Function do_expand

modules/mappers/mod_rewrite.c:2429–2689

perform all the expansions on the input string * putting the result into a new string * * for security reasons this expansion must be performed in a * single pass, otherwise an attacker can arrange for the result * of an earlier expansion to include expansion specifiers that * are interpreted by a later expansion, producing results that * were not intended by the administrator. * * unsafe

 * to -1 and remains so if no qmark is found.
 */
static char *do_expand(char *input, rewrite_ctx *ctx, rewriterule_entry *entry,
                       int *unsafe_qmark)
{
#define EXPAND_SPECIALS "\\$%"
    result_list *result, *current;
    result_list sresult[SMALL_EXPANSION];
    unsigned spc = 0;
    apr_size_t span, inputlen, outlen;
    char *p, *c;
    apr_pool_t *pool = ctx->r->pool;

    inputlen = strlen(input);
    if (!unsafe_qmark) {
        span = strcspn(input, EXPAND_SPECIALS);
    }
    else {
        span = strcspn(input, EXPAND_SPECIALS "?");
        if (input[span] == '?') {
            /* this qmark is not from an expansion thus safe */
            *unsafe_qmark = 0;

            /* keep tracking only if interested in the last qmark */
            if (!entry || !(entry->flags & RULEFLAG_QSLAST)) {
                unsafe_qmark = NULL;
            }

            /* find the next real special char, any (last) qmark up to
             * there is safe too
             */
            span += strcspn(input + span, EXPAND_SPECIALS);
        }
    }

    /* fast path (no specials) */
    if (span >= inputlen) {
        return apr_pstrmemdup(pool, input, inputlen);
    }

    /* well, actually something to do */
    result = current = &(sresult[spc++]);

    p = input + span;
    current->next = NULL;
    current->string = input;
    current->len = span;
    outlen = span;

    /* loop for specials */
    do {
        int expanded = 0;

        /* prepare next entry */
        if (current->len) {
            current->next = (spc < SMALL_EXPANSION)
                            ? &(sresult[spc++])
                            : (result_list *)apr_palloc(pool,
                                                        sizeof(result_list));
            current = current->next;