commit 7dff998495d527041dbd7f48770dfc395ddabaee
author Maxim Dounin <mdounin@mdounin.ru> Mon Feb 13 15:35:48 2012 +0000
committer Maxim Dounin <mdounin@mdounin.ru> Mon Feb 13 15:35:48 2012 +0000
tree b466d42af3378de207495c94721fd61e51899847
parent 1b0ad6ee72179fef479bfae7c8c4bfd5ac834c29

Core: protection from cycles with named locations and post_action.

Now redirects to named locations are counted against normal uri changes
limit, and post_action respects this limit as well.  As a result at least
the following (bad) configurations no longer trigger infinite cycles:

1. Post action which recursively triggers post action:

    location / {
        post_action /index.html;
    }

2. Post action pointing to nonexistent named location:

    location / {
        post_action @nonexistent;
    }

3. Recursive error page for 500 (Internal Server Error) pointing to
   a nonexistent named location:

    location / {
        recursive_error_pages on;
        error_page 500 @nonexistent;
        return 500;
    }

src/http/ngx_http_core_module.c

diff --git a/src/http/ngx_http_core_module.c b/src/http/ngx_http_core_module.c
index 24102e4..0bfc76f 100644
--- a/src/http/ngx_http_core_module.c
+++ b/src/http/ngx_http_core_module.c
@@ -2524,6 +2524,16 @@
     ngx_http_core_main_conf_t   *cmcf;
 
     r->main->count++;
+    r->uri_changes--;
+
+    if (r->uri_changes == 0) {
+        ngx_log_error(NGX_LOG_ERR, r->connection->log, 0,
+                      "rewrite or internal redirection cycle "
+                      "while redirect to named location \"%V\"", name);
+
+        ngx_http_finalize_request(r, NGX_HTTP_INTERNAL_SERVER_ERROR);
+        return NGX_DONE;
+    }
 
     cscf = ngx_http_get_module_srv_conf(r, ngx_http_core_module);
 

src/http/ngx_http_request.c

diff --git a/src/http/ngx_http_request.c b/src/http/ngx_http_request.c
index c35d550..a8515f3 100644
--- a/src/http/ngx_http_request.c
+++ b/src/http/ngx_http_request.c
@@ -2928,6 +2928,10 @@
         return NGX_DECLINED;
     }
 
+    if (r->post_action && r->uri_changes == 0) {
+        return NGX_DECLINED;
+    }
+
     ngx_log_debug1(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
                    "post action: \"%V\"", &clcf->post_action);