Use SCRIPT_FILENAME in slowcgi

classic Classic list List threaded Threaded
7 messages Options
Reply | Threaded
Open this post in threaded view
|

Use SCRIPT_FILENAME in slowcgi

James Turner-5
The attached diff uses SCRIPT_FILENAME instead of SCRIPT_NAME to
determine the path of CGI scripts in slowcgi. It also updates the
example in nginx.conf.

According to CGI/1.1:
    "The SCRIPT_NAME variable MUST be set to a URL path (not URL-encoded)
     which could identify the CGI script (rather than the script's
     output).  The syntax is the same as for PATH_INFO (section 4.1.5)"

If you decided to run a CGI script outside of /cgi-bin/ SCRIPT_NAME no
longer matches the path of the CGI script as it is now local to the
document root.

You would need to set something like the following in nginx.conf to make
slowcgi be able to find the CGI script:

fastcgi_param  SCRIPT_NAME $document_root$fastcgi_script_name;

However this now violates the CGI/1.1 spec as SCRIPT_NAME is now an
absolute path to the file on disk.

By introducing SCRIPT_FILENAME much like PHP does we can then use:

fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;

when using CGI scripts outside of cgi-bin and SCRIPT_NAME still
functions as normal.

The /cgi-bin/ example doesn't need $document_root so your pretty much
setting SCRIPT_FILENAME = SCRIPT_NAME which seems redundant but once you
move outside of cgi-bin I believe this is the correct way to go.

--
James Turner

script_filename.diff (2K) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Use SCRIPT_FILENAME in slowcgi

James Turner-5
If we want to keep it simple we can just go this route.

On Sat, Mar 01, 2014 at 04:39:49PM -0500, James Turner wrote:

> The attached diff uses SCRIPT_FILENAME instead of SCRIPT_NAME to
> determine the path of CGI scripts in slowcgi. It also updates the
> example in nginx.conf.
>
> According to CGI/1.1:
>     "The SCRIPT_NAME variable MUST be set to a URL path (not URL-encoded)
>      which could identify the CGI script (rather than the script's
>      output).  The syntax is the same as for PATH_INFO (section 4.1.5)"
>
> If you decided to run a CGI script outside of /cgi-bin/ SCRIPT_NAME no
> longer matches the path of the CGI script as it is now local to the
> document root.
>
> You would need to set something like the following in nginx.conf to make
> slowcgi be able to find the CGI script:
>
> fastcgi_param  SCRIPT_NAME $document_root$fastcgi_script_name;
>
> However this now violates the CGI/1.1 spec as SCRIPT_NAME is now an
> absolute path to the file on disk.
>
> By introducing SCRIPT_FILENAME much like PHP does we can then use:
>
> fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
>
> when using CGI scripts outside of cgi-bin and SCRIPT_NAME still
> functions as normal.
>
> The /cgi-bin/ example doesn't need $document_root so your pretty much
> setting SCRIPT_FILENAME = SCRIPT_NAME which seems redundant but once you
> move outside of cgi-bin I believe this is the correct way to go.
>
> --
> James Turner

--
James Turner

script_filename2.diff (1K) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Use SCRIPT_FILENAME in slowcgi

Stuart Henderson-6
On 2014/03/07 18:04, James Turner wrote:

> If we want to keep it simple we can just go this route.
>
> On Sat, Mar 01, 2014 at 04:39:49PM -0500, James Turner wrote:
> > The attached diff uses SCRIPT_FILENAME instead of SCRIPT_NAME to
> > determine the path of CGI scripts in slowcgi. It also updates the
> > example in nginx.conf.
> >
> > According to CGI/1.1:
> >     "The SCRIPT_NAME variable MUST be set to a URL path (not URL-encoded)
> >      which could identify the CGI script (rather than the script's
> >      output).  The syntax is the same as for PATH_INFO (section 4.1.5)"
> >
> > If you decided to run a CGI script outside of /cgi-bin/ SCRIPT_NAME no
> > longer matches the path of the CGI script as it is now local to the
> > document root.
> >
> > You would need to set something like the following in nginx.conf to make
> > slowcgi be able to find the CGI script:
> >
> > fastcgi_param  SCRIPT_NAME $document_root$fastcgi_script_name;
> >
> > However this now violates the CGI/1.1 spec as SCRIPT_NAME is now an
> > absolute path to the file on disk.
> >
> > By introducing SCRIPT_FILENAME much like PHP does we can then use:
> >
> > fastcgi_param  SCRIPT_FILENAME $document_root$fastcgi_script_name;
> >
> > when using CGI scripts outside of cgi-bin and SCRIPT_NAME still
> > functions as normal.
> >
> > The /cgi-bin/ example doesn't need $document_root so your pretty much
> > setting SCRIPT_FILENAME = SCRIPT_NAME which seems redundant but once you
> > move outside of cgi-bin I believe this is the correct way to go.
> >
> > --
> > James Turner
>
>
> --
> James Turner

