[httpd] XSS prevention did not work for hex-encoded URL's.

OTP-9655
Merge branch 'bmk/inets/httpd/xss_when_erl_encoded/r14/OTP-9655' into bmk/inets/inets572_integration

8 files changed, 126 insertions, 65 deletions

diff --git a/lib/inets/src/http_lib/http_uri.erl b/lib/inets/src/http_lib/http_uri.erl
index 44b9face0b..607475c359 100644
--- a/lib/inets/src/http_lib/http_uri.erl
+++ b/lib/inets/src/http_lib/http_uri.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %%
-%% Copyright Ericsson AB 2006-2010. All Rights Reserved.
+%% Copyright Ericsson AB 2006-2011. All Rights Reserved.
 %%
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -20,7 +20,9 @@
 
 -module(http_uri).
 
--export([parse/1, encode/1, decode/1]).
+-export([parse/1]).
+-export([encode/1, decode/1]).
+
 
 %%%=========================================================================
 %%%  API
@@ -42,20 +44,24 @@ encode(URI) ->
     Reserved = sets:from_list([$;, $:, $@, $&, $=, $+, $,, $/, $?,
 			       $#, $[, $], $<, $>, $\", ${, $}, $|,
 			       $\\, $', $^, $%, $ ]),
-    lists:append(lists:map(fun(Char) ->
-				   uri_encode(Char, Reserved)
-			   end, URI)).
-
-decode([$%,Hex1,Hex2|Rest]) ->
-    [hex2dec(Hex1)*16+hex2dec(Hex2)|decode(Rest)];
-decode([First|Rest]) ->
-    [First|decode(Rest)];
-decode([]) ->
+    %% lists:append(lists:map(fun(Char) -> uri_encode(Char, Reserved) end, URI)).
+    lists:append([uri_encode(Char, Reserved) || Char <- URI]).
+
+decode(String) ->
+    do_decode(String).
+
+do_decode([$%,Hex1,Hex2|Rest]) ->
+    [hex2dec(Hex1)*16+hex2dec(Hex2)|do_decode(Rest)];
+do_decode([First|Rest]) ->
+    [First|do_decode(Rest)];
+do_decode([]) ->
     [].
 
+
 %%%========================================================================
 %%% Internal functions
 %%%========================================================================
+
 parse_scheme(AbsURI) ->
     case split_uri(AbsURI, ":", {error, no_scheme}, 1, 1) of
 	{error, no_scheme} ->
diff --git a/lib/inets/src/http_lib/http_util.erl b/lib/inets/src/http_lib/http_util.erl
index 973600d7be..5b21170b78 100644
--- a/lib/inets/src/http_lib/http_util.erl
+++ b/lib/inets/src/http_lib/http_util.erl
@@ -206,9 +206,7 @@ timeout(Timeout, Started) ->
 
 html_encode(Chars) ->
     Reserved = sets:from_list([$&, $<, $>, $\", $', $/]),
-    lists:append(lists:map(fun(Char) ->
-	               char_to_html_entity(Char, Reserved)
-	           end, Chars)).
+    lists:append([char_to_html_entity(Char, Reserved) || Char <- Chars]).
 
