Incorrect http filename (string problem)

[Bruno Macadré]

I've a problem with nginx with long URI, the few last characters of the "http filename" are replaced by first characters of the "http filename".

I've the following configuration :

server {
listen 80;
listen 443 ssl;

...

server_name srv-web.domain;

root /path/to/root/directory

rewrite ^([.]*[^{/])$ $1/ permanent;}

## cut some useless locations ##

location ~ /phpmyadmin/(.*\.php)$ {

try_files $1 $1/ $1/index.php =404;

alias /srv/www/phpMyAdmin/;

fastcgi_index index.php;

## Cut some FastCGI parameters ##

fastcgi_pass unix:/path/to/php-fpm/socket;

}

location ~ /phpmyadmin/ {

try_files $uri $uri/ $uri/index.php =404;

alias /srv/www/phpMyAdmin/;
index index.php;

}

---

The problem :

I can't access some files cause the http filename was rewrited strangely during process. See the error_log below :

[debug] 10429#0: *1 http process request line
[debug] 10429#0: *1 http request line: "GET /phpmyadmin/js/jquery/jquery.qtip-1.0.0.min.js HTTP/1.1"
[debug] 10429#0: *1 http uri: "/phpmyadmin/js/jquery/jquery.qtip-1.0.0.min.js"
[debug] 10429#0: *1 http args: ""
[debug] 10429#0: *1 http exten: "js"
[debug] 10429#0: *1 http process request header line
[debug] 10429#0: *1 http header: "Host: srv-web"
[debug] 10429#0: *1 http header: "User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:11.0) Gecko/20100101 Firefox/11.0"
[debug] 10429#0: *1 http header: "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"
[debug] 10429#0: *1 http header: "Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3"
[debug] 10429#0: *1 http header: "Accept-Encoding: gzip, deflate"
[debug] 10429#0: *1 http header: "Connection: keep-alive"
[debug] 10429#0: *1 http header: "Cookie: pma_navi_width=350; pma_lang=fr; phpMyAdmin=9uetckdlb9fi7di7pstguu74ruqif9ro; pma_mcrypt_iv=6dZTVyFE8W0%3D; pma_collation_connection=utf8_general_ci"
[debug] 10429#0: *1 http header: "Authorization: Basic RFBJOnFRZDNGRmZoUjA="
[debug] 10429#0: *1 http header done
[debug] 10429#0: *1 event timer del: 13: 1333029231431
[debug] 10429#0: *1 generic phase: 0
[debug] 10429#0: *1 rewrite phase: 1
[debug] 10429#0: *1 http script regex: "^([.]*[^{/])$"
[notice] 10429#0: *1 "}([^.]*[/])$" does not match "/phpmyadmin/js/jquery/jquery.qtip-1.0.0.min.js", client: 10.195.163.30, server: srv-web.domain, request: "GET /phpmyadmin/js/jquery/jquery.qtip-1.0.0.min.js HTTP/1.1", host: "srv-web"
[debug] 10429#0: *1 test location: "/"
[debug] 10429#0: *1 test location: "pma/"
[debug] 10429#0: *1 test location: "favicon.ico"
[debug] 10429#0: *1 test location: ~ "/\."
[debug] 10429#0: *1 test location: ~ "/phpmyadmin/(.*\.php)$"
[debug] 10429#0: *1 test location: ~ "/phpmyadmin/"
[debug] 10429#0: *1 using configuration "/phpmyadmin/"
[debug] 10429#0: *1 http cl:-1 max:1048576
[debug] 10429#0: *1 rewrite phase: 3
[debug] 10429#0: *1 post rewrite phase: 4
[debug] 10429#0: *1 generic phase: 5
[debug] 10429#0: *1 generic phase: 6
[debug] 10429#0: *1 generic phase: 7
[debug] 10429#0: *1 access phase: 8
[debug] 10429#0: *1 access phase: 9
[debug] 10429#0: *1 access phase: 10
[debug] 10429#0: *1 post access phase: 11
[debug] 10429#0: *1 try files phase: 12
[debug] 10429#0: *1 http script copy: "/srv/www/phpMyAdmin/"
[debug] 10429#0: *1 http script var: "/phpmyadmin/js/jquery/jquery.qtip-1.0.0.min.js"
[debug] 10429#0: *1 trying to use file: "js/jquery/jquery.qtip-1.0.0.min.js" "/srv/www/phpMyAdmin/js/jquery/jquery.qtip-1.0.0.min.js"
[debug] 10429#0: *1 try file uri: "js/jquery/jquery.qtip-1.0.0.min.js"
[debug] 10429#0: *1 content phase: 13
[debug] 10429#0: *1 content phase: 14
[debug] 10429#0: *1 content phase: 15
[debug] 10429#0: *1 content phase: 16
[debug] 10429#0: *1 content phase: 17
[debug] 10429#0: *1 http script copy: "/srv/www/phpMyAdmin/"
[debug] 10429#0: *1 http filename: "/srv/www/phpMyAdmin/js/jquery/jquery.qtip-1.0.0.mi/srv"
[debug] 10429#0: *1 add cleanup: 0000000000F04220
[error] 10429#0: *1 open() "/srv/www/phpMyAdmin/js/jquery/jquery.qtip-1.0.0.mi/srv" failed (2: No such file or directory), client: 10.195.163.30, server: srv-web.domain, request: "GET /phpmyadmin/js/jquery/jquery.qtip-1.0.0.min.js HTTP/1.1", host: "srv-web"
[debug] 10429#0: *1 http finalize request: 404, "js/jquery/jquery.qtip-1.0.0.mi/srv?" a:1, c:1
[debug] 10429#0: *1 http special response: 404, "js/jquery/jquery.qtip-1.0.0.mi/srv?"
[debug] 10429#0: *1 http set discard body
[debug] 10429#0: *1 xslt filter header
[debug] 10429#0: *1 HTTP/1.1 404 Not Found

