CGI script command line is broken in 2.0.40, the query string is *always* passed to all CGI scripts as the first argument, whether it contains '=' or not. I took a look and the patch I'm attaching to this report seems obviously correct to me (it's against CVS HEAD), but I haven't tested it. Please take a look ASAP, this prevents running eg. the W3C checklink, <http://validator.w3.org/checklink>. For more info, see the CGI spec at <http://cgi-spec.golux.com/draft-coar-cgi-v11-03-clean.html#5.0>.
Created attachment 3590 [details] CGI command line argument fix
This seems pretty obviously correct to me, but I'm not setup to test it at the moment.
The patch appears correct. As simple as it is to patch and move on, it seems like the sort of exception we should be looking for in the test suite. I'll see what we can do about that, since we aught to prove the old module wrong (from the perl-testsuite), apply the patch and confirm it solves the bug complete.
Ok, I tested this a bit further with 1.3.26 and 2.0.40 and made a perl CGI that can be used for testing (attaching it in a jiffy). The script contains test URLs, expected results and results for the two tested servers. 1.3.26 passed all tests, while 2.0.40 failed 3 of them; 2) and 6) supposedly because of the bug described here, and 9) since it doesn't seem to check if the query string after '?' is empty, but passes an empty string.
Created attachment 3622 [details] Perl CGI for testing CGI command line arguments
Fixes were just committed for mod_cgi and mod_cgid. Thanks for the mod_cgi fix and the testcase, and thanks for using Apache!