Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Buffer overflow in WFS xsi:schemaLocation #4413

Closed
josefbicik opened this issue Aug 3, 2012 · 11 comments
Closed

Buffer overflow in WFS xsi:schemaLocation #4413

josefbicik opened this issue Aug 3, 2012 · 11 comments
Assignees
@tbonfort
Milestone
6.2 release

Comments

@josefbicik
Copy link

There seems to be a buffer-overflow bug in WFS server response in the xsi:schemaLocation section when the URL defined in "ows_service_onlineresource" is HTTPS with a non-standard port (e.g., "https://127.0.0.1:8443/test-wms?"). This affects Mapserver 6.0.3 and also 6.2beta2. The buffer overflow results in the generation of an invalid XML response that cannot be parsed by the client. See part of the XML response below (strange characters after https://127.0.0.1:8443/test-wms?):

<?xml version='1.0' encoding="ISO-8859-1" ?>
<wfs:FeatureCollection
   xmlns:ms="http://mapserver.gis.umn.edu/mapserver"
   xmlns:gml="http://www.opengis.net/gml"
   xmlns:wfs="http://www.opengis.net/wfs"
   xmlns:ogc="http://www.opengis.net/ogc"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://mapserver.gis.umn.edu/mapserver https://127.0.0.1:8443/test-wms?-â­SERVICE=WFS&amp;VERSION=1.1.0&amp;REQUEST=DescribeFeatureType&amp;TYPENAME=ms:cities&amp;OUTPUTFORMAT=text/xml;%20subtype=gml/3.1.1  http://www.opengis.net/wfs http://schemas.opengis.net/wfs/1.1.0/wfs.xsd">
      <gml:boundedBy>
              <gml:Envelope srsName="EPSG:3857">
                      <gml:lowerCorner>-64.318558 -24.711018</gml:lowerCorner>
                      <gml:upperCorner>-60.597546 -23.138828</gml:upperCorner>
              </gml:Envelope>
      </gml:boundedBy>

My mapfile is:

MAP
    NAME "sample"
    STATUS ON
    SIZE 600 400
    EXTENT -180.0000 -90.0000 180.0000 90.0000
    IMAGECOLOR 200 200 255

  CONFIG "MS_ERRORFILE" "mserror.log"
  CONFIG "PROJ_DEBUG" "ON"
  DEBUG 5
  WEB  
    METADATA
      "ows_enable_request" "*"
      "ows_service_onlineresource" "https://127.0.0.1:8443/test-wms?"
      "ows_title" "GIS"
      "ows_abstract" ""
      "ows_srs" "EPSG:3857 EPSG:4326"
    END
  END

  PROJECTION  
    "init=epsg:4326"
  END

  SYMBOL
    NAME "circle"
    TYPE ellipse
    FILLED true
    POINTS
      1 1
    END
  END

  LAYER
    NAME cities
    TYPE POINT
    STATUS OFF
    DATA citypoints.shp

          METADATA
      ows_title "cities"
      ows_abstract "World cities"
      ows_featureid "NAME"
      "gml_include_items" "all" ## Optional (serves all attributes for layer)  

          END

    CLASS
      STYLE
        COLOR 255 0 0
        OUTLINECOLOR 50 50 50
        SYMBOL "circle"
        SIZE 5
      END
    END

    PROJECTION  
      "init=epsg:4326"
    END

  END # LAYER
END # MAP

And the POST request looks like:

<wfs:GetFeature xmlns:wfs="http://www.opengis.net/wfs" service="WFS" version="1.1.0" maxFeatures="5" xsi:schemaLocation="http://www.opengis.net/wfs http://schemas.opengis.net/wfs/1.1.0/wfs.xsd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"><wfs:Query typeName="ms:cities" srsName="EPSG:4326"><ogc:Filter xmlns:ogc="http://www.opengis.net/ogc"><ogc:BBOX><ogc:PropertyName>msGeometry</ogc:PropertyName><gml:Envelope xmlns:gml="http://www.opengis.net/gml" srsName="EPSG:3857"><gml:lowerCorner>-148950696.7618 -61443140.808204</gml:lowerCorner><gml:upperCorner>148950696.7618 61443140.808204</gml:upperCorner></gml:Envelope></ogc:BBOX></ogc:Filter></wfs:Query></wfs:GetFeature>
@ghost ghost assigned tbonfort Aug 6, 2012
@tbonfort
Copy link
Member

tbonfort commented Aug 6, 2012

what query string are you using, I'm not managing to reproduce this

@tbonfort
Copy link
Member

tbonfort commented Aug 6, 2012

I'm suspecting the mapfile you provided isn't exactly the one where you're getting this issue. When running with your mapfile, I get


