Bash fastCGI 在没有给定参数时显示大量信息
Bash fastCGI displays a lot of information when no args are given
重现步骤 通过 NGINX 从 FastCGI 创建一个 bash 脚本到 运行,在 URL 栏中不提供变量。
Nginx 位置:
location ~ (\.cgi|\.py|\.sh|\.pl|\.lua)$ {
gzip off;
autoindex on;
fastcgi_pass unix:/var/run/fcgiwrap.socket;
include /etc/nginx/fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}
Bash 脚本顶部:
# Save the old internal field separator.
OIFS="$IFS"
# Set the field separator to & and parse the QUERY_STRING at the ampersand.
IFS="${IFS}&"
set $QUERY_STRING
Args="$*"
IFS="$OIFS"
预期输出:无
实际输出:
请注意输出已被清理
BASH=/bin/bash
BASHOPTS=""
BASH_ALIASES=""
BASH_ARGC=""
BASH_ARGV=""
BASH_CMDS=""
BASH_LINENO=""
BASH_SOURCE=""
BASH_VERSINFO=""
BASH_VERSION=""`
CONTENT_LENGTH=""
CONTENT_TYPE=""
DAEMON_OPTS=""
DIRSTACK=""
DOCUMENT_ROOT=""
DOCUMENT_URI=""
EUID=""
FCGI_ROLE=""
GATEWAY_INTERFACE=""
GROUPS=""
HOME=""
HOSTNAME=""
HOSTTYPE=""
HTTPS=""
HTTP_ACCEPT=""
HTTP_ACCEPT_ENCODING=""
HTTP_ACCEPT_LANGUAGE=""
HTTP_CONNECTION=""
HTTP_COOKIE=CID=""
HTTP_HOST=""
HTTP_UPGRADE_INSECURE_REQUESTS=""
HTTP_USER_AGENT=""
IFS=""
INVOCATION_ID=""
JOURNAL_STREAM=""
LANG=""
LOGNAME=""
MACHTYPE=""
OIFS=""
OPTERR=""
OPTIND=""
OSTYPE=""
PATH=""
PIPESTATUS=""
PPID=""
PS4=""
PWD=""
QUERY_STRING=""
REDIRECT_STATUS=""
REMOTE_ADDR=""
REMOTE_PORT=""
REQUEST_METHOD=""
REQUEST_SCHEME=""
REQUEST_URI=""
SCRIPT_FILENAME=""
SCRIPT_NAME=""
SERVER_ADDR=""
SERVER_NAME=""
SERVER_PORT=""
SERVER_PROTOCOL=""
SERVER_SOFTWARE=""
SHELL=""
SHELLOPTS=""
SHLVL=""
TERM=""
UID=""
USER=""
_=""
我不确定 set $QUERY_STRING
行的意图是什么,但这就是导致输出的原因。如果在没有任何有效选项的情况下调用 bash 中的 set builtin 将输出环境。
重现步骤 通过 NGINX 从 FastCGI 创建一个 bash 脚本到 运行,在 URL 栏中不提供变量。
Nginx 位置:
location ~ (\.cgi|\.py|\.sh|\.pl|\.lua)$ { gzip off; autoindex on; fastcgi_pass unix:/var/run/fcgiwrap.socket; include /etc/nginx/fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; }
Bash 脚本顶部:
# Save the old internal field separator. OIFS="$IFS" # Set the field separator to & and parse the QUERY_STRING at the ampersand. IFS="${IFS}&" set $QUERY_STRING Args="$*" IFS="$OIFS"
预期输出:无
实际输出: 请注意输出已被清理
BASH=/bin/bash BASHOPTS="" BASH_ALIASES=""
BASH_ARGC=""
BASH_ARGV="" BASH_CMDS=""
BASH_LINENO=""
BASH_SOURCE=""
BASH_VERSINFO="" BASH_VERSION=""`
CONTENT_LENGTH=""
CONTENT_TYPE=""
DAEMON_OPTS="" DIRSTACK=""
DOCUMENT_ROOT=""
DOCUMENT_URI=""
EUID=""
FCGI_ROLE="" GATEWAY_INTERFACE=""
GROUPS=""
HOME=""
HOSTNAME=""
HOSTTYPE="" HTTPS=""
HTTP_ACCEPT=""
HTTP_ACCEPT_ENCODING="" HTTP_ACCEPT_LANGUAGE=""
HTTP_CONNECTION=""
HTTP_COOKIE=CID="" HTTP_HOST=""
HTTP_UPGRADE_INSECURE_REQUESTS=""
HTTP_USER_AGENT=""
IFS=""
INVOCATION_ID=""
JOURNAL_STREAM=""
LANG=""
LOGNAME="" MACHTYPE=""
OIFS=""
OPTERR=""
OPTIND=""
OSTYPE=""
PATH="" PIPESTATUS=""
PPID=""
PS4=""
PWD=""
QUERY_STRING=""
REDIRECT_STATUS="" REMOTE_ADDR=""
REMOTE_PORT=""
REQUEST_METHOD=""
REQUEST_SCHEME="" REQUEST_URI=""
SCRIPT_FILENAME=""
SCRIPT_NAME=""
SERVER_ADDR="" SERVER_NAME=""
SERVER_PORT=""
SERVER_PROTOCOL=""
SERVER_SOFTWARE="" SHELL=""
SHELLOPTS=""
SHLVL=""
TERM=""
UID=""
USER="" _=""
我不确定 set $QUERY_STRING
行的意图是什么,但这就是导致输出的原因。如果在没有任何有效选项的情况下调用 bash 中的 set builtin 将输出环境。