As you can see, nginx have replaced the 4 last characters of the URI with the 4 first characters of the alias directory

[Bruno Macadré]

I've just tested the dev version (1.1.18) and the same bug exists.

[Bruno Macadré]

I've found in the source code (in 1.1.18), the place where the string was corrupted.

In src/http/ngx_http_script.c we have this small piece of code (line 547->550) :

while (*(uintptr_t *) e.ip) {
        code = *(ngx_http_script_code_pt *) e.ip;
        code((ngx_http_script_engine_t *) &e);
}

Before this piece of code :

e.request->uri.data contain : js/jquery/jquery.qtip-1.0.0.min.js (nice !!)
e.pos contain : n.js (??)

After this piece of code :

e.pos contain : themes/pmahomme/img/b_import.p/s (the previous file loaded)
e.request->uri.data contain : js/jquery/jquery.qtip-1.0.0.mi/srv/www/phpMyAdmin/themes/pmahomme/img/b_import.p/s (wouahouh !! It's a little bulk)

If you take the n-th first characters of e.request->uri.data (where n is equal to r->uri.len) you've got js/jquery/jquery.qtip-1.0.0.mi/srv exactly like in my error_log !!!

Another strange clue is that e.pos contain before the code the four overwritten letters of the string !!

[Bruno Macadré]

I've found a (strange) workaround :

If I replace this part of my conf :

location ~ /phpmyadmin/ {
  try_files $uri $uri/ $uri/index.php =404;

  alias /srv/www/phpMyAdmin/;
  index index.php;
}

By :

location ~ /phpmyadmin/(.*)?$ {
  if (!-e /srv/www/phpMyAdmin/$1) {
    rewrite ^ 404;
  }

  alias /srv/phpMyAdmin/$1;
  index index.php;
}

All work nice (but it is not normal that the first conf bugs) !!

[Ruslan Ermilov]

Fixed in [4584/nginx].