]> git.ipfire.org Git - thirdparty/apache/httpd.git/commitdiff
* Always trust content types that we set literally
authorRuediger Pluem <rpluem@apache.org>
Tue, 2 Jul 2024 06:35:53 +0000 (06:35 +0000)
committerRuediger Pluem <rpluem@apache.org>
Tue, 2 Jul 2024 06:35:53 +0000 (06:35 +0000)
git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1918814 13f79535-47bb-0310-9956-ffa450edef68

17 files changed:
modules/cluster/mod_heartmonitor.c
modules/dav/main/mod_dav.c
modules/dav/main/ms_wdv.c
modules/examples/mod_example_hooks.c
modules/filters/mod_crypto.c
modules/filters/mod_data.c
modules/filters/mod_include.c
modules/filters/mod_proxy_html.c
modules/generators/mod_cgi.c
modules/generators/mod_cgid.c
modules/generators/mod_info.c
modules/generators/mod_status.c
modules/http/http_filters.c
modules/http/http_protocol.c
modules/ldap/util_ldap.c
modules/mappers/mod_imagemap.c
modules/proxy/mod_proxy_balancer.c

index 53b650469d76189a0be1dec3b10219a67781dbbe..68db585181b8381e1fadc0cea91d1aec5db576f8 100644 (file)
@@ -782,7 +782,7 @@ static int hm_handler(request_rec *r)
     hmserver.seen = apr_time_now();
     hm_update_stat(ctx, &hmserver, r->pool);
 
-    ap_set_content_type(r, "text/plain");
+    ap_set_content_type_ex(r, "text/plain", 1);
     ap_set_content_length(r, 2);
     ap_rputs("OK", r);
     ap_rflush(r);
index 44b6d79f5bdbee820b63cecb1a99c5cc50607311..30f724ef781910c62023d6f25e57dcc1eb7881ca 100644 (file)
@@ -395,7 +395,7 @@ static int dav_error_response(request_rec *r, int status, const char *body)
     r->status = status;
     r->status_line = ap_get_status_line(status);
 
-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
 
     /* begin the response now... */
     ap_rvputs(r,
@@ -426,7 +426,7 @@ static int dav_error_response_tag(request_rec *r,
 {
     r->status = err->status;
 
-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
+    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
 
     ap_rputs(DAV_XML_HEADER DEBUG_CR
              "<D:error xmlns:D=\"DAV:\"", r);
@@ -584,7 +584,7 @@ DAV_DECLARE(void) dav_begin_multistatus(apr_bucket_brigade *bb,
 {
     /* Set the correct status and Content-Type */
     r->status = status;
-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
+    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
 
     /* Send the headers and actual multistatus response now... */
     ap_fputs(r->output_filters, bb, DAV_XML_HEADER DEBUG_CR
@@ -2086,7 +2086,7 @@ static int dav_method_options(request_rec *r)
 
     /* send the options response */
     r->status = HTTP_OK;
-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
+    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
 
     /* send the headers and response body */
     ap_rputs(DAV_XML_HEADER DEBUG_CR
@@ -3437,7 +3437,7 @@ static int dav_method_lock(request_rec *r)
     (*locks_hooks->close_lockdb)(lockdb);
 
     r->status = HTTP_OK;
-    ap_set_content_type(r, DAV_XML_CONTENT_TYPE);
+    ap_set_content_type_ex(r, DAV_XML_CONTENT_TYPE, 1);
 
     ap_rputs(DAV_XML_HEADER DEBUG_CR "<D:prop xmlns:D=\"DAV:\">" DEBUG_CR, r);
     if (lock == NULL)
index 3a5c5cc1822e405d03bc8df9d5da061392519897..ecb506d168ea3be820c019ecd6e2550d184bcc85 100644 (file)
@@ -572,7 +572,7 @@ static dav_error *mswdv_combined_propfind(request_rec *r)
     apr_brigade_printf(bb, NULL, NULL, "%016" APR_UINT64_T_HEX_FMT,
                        (apr_uint64_t)rr->finfo.size);
 
-    ap_set_content_type(r, "multipart/MSDAVEXTPrefixEncoded");
+    ap_set_content_type_ex(r, "multipart/MSDAVEXTPrefixEncoded", 1);
 
     ap_pass_brigade(r->output_filters, bb);
 
index ff458df99f4ae85ccc4b92b9dc87eed96950aa49..03ebb42e99290f590e9e92f7739a145fe2e68e19 100644 (file)
@@ -994,7 +994,7 @@ static int x_handler(request_rec *r)
      * Set the Content-type header. Note that we do not actually have to send
      * the headers: this is done by the http core.
      */
-    ap_set_content_type(r, "text/html");
+    ap_set_content_type_ex(r, "text/html", 1);
     /*
      * If we're only supposed to send header information (HEAD request), we're
      * already there.
index bd383e68085cd0eabdc4352e15de0068ea8506a1..9829c8b1b718e06765ad7bfe1bbb322a13f5a7c4 100644 (file)
@@ -1013,7 +1013,7 @@ static int crypto_handler(request_rec *r)
             return HTTP_INTERNAL_SERVER_ERROR;
         }
 
-        ap_set_content_type(r, "application/octet-stream");
+        ap_set_content_type_ex(r, "application/octet-stream", 1);
         ap_set_content_length(r, rec->k.secret.secretLen);
         ap_rwrite(rec->k.secret.secret, rec->k.secret.secretLen, r);
 
index ddadd1b360540a3966c30e8cdcf36cb011ef0669..4e6e63606caf5102b943ad976ad96e14bbf6e7be 100644 (file)
@@ -117,7 +117,7 @@ static apr_status_t data_out_filter(ap_filter_t *f, apr_bucket_brigade *bb)
             }
         }
 
-        ap_set_content_type(r, "text/plain");
+        ap_set_content_type_ex(r, "text/plain", 1);
 
     }
 
index 584d8fb311fa20ee490f1045c301dfc927ea1076..2c0cc67545cfc811bbeebfa329bb060c2c1f0ce9 100644 (file)
@@ -3972,7 +3972,7 @@ static int include_fixup(request_rec *r)
     if (r->handler && (strcmp(r->handler, "server-parsed") == 0))
     {
         if (!r->content_type || !*r->content_type) {
-            ap_set_content_type(r, "text/html");
+            ap_set_content_type_ex(r, "text/html", 1);
         }
         r->handler = "default-handler";
     }
index 685cb8be5740d19cdac4c254414c47aa6cbe7103..b423ca67bf2c2ad8d3be16a7be434d13b514dc53 100644 (file)
@@ -1009,7 +1009,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb)
                         ap_log_rerror(APLOG_MARK, APLOG_WARNING, 0, f->r, APLOGNO(01422)
                                       "No i18n support found.  Install mod_xml2enc if required");
                     enc = XML_CHAR_ENCODING_NONE;
-                    ap_set_content_type(f->r, "text/html;charset=utf-8");
+                    ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1);
                 }
                 else {
                     /* if we wanted a non-default charset_out, insert the
@@ -1025,7 +1025,7 @@ static apr_status_t proxy_html_filter(ap_filter_t *f, apr_bucket_brigade *bb)
                                                         cenc, NULL));
                     }
                     else /* Normal case, everything worked, utf-8 output */
-                        ap_set_content_type(f->r, "text/html;charset=utf-8");
+                        ap_set_content_type_ex(f->r, "text/html;charset=utf-8", 1);
                 }
 
                 ap_fputs(f->next, ctxt->bb, ctxt->cfg->doctype);
index 3799b06ce33b1aa19d9b3e99de83a1b2edff8ed7..61d888dd94665e09a5ee07d391779418f1e33ef1 100644 (file)
@@ -671,7 +671,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
     /* Force sub_req to be treated as a CGI request, even if ordinary
      * typing rules would have called it something else.
      */
-    ap_set_content_type(rr, CGI_MAGIC_TYPE);
+    ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1);
 
     /* Run it. */
     rr_status = ap_run_sub_req(rr);
index c3bee74809fc98138c5684597eef12c97723c8a6..b27dd802d8073022d51be7f8111cf5336273016d 100644 (file)
@@ -1671,7 +1671,7 @@ static apr_status_t include_cgi(include_ctx_t *ctx, ap_filter_t *f,
     /* Force sub_req to be treated as a CGI request, even if ordinary
      * typing rules would have called it something else.
      */
-    ap_set_content_type(rr, CGI_MAGIC_TYPE);
+    ap_set_content_type_ex(rr, CGI_MAGIC_TYPE, 1);
 
     /* Run it. */
     rr_status = ap_run_sub_req(rr);
index 3b5ae7a7259d2a2d51c5ef1770163d4b482d4233..758d37404a3567e39d36052b05f6fc78a5ef67a9 100644 (file)
@@ -784,7 +784,7 @@ static int display_info(request_rec * r)
         return DECLINED;
     }
 