 
 %%%========================================================================
diff --git a/lib/inets/src/http_server/httpd_file.erl b/lib/inets/src/http_server/httpd_file.erl
index e8a8ab6411..f2ba33099e 100644
--- a/lib/inets/src/http_server/httpd_file.erl
+++ b/lib/inets/src/http_server/httpd_file.erl
@@ -36,9 +36,9 @@ handle_error(emfile, Op, _ModData, Path) ->
     handle_error(500, Op, none, Path, ": Too many open files");
 handle_error({enfile,_}, Op, _ModData, Path) ->
     handle_error(500, Op, none, Path, ": File table overflow");
-handle_error(_Reason, Op, ModData, Path) ->
-    handle_error(404, Op, ModData, Path, ": File not found").
-
+handle_error(_Reason, Op, _ModData, Path) ->
+    handle_error(500, Op, none, Path, "").
+	    
 handle_error(StatusCode, Op, none, Path, Reason) ->
     {StatusCode, none, ?NICE("Can't " ++ Op ++ " " ++ Path ++ Reason)};
 handle_error(StatusCode, Op, ModData, Path, Reason) ->
diff --git a/lib/inets/src/http_server/httpd_request.erl b/lib/inets/src/http_server/httpd_request.erl
index a04bcc2778..5ba79b2706 100644
--- a/lib/inets/src/http_server/httpd_request.erl
+++ b/lib/inets/src/http_server/httpd_request.erl
@@ -309,12 +309,12 @@ validate_uri(RequestURI) ->
 		(catch http_uri:decode(string:left(RequestURI, Ndx)))
 	end,
     case UriNoQueryNoHex of
-	{'EXIT',_Reason} ->
+	{'EXIT', _Reason} ->
 	    {error, {bad_request, {malformed_syntax, RequestURI}}};
 	_ ->
 	    Path  = format_request_uri(UriNoQueryNoHex),
-	    Path2 = [X||X<-string:tokens(Path, "/\\"),X=/="."], 
-	    validate_path( Path2,0, RequestURI)
+	    Path2 = [X||X<-string:tokens(Path, "/"),X=/="."], %% OTP-5938
+	    validate_path(Path2, 0, RequestURI)
     end.
 
 validate_path([], _, _) ->
diff --git a/lib/inets/src/http_server/httpd_request_handler.erl b/lib/inets/src/http_server/httpd_request_handler.erl
index c3b47ce390..d2f22fce93 100644
--- a/lib/inets/src/http_server/httpd_request_handler.erl
+++ b/lib/inets/src/http_server/httpd_request_handler.erl
@@ -1,8 +1,8 @@
 %%
 %% %CopyrightBegin%
-%%
+%% 
 %% Copyright Ericsson AB 1997-2011. All Rights Reserved.
-%%
+%% 
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
 %% compliance with the License. You should have received a copy of the
@@ -355,7 +355,7 @@ handle_http_msg({Method, Uri, Version, {RecordHeaders, Headers}, Body},
 	    Reason = io_lib:format("Forbidden URI: ~p~n", [URI]),
 	    error_log(Reason, ModData),
 	    {stop, normal, State#state{response_sent = true}};
-	{error,{bad_request, {malformed_syntax, URI}}} ->
+	{error, {bad_request, {malformed_syntax, URI}}} ->
 	    ?hdrd("validation failed: bad request - malformed syntax", 
 		  [{uri, URI}]),
 	    httpd_response:send_status(ModData#mod{http_version = Version},
diff --git a/lib/inets/src/http_server/httpd_response.erl b/lib/inets/src/http_server/httpd_response.erl
index ea9cfbf4f2..1301f27081 100644
--- a/lib/inets/src/http_server/httpd_response.erl
+++ b/lib/inets/src/http_server/httpd_response.erl
@@ -1,7 +1,7 @@
 %%
 %% %CopyrightBegin%
 %% 
-%% Copyright Ericsson AB 1997-2009. All Rights Reserved.
+%% Copyright Ericsson AB 1997-2011. All Rights Reserved.
 %% 
 %% The contents of this file are subject to the Erlang Public License,
 %% Version 1.1, (the "License"); you may not use this file except in
@@ -100,12 +100,19 @@ send_status(#mod{socket_type = SocketType,
 		 socket      = Socket, 
 		 config_db   = ConfigDB} = ModData, StatusCode, PhraseArgs) ->
 
+    ?hdrd("send status", [{status_code, StatusCode}, 
+			  {phrase_args, PhraseArgs}]), 
+
     ReasonPhrase = httpd_util:reason_phrase(StatusCode),
     Message      = httpd_util:message(StatusCode, PhraseArgs, ConfigDB),
     Body         = get_body(ReasonPhrase, Message),
 
-    send_header(ModData, StatusCode, [{content_type, "text/html"},
-			    {content_length, integer_to_list(length(Body))}]),
+    ?hdrt("send status - header", [{reason_phrase, ReasonPhrase}, 
+     				   {message,       Message}]), 
+    send_header(ModData, StatusCode, 
+		[{content_type,   "text/html"},
+		 {content_length, integer_to_list(length(Body))}]),
+
     httpd_socket:deliver(SocketType, Socket, Body).
 
