/http/ngx_http_request.c 2012-02-13 15:35:48 UTC (rev 4473)
@@ -2928,6 +2928,10 @@
return NGX_DECLINED;
}

+ if (r->post_action && r->uri_changes == 0) {
+ return NGX_DECLINED;
+ }
+
ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
"post action: \"%V\"", &clcf->post_action);


_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel