Avoid post-rewrite URI to path mapping with alias

Previously, after a "rewrite" had changed the URI, and before a new
location was chosen, the new URI might not match the current location
prefix.  This becomes a problem when the location uses "alias", which
is why normally such inconsistency is detected by checking the
r->valid_location flag.  Meanwhile this flag only handles the
inconsistency when using the "break" directive or parameter.  However
in absence of those, there's still an inconsistency window from URI
change up until the end of the current set of rewrite directives.
URI to path mapping within this window might result in a buffer
overflow if location's prefix was longer than the rewritten URI.

The following example resulted in a buffer overflow with the request
"/foo/1":

location /foo/ {
    alias /bar/;
    rewrite ^/foo/.*$ /x;
    return 200 $request_filename;
}

Alternatively, $request_filename might be used in access log format,
"set", "if", "add_header", etc.

The fix is to reject URI mapping in ngx_http_map_uri_to_path() if the
r->uri_changed flag is set.

diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
index 380ee21b293165a35a9d39bc4d51b7812c0838aa..30ae6e0ec8e631fcbe5aee63e81f4917f585b77e 100644 (file)
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -1987,7 +1987,7 @@ ngx_http_map_uri_to_path(ngx_http_request_t *r, ngx_str_t *path,
 
     alias = clcf->alias;
 
-    if (alias && !r->valid_location) {
+    if (alias && (!r->valid_location || r->uri_changed)) {
         ngx_log_error(NGX_LOG_ALERT, r->connection->log, 0,
                       "\"alias\" cannot be used in location \"%V\" "
                       "where URI was rewritten", &clcf->name);