 
@@ -345,8 +352,9 @@ transform({Field, Value}) when is_list(Field) ->
 %% Leave this method and go on to the newer form of response
 %% OTP-4408
 %%----------------------------------------------------------------------
-send_response_old(#mod{method      = "HEAD"} = ModData,
+send_response_old(#mod{method = "HEAD"} = ModData,
 		  StatusCode, Response) ->
+
     NewResponse = lists:flatten(Response),
     
     case httpd_util:split(NewResponse, [?CR, ?LF, ?CR, ?LF],2) of
diff --git a/lib/inets/src/http_server/httpd_util.erl b/lib/inets/src/http_server/httpd_util.erl
index c051422529..b0b18b9c3d 100644
--- a/lib/inets/src/http_server/httpd_util.erl
+++ b/lib/inets/src/http_server/httpd_util.erl
@@ -178,11 +178,12 @@ message(301,URL,_) ->
     "The document has moved <A HREF=\""++ maybe_encode(URL) ++"\">here</A>.";
 message(304, _URL,_) ->
     "The document has not been changed.";
-message(400,none,_) ->
-    "Your browser sent a query that this server could not understand.";
-message(400,Msg,_) ->
-    "Your browser sent a query that this server could not understand. "++ http_util:html_encode(Msg);
-message(401,none,_) ->
+message(400, none, _) ->
+    "Your browser sent a query that this server could not understand. ";
+message(400, Msg, _) ->
+    "Your browser sent a query that this server could not understand. " ++ 
+	html_encode(Msg);
+message(401, none, _) ->
     "This server could not verify that you
 are authorized to access the document you
 	requested.  Either you supplied the wrong
@@ -190,40 +191,49 @@ credentials (e.g., bad password), or your
 browser doesn't understand how to supply
 the credentials required.";
 message(403,RequestURI,_) ->
-    "You don't have permission to access "++ http_util:html_encode(RequestURI) ++" on this server.";
+    "You don't have permission to access " ++ 
+	html_encode(RequestURI) ++ 
+	" on this server.";
 message(404,RequestURI,_) ->
-    "The requested URL " ++ http_util:html_encode(RequestURI) ++ " was not found on this server.";
+    "The requested URL " ++ 
+	html_encode(RequestURI) ++ 
+	" was not found on this server.";
 message(408, Timeout, _) ->
     Timeout;
 message(412,none,_) ->
     "The requested preconditions were false";
 message(413, Reason,_) ->
-    "Entity: " ++ http_util:html_encode(Reason);
+    "Entity: " ++ html_encode(Reason);
 message(414,ReasonPhrase,_) ->
-    "Message "++ http_util:html_encode(ReasonPhrase) ++".";
+    "Message " ++ html_encode(ReasonPhrase) ++ ".";
 message(416,ReasonPhrase,_) ->
-    http_util:html_encode(ReasonPhrase);
+    html_encode(ReasonPhrase);
 
 message(500,_,ConfigDB) ->
     ServerAdmin=lookup(ConfigDB,server_admin,"unknown@unknown"),
     "The server encountered an internal error or "
 	"misconfiguration and was unable to complete "
 	"your request.<P>Please contact the server administrator "
-	++ http_util:html_encode(ServerAdmin) ++ ", and inform them of the time the error occurred "
+	++ html_encode(ServerAdmin) ++ 
+	", and inform them of the time the error occurred "
 	"and anything you might have done that may have caused the error.";
 
