Skip to content

Found vulnerability in ngx_http_push_stream_complex_value #314

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Found vulnerability in ngx_http_push_stream_complex_value #314

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
08fac49
First patch version, not tested yet
StepanGulyaev Mar 17, 2025
1c34628
Little fix
StepanGulyaev Mar 17, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion include/ngx_http_push_stream_module_utils.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -259,7 +259,7 @@ static ngx_int_t ngx_http_push_stream_memory_cleanup(void);

ngx_chain_t * ngx_http_push_stream_get_buf(ngx_http_request_t *r);
static void ngx_http_push_stream_unescape_uri(ngx_str_t *value);
static void ngx_http_push_stream_complex_value(ngx_http_request_t *r, ngx_http_complex_value_t *val, ngx_str_t *value);
static ngx_int_t ngx_http_push_stream_complex_value(ngx_http_request_t *r, ngx_http_complex_value_t *val, ngx_str_t *value);


ngx_int_t ngx_http_push_stream_add_msg_to_channel(ngx_http_push_stream_main_conf_t *mcf, ngx_log_t *log, ngx_http_push_stream_channel_t *channel, u_char *text, size_t len, ngx_str_t *event_id, ngx_str_t *event_type, ngx_flag_t store_messages, ngx_pool_t *temp_pool);
Expand Down
6 changes: 5 additions & 1 deletion src/ngx_http_push_stream_module_publisher.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,11 @@ ngx_http_push_stream_publisher_handler(ngx_http_request_t *r)


if (cf->allowed_origins != NULL) {
ngx_http_push_stream_complex_value(r, cf->allowed_origins, &vv_allowed_origins);
if (ngx_http_push_stream_complex_value(r, cf->allowed_origins, &vv_allowed_origins) != NGX_OK)
{
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "push stream module: failed to push complex value cf->allowed_origin");
return NGX_ERROR;
}
}

if (vv_allowed_origins.len > 0) {
Expand Down
6 changes: 5 additions & 1 deletion src/ngx_http_push_stream_module_subscriber.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -651,7 +651,11 @@ ngx_http_push_stream_get_padding_by_user_agent(ngx_http_request_t *r)
ngx_str_t vv_user_agent = ngx_null_string;

if (cf->user_agent != NULL) {
ngx_http_push_stream_complex_value(r, cf->user_agent, &vv_user_agent);
if (ngx_http_push_stream_complex_value(r, cf->user_agent, &vv_user_agent) != NGX_OK)
{
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "push stream module: failed to push complex value cf->user_agent");
return NULL;
}
} else if (r->headers_in.user_agent != NULL) {
vv_user_agent = r->headers_in.user_agent->value;
}
Expand Down
49 changes: 36 additions & 13 deletions src/ngx_http_push_stream_module_utils.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1857,14 +1857,23 @@ ngx_http_push_stream_get_last_received_message_values(ngx_http_request_t *r, tim
ngx_str_t vv_event_id = ngx_null_string, vv_time = ngx_null_string;

if (cf->last_received_message_time != NULL) {
ngx_http_push_stream_complex_value(r, cf->last_received_message_time, &vv_time);
if (ngx_http_push_stream_complex_value(r, cf->last_received_message_time, &vv_time) != NGX_OK)
{
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "push stream module: failed to push stream complex value cf->last_receieved_message_time");
}
} else if (r->headers_in.if_modified_since != NULL) {
vv_time = r->headers_in.if_modified_since->value;
}

if (cf->last_received_message_tag != NULL) {
ngx_http_push_stream_complex_value(r, cf->last_received_message_tag, &vv_etag);
etag = vv_etag.len ? &vv_etag : NULL;
if (ngx_http_push_stream_complex_value(r, cf->last_received_message_tag, &vv_etag) != NGX_OK)
{
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "push stream module: failed to push stream complex value cf->last_receieved_message_tag");
}
else
{
etag = vv_etag.len ? &vv_etag : NULL;
}
} else {
etag = ngx_http_push_stream_get_header(r, &NGX_HTTP_PUSH_STREAM_HEADER_IF_NONE_MATCH);
}
Expand All @@ -1875,12 +1884,17 @@ ngx_http_push_stream_get_last_received_message_values(ngx_http_request_t *r, tim
}

if (cf->last_event_id != NULL) {
ngx_http_push_stream_complex_value(r, cf->last_event_id, &vv_event_id);
if (vv_event_id.len) {
*last_event_id = ngx_http_push_stream_create_str(ctx->temp_pool, vv_event_id.len);
ngx_memcpy(((ngx_str_t *)*last_event_id)->data, vv_event_id.data, vv_event_id.len);
}
} else {
if (ngx_http_push_stream_complex_value(r, cf->last_event_id, &vv_event_id) == NGX_OK) {
if (vv_event_id.len) {
*last_event_id = ngx_http_push_stream_create_str(ctx->temp_pool, vv_event_id.len);
ngx_memcpy(((ngx_str_t *)*last_event_id)->data, vv_event_id.data, vv_event_id.len);
}
else {
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "push stream module: failed to push stream complex value cf->last_event_id");
}
}
}
else {
*last_event_id = ngx_http_push_stream_get_header(r, &NGX_HTTP_PUSH_STREAM_HEADER_LAST_EVENT_ID);
}

Expand Down Expand Up @@ -2116,11 +2130,15 @@ ngx_http_push_stream_parse_paddings(ngx_conf_t *cf, ngx_str_t *paddings_by_user
}


static void
static ngx_int_t
ngx_http_push_stream_complex_value(ngx_http_request_t *r, ngx_http_complex_value_t *val, ngx_str_t *value)
{
ngx_http_complex_value(r, val, value);
ngx_http_push_stream_unescape_uri(value);
if (ngx_http_complex_value(r, val, value) != NGX_OK)
{
return NGX_ERROR;
}
ngx_http_push_stream_unescape_uri(value);
return NGX_OK;
}


Expand Down Expand Up @@ -2299,7 +2317,12 @@ ngx_http_push_stream_parse_channels_ids_from_path(ngx_http_request_t *r, ngx_poo
int captures[15];
ngx_int_t n;

ngx_http_push_stream_complex_value(r, cf->channels_path, &vv_channels_path);
if (ngx_http_push_stream_complex_value(r, cf->channels_path, &vv_channels_path))
{
ngx_log_error(NGX_LOG_ERR, r->connection->log, 0, "push stream module: failed to push stream complex value cf->channels_path");
return NULL;
}

if (vv_channels_path.len == 0) {
return NULL;
}
Expand Down