Http: protect prefix variable when add variable

[Jim T]

Hello!

There is a incident occur in our team, when we use auth_request_set like
this in many server, and print $upstream_http_x_auth_request_email in log:

server {
    listen       8080 reuseport;
    server_name  test.io;
    location / {
        auth_request            /oauth2/auth;
        auth_request_set     $email $upstream_http_x_auth_request_email;
    }
}

But when we add a bad auth_request_set like below:
server {
    listen       8080 reuseport;
    server_name  test2.io;
    location / {
        auth_request            /oauth2/auth;
        auth_request_set      $upstream_http_x_auth_request_email $email;
    }
}

We will lost all $upstream_http_x_auth_request_email even the server
haven't use, because there is a new variable
$upstream_http_x_auth_request_email, and the prefix variable can't be read
any more.

So I think we can fix it like this, to avoid the wrong configuration:


# HG changeset patch
# User Jinhua Tan <312841925 at qq.com>
# Date 1611143620 -28800
#      Wed Jan 20 19:53:40 2021 +0800
# Node ID fd7e9432a59abcfcf380ddedb1e892098a54a845
# Parent  61d0df8fcc7c630da35e832ba8e983db0061a3be
Http: protect prefix variable when add variable

diff -r 61d0df8fcc7c -r fd7e9432a59a src/http/ngx_http_variables.c
--- a/src/http/ngx_http_variables.c Tue Jan 19 20:35:17 2021 +0300
+++ b/src/http/ngx_http_variables.c Wed Jan 20 19:53:40 2021 +0800
@@ -393,6 +393,20 @@
 };


+static ngx_str_t  ngx_http_protect_variables_prefix[] = {
+    ngx_string("arg_"),
+    ngx_string("http_"),
+    ngx_string("sent_http_"),
+    ngx_string("sent_trailer_"),
+    ngx_string("cookie_"),
+    ngx_string("arg_"),
+    ngx_string("upstream_http_"),
+    ngx_string("upstream_trailer_"),
+    ngx_string("upstream_cookie_"),
+    ngx_null_string
+};
+
+
 ngx_http_variable_value_t  ngx_http_variable_null_value =
     ngx_http_variable("");
 ngx_http_variable_value_t  ngx_http_variable_true_value =
@@ -410,6 +424,7 @@
     ngx_hash_key_t             *key;
     ngx_http_variable_t        *v;
     ngx_http_core_main_conf_t  *cmcf;
+    ngx_str_t                  *p;

     if (name->len == 0) {
         ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
@@ -421,6 +436,18 @@
         return ngx_http_add_prefix_variable(cf, name, flags);
     }

+    if (flags & NGX_HTTP_VAR_CHANGEABLE) {
+        for (p = ngx_http_protect_variables_prefix; p->len; p++) {
+            if (name->len >= p.len
+                && ngx_strncasecmp(name->data, p->data, p->len) == 0)
+            {
+                ngx_conf_log_error(NGX_LOG_EMERG, cf, 0,
+                                   "similar to prefix variable \"%V\"",
*p);
+                return NULL;
+            }
+        }
+    }
+
     cmcf = ngx_http_conf_get_module_main_conf(cf, ngx_http_core_module);

     key = cmcf->variables_keys->keys.elts;
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nginx.org/pipermail/nginx-devel/attachments/20210120/e1feda84/attachment.htm>