 message(501,{Method, RequestURI, HTTPVersion}, _ConfigDB) ->
     if
 	is_atom(Method) ->
-        http_util:html_encode(atom_to_list(Method))++
-		" to "++ http_util:html_encode(RequestURI)++" ("++ http_util:html_encode(HTTPVersion)++") not supported.";
+	    atom_to_list(Method) ++
+		" to " ++ 
+		html_encode(RequestURI) ++ 
+		" (" ++ HTTPVersion ++ ") not supported.";
 	is_list(Method) ->
-	    http_util:html_encode(Method)++
-		" to "++ http_util:html_encode(RequestURI)++" ("++ http_util:html_encode(HTTPVersion)++") not supported."
+	    Method ++
+		" to " ++ 
+		html_encode(RequestURI) ++ 
+		" (" ++ HTTPVersion ++ ") not supported."
     end;
 
 message(503, String, _ConfigDB) ->
-    "This service in unavailable due to: "++ http_util:html_encode(String).
+    "This service in unavailable due to: " ++ html_encode(String).
 
 maybe_encode(URI) ->
     Decoded = try http_uri:decode(URI) of
@@ -233,6 +243,15 @@ maybe_encode(URI) ->
     end,
     http_uri:encode(Decoded).
 
+html_encode(String) ->
+    try http_uri:decode(String) of
+	Decoded when is_list(Decoded) ->
+	    http_util:html_encode(Decoded)
+    catch 
+	_:_ ->
+	    http_util:html_encode(String)
+    end.
+
 %%convert_rfc_date(Date)->{{YYYY,MM,DD},{HH,MIN,SEC}}
 
 convert_request_date([D,A,Y,DateType| Rest])->
@@ -245,7 +264,7 @@ convert_request_date([D,A,Y,DateType| Rest])->
 		 fun convert_rfc850_date/1
 	 end,
     case catch Func([D,A,Y,DateType| Rest]) of
-	{ok,Date} ->
+	{ok, Date} ->
 	    Date;
 	_Error->
 	    bad_date
diff --git a/lib/inets/src/inets_app/inets.appup.src b/lib/inets/src/inets_app/inets.appup.src
index d5fdf86a60..ede0c10bef 100644
--- a/lib/inets/src/inets_app/inets.appup.src
+++ b/lib/inets/src/inets_app/inets.appup.src
@@ -18,23 +18,38 @@
 
