man.cgi and gzip manuals: bug or feature

man.cgi and gzip manuals: bug or feature

[Stephen Gregoratto]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain; charset=unknown-8bit, Size: 436 bytes --]

man.cgi doesn't handle serving gzipped manuals, with it dumping the raw
bytes onto the user's screen. You can view a simple test I made to
illustrate[1]. Not sure if this is a bug or some way of reducing attack
service ¯\_(ツ)_/¯.

[1] https://man.sgregoratto.me/gzip-test/man1/sh.1
    https://man.sgregoratto.me/gzip-test/man1/sh-plain.1
-- 
Stephen Gregoratto
--
 To unsubscribe send an email to discuss+unsubscribe@mandoc.bsd.lv

Re: man.cgi and gzip manuals: bug or feature

[Jan Stary]

On Feb 16 22:59:47, dev@sgregoratto.me wrote:
> man.cgi doesn't handle serving gzipped manuals, with it dumping the raw
> bytes onto the user's screen. You can view a simple test I made to
> illustrate[1]. Not sure if this is a bug or some way of reducing attack
> service ¯\_(ツ)_/¯.
> 
> [1] https://man.sgregoratto.me/gzip-test/man1/sh.1

What happens when you name the file appropriately, such as ls.1.gz ?

--
 To unsubscribe send an email to discuss+unsubscribe@mandoc.bsd.lv

Re: man.cgi and gzip manuals: bug or feature

[Stephen Gregoratto]

On 2020-02-16 13:43, Jan Stary wrote:
> What happens when you name the file appropriately, such as ls.1.gz?

Same thing, raw bytes galore
-- 
Stephen Gregoratto
--
 To unsubscribe send an email to discuss+unsubscribe@mandoc.bsd.lv

Re: man.cgi and gzip manuals: bug or feature

[Ingo Schwarze]

Hi Stephen,

Stephen Gregoratto wrote on Sun, Feb 16, 2020 at 10:59:47PM +1100:

> man.cgi doesn't handle serving gzipped manuals,

Zipping manual pages is utterly stupid nowadays.  Manual pages are
small in the first place, so there is no point in zipping them.

The only reason why main.c supports zipped manuals is because
some operating systems anachronistically insist on it.  I'd
certainly like to kill the pointless feature, the implementation
is quite ugly, so the code could be nicely simplified.

I'm not going to add similar code to cgi.c.  When you run a server,
just unpack the stuff you are going to serve and be done with it.

Yours,
  Ingo
--
 To unsubscribe send an email to discuss+unsubscribe@mandoc.bsd.lv