Re: MP1 Security issue (was Re: [mp1] PerlRun fails if path_info contains special symbols)

[Geoffrey Young <suppressed>]

> I was able to reproduce this in mp1.
> 
> for the interested, a fix has been put in place in svn for mod_perl 1.0,
> which you can grab from here:
> 
>   https://svn.apache.org/repos/asf/perl/modperl/branches/1.x/
> 
> furthermore, as michael pointed out, the problem is isolated to
> Apache::PerlRun - Apache::Registry has had a similar fix in it since
> mid-2000 and Apache::RegistryNG is filename based, not url based.

as for mp2, nothing in the current distribution is affected -
ModPerl::Registry and ModPerl::PerlRun are both filesystem based and not
uri based.  however, if you use RegistryCooker to roll your own
non-standard Registry handler and are using the non-standard uri-based
methods then you will want to examine your code.

--Geoff