<ows:ExceptionReport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ows="http://www.opengis.net/ows" version="1.1.0" language="en-US" xsi:schemaLocation="http://www.opengis.net/ows http://schemas.opengis.net/ows/1.0.0/owsExceptionReport.xsd">
  <ows:Exception exceptionCode="NoApplicableCode" locator="mapserv">
    <ows:ExceptionText>msWFSGetFeature(): WFS server error. Server URL not found
msOWSGetOnlineResource(): CGI error. Impossible to establish server URL.  Please set "onlineresource" metadata.
msBuildOnlineResource(): CGI error. Impossible to establish server URL.</ows:ExceptionText>
  </ows:Exception>
</ows:ExceptionReport>

@josefbicik
Copy link
Author

Hi Tom, Thank you for looking into this. I might have removed some layers from the mapfile but apart from that I did not modify it. The mapfile seems to work fine on my system. I should have mentioned that my environment is:

OS: Microsoft Windows 7 64-bit Enterprise
Web server: Apache 2.2.22
Mapserver: MapServer version 6.0.3 (MS4W 3.0.6) run in FastCGI mode using mod_fcgid 2.3.7

I pass the mapfile path to Mapserver via an environment variable using the following directive:

SetEnvIf Request_URI "/test-wms" MS_MAPFILE=/GIS/apps/demo-map/world.map

The datasets used by the map are:

http://www.naturalearthdata.com/http//www.naturalearthdata.com/download/110m/cultural/110m-admin-0-countries.zip
Renamed to world.*

http://www.naturalearthdata.com/http//www.naturalearthdata.com/download/110m/cultural/110m-populated-places.zip
Renamed to CityPoints.*

To facilitate the debugging I have translated the HTTP POST request to an equivalent GET request.

https://127.0.0.1:8443/test-wms?SERVICE=WFS&VERSION=1.1.0&REQUEST=GetFeature&TYPENAME=ms:cities&srsName=EPSG:3857&BBOX=-66022024.547326,-20976766.5426,66022024.547326,20976766.5426

The error is a little bit random and does not always result in an invalid XML file. I have taken a screenshot of a GET request that failed (http://i.imgur.com/TgGif.png).

The entire (unmodified) mapfile is:

MAP
    NAME "sample"
    STATUS ON
    SIZE 600 400
    EXTENT -180.0000 -90.0000 180.0000 90.0000 
    IMAGECOLOR 200 200 255

  CONFIG "MS_ERRORFILE" "mserror.log"
  CONFIG "PROJ_DEBUG" "ON"
  DEBUG 5
  MAXSIZE 4096

  WEB  
    METADATA
      "ows_enable_request" "*"
      "ows_service_onlineresource" "https://127.0.0.1:8443/test-wms?"
      "ows_title" "GIS Server"
      "ows_abstract" ""     
      "ows_srs" "EPSG:3857 EPSG:4326 EPSG:900913"
    END
  END

  PROJECTION  
    "init=epsg:4326"
  END

  SYMBOL
    NAME "circle"
    TYPE ellipse
    FILLED true
    POINTS
      1 1
    END
  END

  LAYER
    NAME world
    TYPE POLYGON
    STATUS OFF
    DATA world.shp

    METADATA
      "ows_title" "world"
      "ows_abstract" "World map"
      "ows_featureid" "NAME"
      "gml_include_items" "all" ## Optional (serves all attributes for layer)
      'gml_types' 'auto'
    END

    CLASS
      STYLE
        COLOR 255 255 255
        OUTLINECOLOR 0 0 0
      END
    END

    PROJECTION  
      "init=epsg:4326"
    END

  END # LAYER

  LAYER
    NAME cities
    TYPE POINT
    STATUS OFF
    DATA citypoints.shp
    DEBUG 5

      METADATA
      ows_title "cities"
      ows_abstract "World cities"
      ows_featureid "NAME"
      "gml_include_items" "all" ## Optional (serves all attributes for layer)  

      END

    CLASS
      STYLE
        COLOR 255 0 0
        OUTLINECOLOR 50 50 50
        SYMBOL "circle"
        SIZE 5
      END
    END