-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
 
     ap_rputs(DOCTYPE_XHTML_1_0T
              "<html xmlns=\"http://www.w3.org/1999/xhtml\">\n"
index eda23298720540fc501570a70cd3180a07af764f..a2d23e280e0326b34c80aff29ab7ee8ae48bd90d 100644 (file)
@@ -273,7 +273,7 @@ static int status_handler(request_rec *r)
     if (r->method_number != M_GET)
         return DECLINED;
 
-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
 
     /*
      * Simple table-driven form data set parser that lets you alter the header
@@ -301,7 +301,7 @@ static int status_handler(request_rec *r)
                     no_table_report = 1;
                     break;
                 case STAT_OPT_AUTO:
-                    ap_set_content_type(r, "text/plain; charset=ISO-8859-1");
+                    ap_set_content_type_ex(r, "text/plain; charset=ISO-8859-1", 1);
                     short_report = 1;
                     break;
                 }
index daf66407e2af79f77bbb2f6cba32c43dd86ce33e..426fe2fcb979e210128cc6c54b652cde95d90c55 100644 (file)
@@ -1115,7 +1115,7 @@ AP_DECLARE_NONSTD(int) ap_send_http_trace(request_rec *r)
         }
     }
 
-    ap_set_content_type(r, "message/http");
+    ap_set_content_type_ex(r, "message/http", 1);
 
     /* Now we recreate the request, and echo it back */
 
index 701a7dd6bc3a7ce09edd36d2e383444ca00af786..6684f91b508b839aed5727451bc95c56c47f074c 100644 (file)
@@ -1276,10 +1276,10 @@ AP_DECLARE(void) ap_send_error_response(request_rec *r, int recursive_error)
             request_conf->suppress_charset = 1; /* avoid adding default
                                                  * charset later
                                                  */
-            ap_set_content_type(r, "text/html");
+            ap_set_content_type_ex(r, "text/html", 1);
         }
         else {
-            ap_set_content_type(r, "text/html; charset=iso-8859-1");
+            ap_set_content_type_ex(r, "text/html; charset=iso-8859-1", 1);
         }
 
         if ((status == HTTP_METHOD_NOT_ALLOWED)
index 52a12912b4dbd9d88296d1fbe58bfec771e1db02..1cfa10eee4841a91b4844cdb058be27e4ba401f2 100644 (file)
@@ -200,7 +200,7 @@ static int util_ldap_handler(request_rec *r)
     st = (util_ldap_state_t *) ap_get_module_config(r->server->module_config,
             &ldap_module);
 
-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
 
     if (r->header_only)
         return OK;
index e7d140ed4272a53cffc6bcde5b86038458d90158..9c3fafe746b963ee0dd4f5e4150057a9407e8e30 100644 (file)
@@ -475,7 +475,7 @@ static int imap_reply(request_rec *r, const char *redirect)
 
 static void menu_header(request_rec *r, char *menu)
 {
-    ap_set_content_type(r, "text/html; charset=ISO-8859-1");
+    ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
 
     ap_rvputs(r, DOCTYPE_HTML_4_01, "<html><head>\n<title>Menu for ",
               ap_escape_html(r->pool, r->uri),
index ea1b034d00e9546e27b0a9e17fc81511a5b84471..400b723ee9d646b87c0a30d2376e739da77f00c7 100644 (file)
@@ -1445,7 +1445,7 @@ static void balancer_display_page(request_rec *r, proxy_server_conf *conf,
 
     if (usexml) {
         char date[APR_RFC822_DATE_LEN];
-        ap_set_content_type(r, "text/xml");
+        ap_set_content_type_ex(r, "text/xml", 1);
         ap_rputs("<?xml version='1.0' encoding='UTF-8' ?>\n", r);
         ap_rputs("<httpd:manager xmlns:httpd='http://httpd.apache.org'>\n", r);
         ap_rputs("  <httpd:balancers>\n", r);
@@ -1618,7 +1618,7 @@ static void balancer_display_page(request_rec *r, proxy_server_conf *conf,
         ap_rputs("</httpd:manager>", r);
     }
     else {
-        ap_set_content_type(r, "text/html; charset=ISO-8859-1");
+        ap_set_content_type_ex(r, "text/html; charset=ISO-8859-1", 1);
         ap_rputs(DOCTYPE_HTML_4_01
                  "<html><head><title>Balancer Manager</title>\n", r);
         ap_rputs("<style type='text/css'>\n"