Re: MP1 Security issue (was Re: [mp1] PerlRun fails if path_info contains special symbols)

[Andy Armstrong <suppressed>]

On 23 Mar 2007, at 03:49, Fred Moyer wrote:
> Ok, help me out here Merlyn.  Will this fix it?

I assume it needs to be quoted like this:

     $path_info = quotemeta $path_info;
     my $script_name = $path_info && $self->{URI} =~ /$path_info$/


> suppressed ~/dev/modperl/mod_perl-2.0 $ svn diff ModPerl-Registry/ 
> lib/ModPerl/RegistryCooker.pm
> Index: ModPerl-Registry/lib/ModPerl/RegistryCooker.pm
> ===================================================================
> --- ModPerl-Registry/lib/ModPerl/RegistryCooker.pm      (revision  
> 508723)
> +++ ModPerl-Registry/lib/ModPerl/RegistryCooker.pm      (working copy)
> @@ -337,7 +337,7 @@
>      my $self = shift;
>
>      my $path_info = $self->{REQ}->path_info;
> -    my $script_name = $path_info && $self->{URI} =~ /$path_info$/
> +    my $script_name = $path_info && $self->{URI} =~ /\$path_info$/
>          ? substr($self->{URI}, 0, length($self->{URI}) - length 
> ($path_info))
>          : $self->{URI};

--
Andy Armstrong, hexten.net