    PROJECTION  
      "init=epsg:4326"
    END

  END # LAYER

END # MAP

@josefbicik
Copy link
Author

Tom, your comment about the missing "onlineresource" metadata brought me to an idea to try to add the "wfs_onlineresource" "https://127.0.0.1:8443/test-wms?" URL to my mapfile (i.e., instead of relying only on the "ows_service_onlineresource" URL). When "wfs_onlineresource" is defined than this bug does not happen. So, it seems that this bug might have something to do with a scenario when Mapserver tries to automatically detect the "onlineresource" URL as described here: http://mapserver.org/ogc/wfs_server.html in the "Configuring your MapFile to Serve WFS layers". Hope this helps to narrow down the issue.

@tbonfort
Copy link
Member

tbonfort commented Aug 7, 2012

@josefbicik I still cannot reproduce your issue. Which version are you testing this on? Using your unmodified mapfile you updated, I'm getting:

Content-type: text/xml; subtype=gml/3.1.1

Content-type: text/xml

<?xml version="1.0" encoding="ISO-8859-1"?>
<ows:ExceptionReport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ows="http://www.opengis.net/ows" version="1.1.0" language="en-US" xsi:schemaLocation="http://www.opengis.net/ows http://schemas.opengis.net/ows/1.0.0/owsExceptionReport.xsd">
  <ows:Exception exceptionCode="NoApplicableCode" locator="mapserv">
    <ows:ExceptionText>msWFSGetFeature(): WFS server error. Server URL not found
msOWSGetOnlineResource(): CGI error. Impossible to establish server URL.  Please set "onlineresource" metadata.
msBuildOnlineResource(): CGI error. Impossible to establish server URL.</ows:ExceptionText>
  </ows:Exception>
</ows:ExceptionReport>
      <gml:boundedBy>
        <gml:Envelope srsName="EPSG:3857">
            <gml:lowerCorner>-8347350.686799 -3780909.432059</gml:lowerCorner>
            <gml:upperCorner>14879785.669797 7605957.955411</gml:upperCorner>
        </gml:Envelope>
      </gml:boundedBy>
    <gml:featureMember>
      <ms:cities gml:id="cities.JONISKIS">
        <gml:boundedBy>
            <gml:Envelope srsName="EPSG:3857">
                <gml:lowerCorner>2629406.595400 7605957.955411</gml:lowerCorner>
                <gml:upperCorner>2629406.595400 7605957.955411</gml:upperCorner>
            </gml:Envelope>
        </gml:boundedBy>
        <ms:msGeometry>
          <gml:Point srsName="EPSG:3857">
            <gml:pos>2629406.595400 7605957.955411</gml:pos>
          </gml:Point>
        </ms:msGeometry>
        <ms:NAME>JONISKIS</ms:NAME>
      </ms:cities>
    </gml:featureMember>
[... snip ...]
</wfs:FeatureCollection>

i.e. the corrupt block does not show up at all ...

tbonfort added a commit that referenced this issue Aug 7, 2012
@tbonfort
return exception only on failed wfs getfeature preamble
75ec1d1 
related to #4413
@tbonfort
Copy link
Member

tbonfort commented Aug 7, 2012

with the previous fix, I'm now getting:

Content-type: text/xml; subtype=gml/3.1.1

Content-type: text/xml

<?xml version="1.0" encoding="ISO-8859-1"?>
<ows:ExceptionReport xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:ows="http://www.opengis.net/ows" version="1.1.0" language="en-US" xsi:schemaLocation="http://www.opengis.net/ows http://schemas.opengis.net/ows/1.0.0/owsExceptionReport.xsd">
  <ows:Exception exceptionCode="NoApplicableCode" locator="mapserv">
    <ows:ExceptionText>msWFSGetFeature(): WFS server error. Server URL not found
msOWSGetOnlineResource(): CGI error. Impossible to establish server URL.  Please set "onlineresource" metadata.
msBuildOnlineResource(): CGI error. Impossible to establish server URL.</ows:ExceptionText>
  </ows:Exception>
</ows:ExceptionReport>

i.e., still nothing ....

