Repository navigation
Conversation
APACHE_ARG_MAX rather than ENV_COUNT_MAX. (send_req): Fail with APR_ENOSPC for an environment larger than APACHE_ARG_MAX. * test/modules/generators/test_001_cgid.py (test_generators_001_08_env_count_large, test_generators_001_09_env_count_overflow): New tests. * test/modules/generators/htdocs/cgi/envcount.py: New script. * changes-entries/cgid-env-limit.txt: New entry. PR: 70270 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
+1, looks good to me. |
uri_len and args_len by limit_req_line rather than APR_PATH_MAX. Submitted by: Emmanuel Dreyfus <manu netbsd.org> Reviewed by: jorton PR: 70270
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
values by new ENV_VAL_MAX rather than APR_PATH_MAX. * test/modules/generators/test_001_cgid.py (test_generators_001_15_long_query): New test. * test/modules/generators/htdocs/cgi/arglen.py: New script. PR: 70270 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
Hello, Unfortunately, it is somewhat difficult to track down, as neither the PR nor the bug ticket mentions this error at all. In my view, however, it is highly relevant—for instance, it occurs when a cookie grows in size. Is there a reason why the new limit is As far as I understand, an individual cookie is limited to 4096 bytes, and Chromium allows 180 cookies. |
The length limit for each variable is fairly arbitrary and and needs to accommodate the longest possible URI path which is a config-time limit |
|
Isn't that too short? Shouldn't all the headers fit in as well? In Chrome, 180 x 4096 is possible for cookies. |
|
Does that get merged into a single header when passed to CGI? |
|
I have not tried 180 cookies. But multi cookies are merged into a single http cookie header. And every http header (cookie and other) is a env variable. That means all cookies must fit in a single variable. At the moment my application is not working with 2.4.69. I think it will work with your change. But I was not sure if this is big enough for the browser limits. |
Raise mod_cgid's limit on the number of environment variables passed to a script from the hardcoded 256 of
ENV_COUNT_MAXtoAPACHE_ARG_MAX(4096 on most platforms), fixing Bugzilla PR 70270. The limit is now also enforced on the sender side:send_req()fails withAPR_ENOSPCbefore writing anything to the daemon, so an oversized environment gets a clean 503 rather than a mid-protocol failure.Tested in
test/modules/generators: a 300-variable environment reaches the script intact (fails against trunk), and one over the limit is refused.🤖 Generated with Claude Code