From 38e269322b2e88d8c52f9aeb1db01ffbcecdcd13 Mon Sep 17 00:00:00 2001 From: Nick Kew Date: Fri, 21 Apr 2017 08:44:06 +0000 Subject: Introduce request taint-checking concept. git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1792169 13f79535-47bb-0310-9956-ffa450edef68 --- include/httpd.h | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) (limited to 'include/httpd.h') diff --git a/include/httpd.h b/include/httpd.h index ebb2a15b4c..1a33466aeb 100644 --- a/include/httpd.h +++ b/include/httpd.h @@ -1074,6 +1074,11 @@ struct request_rec { * TODO: 2 bit signed bitfield when this structure is compacted */ int double_reverse; + /** Mark the request as potentially tainted. This might become a + * bitfield if we identify different taints to be flagged. + * Always use ap_request_tainted() to check taint. + */ + int taint; }; /** @@ -2153,6 +2158,17 @@ AP_DECLARE(apr_status_t) ap_timeout_parameter_parse( */ AP_DECLARE(int) ap_request_has_body(request_rec *r); +/** Request taint flags. Only .htaccess defined. */ +#define AP_TAINT_HTACCESS 0x1 +/** + * Check whether a request is tainted by potentially-untrusted sources. + * + * @param r the request + * @param flags Taint flags to check + * @return truth value + */ +AP_DECLARE(int) ap_request_tainted(request_rec *r, int flags); + /** * Cleanup a string (mainly to be filesystem safe) * We only allow '_' and alphanumeric chars. Non-printable -- cgit v1.2.3