Hello!

There is a incident occur in our team, when we use auth_request_set like
this in many server, and print $upstream_http_x_auth_request_email in log:

server {
listen 8080 reuseport;
server_name test.io;
location / {
auth_request /oauth2/auth;
auth_request_set $email $upstream_http_x_auth_request_email;
}
}

But when we add a bad auth_request_set like below:
server {
listen 8080 reuseport;
server_name test2.io;
location / {
auth_request /oauth2/auth;
auth_request_set $upstream_http_x_auth_request_email $email;
}
}

We will lost all $upstream_http_x_auth_request_email even the server
haven't use, because there is a new variable
$upstream_http_x_auth_request_email, and the prefix variable can't be read
any more.

So I think we can fix it like this, to avoid the wrong configuration:


# HG changeset patch
# User Jinhua Tan <312841925@qq.com>
# Date 1611143620 -28800
# Wed Jan 20 19:53:40 2021 +0800
# Node ID fd7e9432a59abcfcf380ddedb1e892098a54a845
# Parent 61d0df8fcc7c630da35e832ba8e983db0061a3be
Http: protect prefix variable when add variable

diff -r 61d0df8fcc7c -r fd7e9432a59a src/http/ngx_http_variables.c
--- a/src/http/ngx_http_variables.c Tue Jan 19 20:35:17 2021 +0300
+++ b/src/http/ngx_http_variables.c Wed Jan 20 19:53:40 2021 +0800
@@ -393,6 +393,20 @@
};


+static ngx_str_t ngx_http_protect_variables_prefix[] = {
+ ngx_string("arg_"),
+ ngx_string("http_"),
+ ngx_string("sent_http_"),
+ ngx_string("sent_trailer_"),
+ ngx_string("cookie_"),
+ ngx_string("arg_"),
+ ngx_string("upstream_http_"),
+ ngx_string("upstream_trailer_"),
+ ngx_string("upstream_cookie_"),
+ ngx_null_string
+};
+
+
ngx_http_variable_value_t ngx_http_variable_null_value =
ngx_http_variable("");
ngx_http_variable_value_t ngx_http_variable_true_value =
@@ -410,6 +424,7 @@
ngx_hash_key_t *key;
ngx_http_variable_t *v;
ngx_http_core_main_conf_t *cmcf;
+ ngx_str_t *p;

if (name->len == 0) {
ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
@@ -421,6 +436,18 @@
return ngx_http_add_prefix_variable(cf, name, flags);
}

+ if (flags & NGX_HTTP_VAR_CHANGEABLE) {
+ for (p = ngx_http_protect_variables_prefix; p->len; p++) {
+ if (name->len >= p.len
+ && ngx_strncasecmp(name->data, p->data, p->len) == 0)
+ {
+ ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+ "similar to prefix variable \"%V\"",
*p);
+ return NULL;
+ }
+ }
+ }
+
cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);

key = cmcf->variables_keys->keys.elts;
_______________________________________________
nginx-devel mailing list
nginx-devel@nginx.org
http://mailman.nginx.org/mailman/listinfo/nginx-devel