> Index: usr.sbin/slowcgi/slowcgi.c
> ===================================================================
> RCS file: /cvs/src/usr.sbin/slowcgi/slowcgi.c,v
> retrieving revision 1.27
> diff -u -p -u -p -r1.27 slowcgi.c
> --- usr.sbin/slowcgi/slowcgi.c 19 Jan 2014 00:01:05 -0000 1.27
> +++ usr.sbin/slowcgi/slowcgi.c 7 Mar 2014 23:02:43 -0000
> @@ -741,7 +741,7 @@ parse_params(uint8_t *buf, uint16_t n, s
>  
>   env_entry->val[name_len] = '\0';
>   if (val_len < MAXPATHLEN && strcmp(env_entry->val,
> -    "SCRIPT_NAME") == 0) {
> +    "SCRIPT_FILENAME") == 0) {
>   bcopy(buf, c->script_name, val_len);
>   c->script_name[val_len] = '\0';
>   }
> Index: usr.sbin/nginx/conf/nginx.conf
> ===================================================================
> RCS file: /cvs/src/usr.sbin/nginx/conf/nginx.conf,v
> retrieving revision 1.16
> diff -u -p -u -p -r1.16 nginx.conf
> --- usr.sbin/nginx/conf/nginx.conf 28 Jan 2014 14:48:53 -0000 1.16
> +++ usr.sbin/nginx/conf/nginx.conf 7 Mar 2014 23:02:43 -0000
> @@ -64,6 +64,7 @@ http {
>          #    fastcgi_pass   unix:run/slowcgi.sock;
>          #    fastcgi_split_path_info ^(/cgi-bin/[^/]+)(.*);
>          #    fastcgi_param  PATH_INFO $fastcgi_path_info;
> +        #    fastcgi_param  SCRIPT_FILENAME  $fastcgi_script_name;
>          #    include        fastcgi_params;
>          #}
>  

I've been umming and ahhing about this diff, the thing I don't like is
that SCRIPT_FILENAME is an Apache extension rather than part of the
standard CGI variables, which explains why it's not included by
default in nginx (or other servers that people might conceivably
want to use with slowcgi, such as lighttpd).

Still, I don't see a better way to handle this, and replacing Apache
is going to need to support cgis outside of /cgi-bin one way or another.
But I do think it should fallback to using SCRIPT_NAME if the
SCRIPT_FILENAME variable isn't present, so that standard fastcgi
servers can use it to some extent too.

Reply | Threaded
Open this post in threaded view
|

Re: Use SCRIPT_FILENAME in slowcgi

Stuart Henderson-6
On 2014/03/07 23:20, Stuart Henderson wrote:

> I've been umming and ahhing about this diff, the thing I don't like is
> that SCRIPT_FILENAME is an Apache extension rather than part of the
> standard CGI variables, which explains why it's not included by
> default in nginx (or other servers that people might conceivably
> want to use with slowcgi, such as lighttpd).
>
> Still, I don't see a better way to handle this, and replacing Apache
> is going to need to support cgis outside of /cgi-bin one way or another.
> But I do think it should fallback to using SCRIPT_NAME if the
> SCRIPT_FILENAME variable isn't present, so that standard fastcgi
> servers can use it to some extent too.
>

... also, the fastcgi_split_path_info in default config would need
adjusting for a cgi outside of cgi-bin. (I didn't notice this before
as I've had my own config block for this from before slowcgi existed
that I haven't merged in..).

Reply | Threaded
Open this post in threaded view
|

Re: Use SCRIPT_FILENAME in slowcgi

James Turner-5
In reply to this post by Stuart Henderson-6
On Fri, Mar 07, 2014 at 11:20:53PM +0000, Stuart Henderson wrote:

> I've been umming and ahhing about this diff, the thing I don't like is
> that SCRIPT_FILENAME is an Apache extension rather than part of the
> standard CGI variables, which explains why it's not included by
> default in nginx (or other servers that people might conceivably
> want to use with slowcgi, such as lighttpd).
>
> Still, I don't see a better way to handle this, and replacing Apache
> is going to need to support cgis outside of /cgi-bin one way or another.
> But I do think it should fallback to using SCRIPT_NAME if the
> SCRIPT_FILENAME variable isn't present, so that standard fastcgi
> servers can use it to some extent too.
>
Maybe something like this? Using SCRIPT_FILENAME if present but falling
back on SCRIPT_NAME.

