Bug 60624 - mod_include DOCUMENT_URI in "if" expression has different value than when echoed
Summary: mod_include DOCUMENT_URI in "if" expression has different value than when echoed
Alias: None
Product: Apache httpd-2
Classification: Unclassified
Component: mod_include (show other bugs)
Version: 2.4.25
Hardware: PC All
: P2 normal (vote)
Target Milestone: ---
Assignee: Apache HTTPD Bugs Mailing List
Keywords: FixedInTrunk, PatchAvailable
Depends on:
Reported: 2017-01-22 02:08 UTC by jan-bugreport
Modified: 2018-03-12 21:40 UTC (History)
1 user (show)

output (331 bytes, text/plain)
2017-01-22 02:08 UTC, jan-bugreport
main.shtml to reproduce (149 bytes, text/html)
2017-01-22 02:09 UTC, jan-bugreport
included.shtml to reproduce (343 bytes, text/html)
2017-01-22 02:10 UTC, jan-bugreport
Proposed patch (489 bytes, patch)
2017-01-23 15:13 UTC, Hank Ibell
Details | Diff
Proposed patch for 2.4.x (489 bytes, patch)
2017-01-23 15:15 UTC, Hank Ibell
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description jan-bugreport 2017-01-22 02:08:54 UTC
Created attachment 34657 [details]

When DOCUMENT_URI is echoed from inside an included file, it shows the path of the including file. However, when a regexp match is performed on DOCUMENT_URI within an if expression and the value is printed via a backreference, the printed value is the path of the included file.

This makes debugging sessions very interesting, and I suspect that most people simply enable the legacy syntax. As a result, I suspect the new syntax may not have been sufficiently tested.
Comment 1 jan-bugreport 2017-01-22 02:09:43 UTC
Created attachment 34658 [details]
main.shtml to reproduce
Comment 2 jan-bugreport 2017-01-22 02:10:04 UTC
Created attachment 34659 [details]
included.shtml to reproduce
Comment 3 Hank Ibell 2017-01-23 15:13:30 UTC
Created attachment 34665 [details]
Proposed patch

Proposed patch is to send the DOCUMENT_URI if found inside the subprocess environment of a request when evaluating request variables. Otherwise it just sends the request stored in the request's uri field.

I found DOCUMENT_URI is used in two modules: mod_includes and mod_ext_filter so preferring the DOCUMENT_URI if found in the subprocess environment over the uri field looks to be a safe change.
Comment 4 Hank Ibell 2017-01-23 15:15:35 UTC
Created attachment 34666 [details]
Proposed patch for 2.4.x

Proposed patch for 2.4.x
Comment 6 Christophe JAILLET 2018-03-12 21:40:02 UTC
This is part of apache 2.4.26, see r1788448