@tbonfort
Copy link
Member

tbonfort commented Aug 7, 2012

OK, I was running from the command line, and was missing a few env vars to get this running. I'm now getting:

Content-type: text/xml; subtype=gml/3.1.1

<?xml version='1.0' encoding="ISO-8859-1" ?>
<wfs:FeatureCollection
   xmlns:ms="http://mapserver.gis.umn.edu/mapserver"
   xmlns:gml="http://www.opengis.net/gml"
   xmlns:wfs="http://www.opengis.net/wfs"
   xmlns:ogc="http://www.opengis.net/ogc"
   xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://mapserver.gis.umn.edu/mapserver https://localhost:8443/mapserv?map=test2.mapSERVICE=WFS&amp;VERSION=1.1.0&amp;REQUEST=DescribeFeatureType&amp;TYPENAME=ms:cities&amp;OUTPUTFORMAT=text/xml;%20subtype=gml/3.1.1  http://www.opengis.net/wfs http://schemas.opengis.net/wfs/1.1.0/wfs.xsd">
[...snip...]

Note that the URL is built from the ows_onlineresource metadata key, and not the ows_service_onlineresource. If ows_onlineresource is not set, then it is built using the env vars set by the webserver.

@josefbicik
Copy link
Author

Hi Tom, this is the version of Mapserver I used for this test.

MapServer version 6.0.3 (MS4W 3.0.6) OUTPUT=GIF OUTPUT=PNG OUTPUT=JPEG OUTPUT=KM
L SUPPORTS=PROJ SUPPORTS=AGG SUPPORTS=CAIRO SUPPORTS=FREETYPE SUPPORTS=ICONV SUP
PORTS=FRIBIDI SUPPORTS=WMS_SERVER SUPPORTS=WMS_CLIENT SUPPORTS=WFS_SERVER SUPPOR
TS=WFS_CLIENT SUPPORTS=WCS_SERVER SUPPORTS=SOS_SERVER SUPPORTS=FASTCGI SUPPORTS=
THREADS SUPPORTS=GEOS INPUT=JPEG INPUT=POSTGIS INPUT=OGR INPUT=GDAL INPUT=SHAPEF
ILE

and also:

MapServer version 6.2.0-beta2 OUTPUT=GIF OUTPUT=PNG OUTPUT=JPEG OUTPUT=KML SUPPO
RTS=PROJ SUPPORTS=GD SUPPORTS=AGG SUPPORTS=FREETYPE SUPPORTS=CAIRO SUPPORTS=ICON
V SUPPORTS=FRIBIDI SUPPORTS=WMS_SERVER SUPPORTS=WMS_CLIENT SUPPORTS=WFS_SERVER S
UPPORTS=WFS_CLIENT SUPPORTS=WCS_SERVER SUPPORTS=SOS_SERVER SUPPORTS=FASTCGI SUPP
ORTS=THREADS SUPPORTS=GEOS INPUT=JPEG INPUT=POSTGIS INPUT=OGR INPUT=GDAL INPUT=S
HAPEFILE

@josefbicik
Copy link
Author

You are right that the "ows_onlineresource" was missing in the mapfile. Nevertheless, even the xsi:Schema you posted does not seem to be entirely correct since there is an "&" entity missing there between map and SERVICE ("...test2.mapSERVICE..."). I still think that there is a bug in the code that determines the "ows_onlineresource" URL from the server when it is not defined in the mapfile.

tbonfort added a commit that referenced this issue Aug 7, 2012
@tbonfort
fix buffer size for onlineressource with https and non-standard port (#…
bad0ca4 
…4413)
@tbonfort
Copy link
Member

tbonfort commented Aug 7, 2012

@josefbicik can you confirm this commit fixes your issue ?

@josefbicik
Copy link
Author

Thank you for fixing the problem! I can confirm that the issue with invalid characters in the URL no longer occurrs after applying your fix to 6.2-beta2. As you suggested the correct approach is to specify the "ows_onlineresource" URL in the mapfile.

mkofahl pushed a commit to faegi/mapserver that referenced this issue Apr 9, 2013
@tbonfort
return exception only on failed wfs getfeature preamble
4b39b37 
related to MapServer#4413
mkofahl pushed a commit to faegi/mapserver that referenced this issue Apr 9, 2013
@tbonfort
fix buffer size for onlineressource with https and non-standard port (M…
0df95cf 
…apServer#4413)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@tbonfort tbonfort

Labels
None yet
Projects
None yet
Milestone
6.2 release
Development

No branches or pull requests
2 participants
@tbonfort @josefbicik