 {"%VSN%",
  [
+  {"5.7.1",
+   [
+    {load_module, http_uri,       soft_purge, soft_purge, []},
+    {load_module, http_util,      soft_purge, soft_purge, []},
+    {load_module, httpd_util,     soft_purge, soft_purge, [http_util]},
+    {load_module, httpd_file,     soft_purge, soft_purge, []}, 
+    {load_module, httpd_request,  soft_purge, soft_purge, []}
+   ]
+  }, 
   {"5.7", 
    [
-    {load_module, httpd_request, soft_purge, soft_purge, []}, 
-    {load_module, httpc_cookie, soft_purge, soft_purge, [http_util]}, 
-    {load_module, http_util, soft_purge, soft_purge, []}
+    {load_module, http_uri,       soft_purge, soft_purge, []},
+    {load_module, httpd_util,     soft_purge, soft_purge, [http_util]},
+    {load_module, httpd_file,     soft_purge, soft_purge, []}
+    {load_module, httpd_request,  soft_purge, soft_purge, []}, 
+    {load_module, httpc_cookie,   soft_purge, soft_purge, [http_util]}, 
+    {load_module, http_util,      soft_purge, soft_purge, []}
    ]
   }, 
   {"5.6", 
    [
-    {load_module, httpd_request, soft_purge, soft_purge, []}, 
-    {load_module, httpc, soft_purge, soft_purge, [httpc_manager]}, 
-    {load_module, http_transport, soft_purge, soft_purge, [http_transport]},
-    {load_module, httpc_cookie, soft_purge, soft_purge, [http_util]}, 
-    {load_module, http_util, soft_purge, soft_purge, []}, 
-    {update, httpc_handler, soft, soft_purge, soft_purge, []}, 
-    {update, httpc_manager, soft, soft_purge, soft_purge, [httpc_handler]}, 
-    {update, ftp, soft, soft_purge, soft_purge, []}
+    {load_module, http_uri,          soft_purge, soft_purge, []},
+    {load_module, httpd_util,        soft_purge, soft_purge, [http_util]},
+    {load_module, httpd_file,        soft_purge, soft_purge, []}
+    {load_module, httpd_request,     soft_purge, soft_purge, []}, 
+    {load_module, httpc,             soft_purge, soft_purge, [httpc_manager]}, 
+    {load_module, http_transport,    soft_purge, soft_purge, [http_transport]},
+    {load_module, httpc_cookie,      soft_purge, soft_purge, [http_util]}, 
+    {load_module, http_util,         soft_purge, soft_purge, []}, 
+    {update, httpc_handler, soft,    soft_purge, soft_purge, []}, 
+    {update, httpc_manager, soft,    soft_purge, soft_purge, [httpc_handler]}, 
+    {update, ftp, soft, soft_purge,  soft_purge, []}
    ]
   }, 
   {"5.5.2", 
@@ -59,22 +74,37 @@
   } 
  ],
  [
+  {"5.7.1",
+   [
+    {load_module, http_uri,       soft_purge, soft_purge, []},
+    {load_module, http_util,      soft_purge, soft_purge, []},
+    {load_module, httpd_util,     soft_purge, soft_purge, [http_util]},
+    {load_module, httpd_file,     soft_purge, soft_purge, []}, 
+    {load_module, httpd_request,  soft_purge, soft_purge, []}, 
+   ]
+  }, 
   {"5.7", 
    [
-    {load_module, httpd_request, soft_purge, soft_purge, []}, 
-    {load_module, httpc_cookie, soft_purge, soft_purge, [http_util]}, 
-    {load_module, http_util, soft_purge, soft_purge, []}
+    {load_module, http_uri,       soft_purge, soft_purge, []},
+    {load_module, httpd_util,     soft_purge, soft_purge, [http_util]},
+    {load_module, httpd_file,     soft_purge, soft_purge, []}
+    {load_module, httpd_request,  soft_purge, soft_purge, []}, 
+    {load_module, httpc_cookie,   soft_purge, soft_purge, [http_util]}, 
+    {load_module, http_util,      soft_purge, soft_purge, []}
    ]
   }, 
   {"5.6", 
    [
-    {load_module, httpd_request, soft_purge, soft_purge, []}, 
-    {load_module, httpc, soft_purge, soft_purge, [httpc_manager]}, 
-    {load_module, http_transport, soft_purge, soft_purge, [http_transport]},
-    {load_module, httpc_cookie, soft_purge, soft_purge, [http_util]}, 
-    {load_module, http_util, soft_purge, soft_purge, []}, 
-    {update, httpc_handler, soft, soft_purge, soft_purge, []}, 
-    {update, httpc_manager, soft, soft_purge, soft_purge, [httpc_handler]}, 
+    {load_module, http_uri,         soft_purge, soft_purge, []},
+    {load_module, httpd_util,       soft_purge, soft_purge, [http_util]},
+    {load_module, httpd_file,       soft_purge, soft_purge, []}
+    {load_module, httpd_request,    soft_purge, soft_purge, []}, 
+    {load_module, httpc,            soft_purge, soft_purge, [httpc_manager]}, 
+    {load_module, http_transport,   soft_purge, soft_purge, [http_transport]},
+    {load_module, httpc_cookie,     soft_purge, soft_purge, [http_util]}, 
+    {load_module, http_util,        soft_purge, soft_purge, []}, 
+    {update, httpc_handler, soft,   soft_purge, soft_purge, []}, 
+    {update, httpc_manager, soft,   soft_purge, soft_purge, [httpc_handler]}, 
     {update, ftp, soft, soft_purge, soft_purge, []}
    ]
   },