--
James Turner

script_filename.diff (2K) Download Attachment
Reply | Threaded
Open this post in threaded view
|

Re: Use SCRIPT_FILENAME in slowcgi

Florian Obser-2
On Fri, Mar 07, 2014 at 10:35:37PM -0500, James Turner wrote:

> On Fri, Mar 07, 2014 at 11:20:53PM +0000, Stuart Henderson wrote:
> > I've been umming and ahhing about this diff, the thing I don't like is
> > that SCRIPT_FILENAME is an Apache extension rather than part of the
> > standard CGI variables, which explains why it's not included by
> > default in nginx (or other servers that people might conceivably
> > want to use with slowcgi, such as lighttpd).
> >
> > Still, I don't see a better way to handle this, and replacing Apache
> > is going to need to support cgis outside of /cgi-bin one way or another.
> > But I do think it should fallback to using SCRIPT_NAME if the
> > SCRIPT_FILENAME variable isn't present, so that standard fastcgi
> > servers can use it to some extent too.
> >
>
> Maybe something like this? Using SCRIPT_FILENAME if present but falling
> back on SCRIPT_NAME.
>
> --
> James Turner

How about this? I don't see a reason to track SCRIPT_NAME vs.
SCRIPT_FILENAME through the whole daemon. c->script_name is just the
thing that get's execve'ed, it doesn't care where it's comming from.

diff --git slowcgi.c slowcgi.c
index af07bd8..1b467f5 100644
--- slowcgi.c
+++ slowcgi.c
@@ -741,7 +741,11 @@ parse_params(uint8_t *buf, uint16_t n, struct request *c, uint16_t id)
 
  env_entry->val[name_len] = '\0';
  if (val_len < MAXPATHLEN && strcmp(env_entry->val,
-    "SCRIPT_NAME") == 0) {
+    "SCRIPT_NAME") == 0 && c->script_name[0] == '\0') {
+ bcopy(buf, c->script_name, val_len);
+ c->script_name[val_len] = '\0';
+ } else if (val_len < MAXPATHLEN && strcmp(env_entry->val,
+    "SCRIPT_FILENAME") == 0) {
  bcopy(buf, c->script_name, val_len);
  c->script_name[val_len] = '\0';
  }

--
I'm not entirely sure you are real.

Reply | Threaded
Open this post in threaded view
|

Re: Use SCRIPT_FILENAME in slowcgi

James Turner-5
On Sun, Mar 16, 2014 at 04:01:04PM +0000, Florian Obser wrote:

> On Fri, Mar 07, 2014 at 10:35:37PM -0500, James Turner wrote:
> > On Fri, Mar 07, 2014 at 11:20:53PM +0000, Stuart Henderson wrote:
> > > I've been umming and ahhing about this diff, the thing I don't like is
> > > that SCRIPT_FILENAME is an Apache extension rather than part of the
> > > standard CGI variables, which explains why it's not included by
> > > default in nginx (or other servers that people might conceivably
> > > want to use with slowcgi, such as lighttpd).
> > >
> > > Still, I don't see a better way to handle this, and replacing Apache
> > > is going to need to support cgis outside of /cgi-bin one way or another.
> > > But I do think it should fallback to using SCRIPT_NAME if the
> > > SCRIPT_FILENAME variable isn't present, so that standard fastcgi
> > > servers can use it to some extent too.
> > >
> >
> > Maybe something like this? Using SCRIPT_FILENAME if present but falling
> > back on SCRIPT_NAME.
> >
> > --
> > James Turner
>
> How about this? I don't see a reason to track SCRIPT_NAME vs.
> SCRIPT_FILENAME through the whole daemon. c->script_name is just the
> thing that get's execve'ed, it doesn't care where it's comming from.
>
> diff --git slowcgi.c slowcgi.c
> index af07bd8..1b467f5 100644
> --- slowcgi.c
> +++ slowcgi.c
> @@ -741,7 +741,11 @@ parse_params(uint8_t *buf, uint16_t n, struct request *c, uint16_t id)
>  
>   env_entry->val[name_len] = '\0';
>   if (val_len < MAXPATHLEN && strcmp(env_entry->val,
> -    "SCRIPT_NAME") == 0) {
> +    "SCRIPT_NAME") == 0 && c->script_name[0] == '\0') {
> + bcopy(buf, c->script_name, val_len);
> + c->script_name[val_len] = '\0';
> + } else if (val_len < MAXPATHLEN && strcmp(env_entry->val,
> +    "SCRIPT_FILENAME") == 0) {
>   bcopy(buf, c->script_name, val_len);
>   c->script_name[val_len] = '\0';
>   }
>
> --
> I'm not entirely sure you are real.
>

I like it. SCRIPT_FILENAME is used when set otherwise it falls back on
SCRIPT_NAME. Works with my test case were I have a cgi script in htdocs
and need to set SCRIPT_FILENAME with something like:

fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;

and when I use /cgi-bin/ and don't set SCRIPT_FILENAME (current nginx
cgi-bin example).

ok jturner@

--
James Turner