Index of /Applications/Apache/perl/
 URL regular expression DoS (CVE-2007-1349)
A flaw was discovered in the Apache::PerlRun module shipped with
mod_perl 1.29 and earlier and in the ModPerl::RegistryCooker module shipped with
mod_perl 2.03 and earlier. A remote attacker could craft a URL with a path that
would be interpreted as a regular expression, potentially allowing a
denial of service by creating an expression that will take a very long
time to run. This vulnerability only affects Apache::PerlRun and
custom subclasses of ModPerl::RegistryCooker that explicitly use the
namespace_from_uri() method. The Apache::Registry, ModPerl::PerlRun,
and ModPerl::Registry modules are NOT affected.
Users of mod_perl 1.29 and earlier are encouraged to upgrade to 1.30 if
they use Apache::PerlRun for their applications. Users of mod_perl 2.03
are encouraged to check their custom code for calls to the
namespace_from_uri() method and replace it with the
namespace_from_filename() method.
Please note!
mod_perl-1.24_01.tar.gz or later is required for Apache >= 1.3.14.
The Apache/Perl integration project brings together the full power of
the Perl programming language and the Apache HTTP server. This is
achieved by linking the Perl runtime library into the server and
providing an object oriented Perl interface to the server's C language
API.
These pieces are seamlessly glued together by the `mod_perl' server
plugin, making it is possible to write Apache modules entirely in
Perl. In addition, the persistent interpreter embedded in the server
avoids the overhead of starting an external interpreter program and
the additional Perl start-up (compile) time.
Without question, the most popular Apache/Perl module is
Apache::Registry module. This module emulates the CGI environment,
allowing programmers to write scripts that run under CGI or
mod_perl without change. Existing CGI scripts may require some
changes, simply because a CGI script has a very short lifetime of one
HTTP request, allowing you to get away with "quick and dirty"
scripting. Using mod_perl and Apache::Registry requires you to be
more careful, but it also gives new meaning to the work "quick"!
Apache::Registry maintains a cache of compiled scripts, which happens
the first time a script is accessed by a child server or once again if
the file is updated on disk.
Although it may be all you need, a speedy CGI replacement is only a
small part of this project. Callback hooks are in place for each stage
of a request. Apache-Perl modules may step in during the handler,
header parser, uri translate, authentication, authorization, access,
type check, fixup, logger and cleanup stages of a request.
Apache/Perl modules include:
Apache::Registry - Run unaltered CGI scripts
Apache::Status - Embedded interpreter runtime status
Apache::Embperl - Embed Perl code in HTML documents
Apache::SSI - Implement server-side includes in Perl
Apache::DBI - Maintain persistent DBI connections
Apache::Gateway - Implement an HTTP/1.1 gateway
Apache::GzipChain - Compress output on the fly
Apache::Filter - Filter document and script output
Apache::Sandwich - Generate page headers and footers
Apache::TransLDAP - Translate URIs via LDAP lookups
Apache::ASP - Implement "Active Server Pages"
Apache::AuthenDBI - Authenticate against a database via DBI
Apache::PHLogin - Authenticate against a PH database
Apache::DBILogger - Log requests to a database via DBI
Apache::Session - Persistent session management
Apache::Throttle - Content negotiation based on connection speed
There's plenty more Apache/Perl software you might be interested in.
The Apache/Perl module list keeps track of modules inside and outside
the distribution, along with idea placeholders.
It is also possible to use Perl to configure your server (in
*.conf files) with
sections. This eases often complicated and
cumbersome configuration of vitrual host and various resources. Since
any Perl code can be used in these sections, configuration info could
be pulled in from an RDBMS with DBI or your favorite database package.
While the output of mod_perl scripts can be included with Server Side
Includes just as CGI scripts can, mod_perl's integration with
mod_include gives an extra speed boost and allows Perl code to be
directly inside SSI files.
For comments, questions, bug-reports, etc., join the Apache/Perl
mailing list by sending mail to modperl-subscribe@perl.apache.org.
sending mail to announce-subscribe@perl.apache.org
will subscribe you to the very low-traffic announcements list.
Here is an important list of links to follow:
The Apache/Perl homepage:
http://perl.apache.org/
or
http://apache.perl.org/
Mailing list archives:
http://perl.apache.org/maillist/modperl.html#Searchable_Archives
Documentation:
http://perl.apache.org/docs/index.html
Books:
"Practical mod_perl"
By Stas Bekman and Eric Cholet
http://www.modperlbook.org/
"The mod_perl Developer's Cookbook"
By Geoffrey Young; Paul Lindner; Randy Kobes
http://www.modperlcookbook.org/
"mod_perl quick reference card"
By Andrew Ford
http://www.refcards.com/
"Writing Apache Modules with Perl and C":
By Lincoln Stein and Doug MacEachern
http://www.modperl.com/
The Apache/Perl module list:
http://perl.apache.org/products/apache-modules.html
Enjoy,
-Doug MacEachern (dougm@perl.apache.org)
|
Parent Directory
contrib
HEADER.html.old
mod_perl-2.0.4.tar.gz