Re: libxml with CGI fix

[Bob Friesenhahn <bfriesen () simple dallas tx us>]

On Tue, 13 Sep 2016, watashiwaher wrote:

> Hi, huys! There is a known httpoxy vulnerability ( https://httpoxy.org/ ).
> There is a problem with CGI usage in all application which use libxml2
> library. Attacker can make requests via attacker proxy from target server
> using this vulnerability. I reported this problem in the 5th august, but
> developers didn't reply me at all, and I don't know if they want to
> response.

The referenced web site provides the advice "Do it “at the edge”, 
where HTTP requests first enter your system.".  In this case libxml2 
is not the edge.  The edge is the parser which accepts the CGI 
requests.

Adding detection of "REQUEST_METHOD" to libxml2 may reduce the 
potential menace.

The libxml2 developers should have responded to you but I can see why 
they would not consider this to be their problem.

If you break libxml2 support for HTTP_PROXY (and/or http_proxy) then 
the proxy capabilty can't be used outside of CGI applications, which 
is likely to break existing valid uses.

Bob
--
Bob Friesenhahn
bfriesen () simple dallas tx us, http://www.simplesystems.org/users/bfriesen/
GraphicsMagick Maintainer,    http://www.GraphicsMagick.org/