Permalink
Browse files

bugfix: buffer error would happen when the "args" option table to ngx…

….location.capture (and ngx.exec) contained a multi-value argument whose key also required uri escaping. thanks Matthieu Tourne for reporting this.
  • Loading branch information...
agentzh committed Jul 26, 2012
1 parent 0f62a62 commit d1cfc94c86185bfaf1f8afa5ae3d35d038240437
Showing with 40 additions and 7 deletions.
  1. +15 −6 src/ngx_http_lua_util.c
  2. +25 −1 t/020-subrequest.t
View
@@ -1864,6 +1864,7 @@ ngx_http_lua_process_args_option(ngx_http_request_t *r, lua_State *L,
u_char *value;
size_t value_len;
size_t len = 0;
+ size_t key_escape = 0;
uintptr_t total_escape = 0;
int n;
int i;
@@ -1883,8 +1884,10 @@ ngx_http_lua_process_args_option(ngx_http_request_t *r, lua_State *L,
}
key = (u_char *) lua_tolstring(L, -2, &key_len);
- total_escape += 2 * ngx_http_lua_escape_uri(NULL, key, key_len,
- NGX_ESCAPE_URI);
+
+ key_escape = 2 * ngx_http_lua_escape_uri(NULL, key, key_len,
+ NGX_ESCAPE_URI);
+ total_escape += key_escape;
switch (lua_type(L, -1)) {
case LUA_TNUMBER:
@@ -1909,9 +1912,9 @@ ngx_http_lua_process_args_option(ngx_http_request_t *r, lua_State *L,
case LUA_TTABLE:
+ i = 0;
lua_pushnil(L);
while (lua_next(L, -2) != 0) {
-
value = (u_char *) lua_tolstring(L, -1, &value_len);
if (value == NULL) {
@@ -1921,9 +1924,15 @@ ngx_http_lua_process_args_option(ngx_http_request_t *r, lua_State *L,
}
total_escape += 2 * ngx_http_lua_escape_uri(NULL, value,
- value_len, NGX_ESCAPE_URI);
+ value_len,
+ NGX_ESCAPE_URI);
+
len += key_len + value_len + (sizeof("=") - 1);
+ if (i++ > 0) {
+ total_escape += key_escape;
+ }
+
n++;
lua_pop(L, 1);
@@ -2026,7 +2035,7 @@ ngx_http_lua_process_args_option(ngx_http_request_t *r, lua_State *L,
if (total_escape) {
p = (u_char *) ngx_http_lua_escape_uri(p, key, key_len,
- NGX_ESCAPE_URI);
+ NGX_ESCAPE_URI);
} else {
dd("shortcut: no escape required");
@@ -2040,7 +2049,7 @@ ngx_http_lua_process_args_option(ngx_http_request_t *r, lua_State *L,
if (total_escape) {
p = (u_char *) ngx_http_lua_escape_uri(p, value, value_len,
- NGX_ESCAPE_URI);
+ NGX_ESCAPE_URI);
} else {
p = ngx_copy(p, value, value_len);
View
@@ -10,7 +10,7 @@ workers(1);
repeat_each(2);
-plan tests => repeat_each() * (blocks() * 2 + 8);
+plan tests => repeat_each() * (blocks() * 2 + 10);
$ENV{TEST_NGINX_MEMCACHED_PORT} ||= 11211;
@@ -454,6 +454,8 @@ fo%3d=%3d%3e
GET /lua
--- response_body_like chop
^(?:fo%3d=%3d%3e\&%3d=%3a|%3d=%3a\&fo%3d=%3d%3e)$
+--- no_error_log
+[error]
@@ -1045,3 +1047,25 @@ hello world
--- no_error_log
[error]
+
+
+=== TEST 40: encode args table with a multi-value arg.
+--- config
+ location /t {
+ content_by_lua '
+ local args = ngx.req.get_uri_args()
+ local res = ngx.location.capture("/sub", { args = args })
+ ngx.print(res.body)
+ ';
+ }
+
+ location /sub {
+ echo $query_string;
+ }
+--- request
+GET /t?r[]=http%3A%2F%2Fajax.googleapis.com%3A80%2Fajax%2Flibs%2Fjquery%2F1.7.2%2Fjquery.min.js&r[]=http%3A%2F%2Fajax.googleapis.com%3A80%2Fajax%2Flibs%2Fdojo%2F1.7.2%2Fdojo%2Fdojo.js.uncompressed.js
+--- response_body
+r%5b%5d=http%3a%2f%2fajax.googleapis.com%3a80%2fajax%2flibs%2fjquery%2f1.7.2%2fjquery.min.js&r%5b%5d=http%3a%2f%2fajax.googleapis.com%3a80%2fajax%2flibs%2fdojo%2f1.7.2%2fdojo%2fdojo.js.uncompressed.js
+--- no_error_log
+[error]
+

0 comments on commit d1cfc94

Please sign in to comment.