PHP - script filename may incorrectly contain query parameters #781
Description
If a query string contains something that looks like a pathinfo string, nginx unit will incorrectly attempt to load the wrong php file.
The issue is triggered when the string ".php" followed by a "/" is found in the query string.
Example: http://foo.bar/test.php?blah=test.php/foo
The following is a test case that triggers the issue in master. As far as I can tell, this bug exists back to at least 1.25.0.
from unit.applications.lang.php import TestApplicationPHP
from unit.option import option
class TestPHPParseConfusion(TestApplicationPHP):
prerequisites = {'modules': {'php': 'any'}}
def test_php_parse_confusion(self):
assert 'success' in self.conf(
{
"listeners": {"*:7080": {"pass": "routes"}},
"routes": [
{
"action": {"pass": "applications/targets/default"}
}
],
"applications": {
"targets": {
"type": self.get_application_type(),
"processes": {"spare": 0},
"targets": {
"default": {
"root": option.test_dir + "/php/targets/",
}
}
}
}
}
)
assert self.get(url='/1.php?test=test.php/')['body'] == '1'
Output:
E AssertionError: assert '<br />\n<b>W...0</b><br />\n' == '1'
E + 1
E - <br />
E - <b>Warning</b>: Unknown: Failed to open stream: No such file or directory in <b>Unknown</b> on line <b>0</b><br />
E - <br />
E - <b>Fatal error</b>: Failed opening required '/home/dward/unit/test/php/targets/1.php?test=test.php' (include_path='.:/usr/local/lib/php:/usr/local/share/php') in <b>Unknown</b> on line <b>0</b><br **/>**