Suppose a site is http://www.a.com, and a simple page on the site can be http://www.a.com/node/1. A bot can inject a "index.php" when it is visiting the page, so the URL of the page it requested becomes http://www.a.com/index.php/node/1. The shipped .htaccess allows this URL, and forwards to Drupal, then Drupal will use http://www.a.com/index.php as its base URL for generating all the links on the site. This gets worse, when Drupal caches the links/menus generated by bots and displays them for normal users.

I originally thought this could be exploited to hurt SEO and "clean URL", and called it "uglify attack". But, after speaking with @alexpott in private, we conclude it is not a security problem. Therefore, opening up this issue.

Not only our shipped .htaccess has this problem. The default Nginx template for Drupal published on nginx.org https://www.nginx.com/resources/wiki/start/topics/recipes/drupal/ also has the same problem. In fact, I tested a couple of sites hosted with Nginx and I was able to reproduce the problem.

CommentFileSizeAuthor
#31 htaccess_fix-3095854-30.patch1.3 KBjblouvet
#29 htaccess-fix.patch1.43 KBjblouvet
#28 htaccess-fix.patch1.43 KBjblouvet
#21 3095854-20.patch1.43 KBkapilv
#18 3095854-18.patch2.25 KBskyredwang
#15 3095854-15.patch2.25 KBskyredwang
#13 3095854-13.patch2.19 KBrishi.kulshreshtha
#10 3095854-10.patch2.18 KBrishi.kulshreshtha
#7 3095854-7.patch2.12 KBrishi.kulshreshtha
#6 3095854-6.patch1.44 KBrishi.kulshreshtha
#4 3095854-4.patch2.19 KBalexpott

Comments

skyredwang created an issue. See original summary.

skyredwang’s picture

skyredwang
Location Shanghai
commented

Updated my org attribution for this issue.

skyredwang’s picture

skyredwang
Location Shanghai
commented
alexpott’s picture

alexpott
he/they
Primary language English
Location 🇪🇺🌍
commented
Status: Active » Needs review
StatusFileSize
new 3095854-4.patch2.19 KB

Here's a first pass. This copes with http://mysite.com/index.php/some/url -> http://mysite.com/some/url but it does not cope with http://mysite.com/index.php -> http://mysite.com/ which I think it needs to.

Status: Needs review » Needs work

The last submitted patch, 4: 3095854-4.patch, failed testing. View results

rishi.kulshreshtha’s picture

rishi.kulshreshtha
He/Him
Primary language English
Location Portland, Maine
commented
Status: Needs work » Needs review
StatusFileSize
new 3095854-6.patch1.44 KB

I've tried to fixed the second issue in the attached patch. Now it also copes with http://mysite.com/index.php -> http://mysite.com/

rishi.kulshreshtha’s picture

rishi.kulshreshtha
He/Him
Primary language English
Location Portland, Maine
commented
StatusFileSize
new 3095854-7.patch2.12 KB

Attaching the new patch as the earlier one was missing the scaffold one.

The last submitted patch, 6: 3095854-6.patch, failed testing. View results

Status: Needs review » Needs work

The last submitted patch, 7: 3095854-7.patch, failed testing. View results

rishi.kulshreshtha’s picture

rishi.kulshreshtha
He/Him
Primary language English
Location Portland, Maine
commented
StatusFileSize
new 3095854-10.patch2.18 KB

Updated the RewriteCond & the RewriteRule as per the requirement.

rishi.kulshreshtha’s picture

rishi.kulshreshtha
He/Him
Primary language English
Location Portland, Maine
commented
Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 10: 3095854-10.patch, failed testing. View results
- codesniffer_fixes.patch Interdiff of automated coding standards fixes only.

rishi.kulshreshtha’s picture

rishi.kulshreshtha
He/Him
Primary language English
Location Portland, Maine
commented
Status: Needs work » Needs review
StatusFileSize
new 3095854-13.patch2.19 KB

Fixed coding standards.

Status: Needs review » Needs work

The last submitted patch, 13: 3095854-13.patch, failed testing. View results

skyredwang’s picture

skyredwang
Location Shanghai
commented
Status: Needs work » Needs review
StatusFileSize
new 3095854-15.patch2.25 KB

Let's try this.

Status: Needs review » Needs work

The last submitted patch, 15: 3095854-15.patch, failed testing. View results

skyredwang’s picture

skyredwang
Location Shanghai
commented

Apparently, drupalGet() doesn't work with redirect, see #2794649: How to do a redirection test using simpletest?.

skyredwang’s picture

skyredwang
Location Shanghai
commented
Status: Needs work » Needs review
StatusFileSize
new 3095854-18.patch2.25 KB

This patch uses the solution mentioned in https://stackoverflow.com/a/24008632/1966269

Also, this problem is discussed in https://www.drupal.org/forum/support/post-installation/2016-09-19/how-to...

I don't think the automated test will pass, because of the reason mentioned in #17

kapilv’s picture

kapilv commented
Issue tags: +.htaccess

Status: Needs review » Needs work

The last submitted patch, 18: 3095854-18.patch, failed testing. View results

kapilv’s picture

kapilv commented
StatusFileSize
new 3095854-20.patch1.43 KB
kapilv’s picture

kapilv commented
Status: Needs work » Needs review

Status: Needs review » Needs work

The last submitted patch, 21: 3095854-20.patch, failed testing. View results

Version: 8.9.x-dev » 9.1.x-dev

Drupal 8.9.0-beta1 was released on March 20, 2020. 8.9.x is the final, long-term support (LTS) minor release of Drupal 8, which means new developments and disruptive changes should now be targeted against the 9.1.x-dev branch. For more information see the Drupal 8 and 9 minor version schedule and the Allowed changes during the Drupal 8 and 9 release cycles.

deepak goyal’s picture

deepak goyal commented
Status: Needs work » Needs review

Applied patch #21 cleanly in drupal version (9.1.x).

Version: 9.1.x-dev » 9.2.x-dev

Drupal 9.1.0-alpha1 will be released the week of October 19, 2020, which means new developments and disruptive changes should now be targeted for the 9.2.x-dev branch. For more information see the Drupal 9 minor version schedule and the Allowed changes during the Drupal 9 release cycle.

Version: 9.2.x-dev » 9.3.x-dev

Drupal 9.2.0-alpha1 will be released the week of May 3, 2021, which means new developments and disruptive changes should now be targeted for the 9.3.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

jblouvet’s picture

jblouvet commented
StatusFileSize
new htaccess-fix.patch1.43 KB

It seems that previous patches missed a `#` at the beginning of a line to correctly comment it.

jblouvet’s picture

jblouvet commented
StatusFileSize
new htaccess-fix.patch1.43 KB

Adding newlines for readability.

The last submitted patch, 28: htaccess-fix.patch, failed testing. View results

jblouvet’s picture

jblouvet commented
StatusFileSize
new htaccess_fix-3095854-30.patch1.3 KB

Sorry for my previous patches. This one should be complete and apply correctly.

Status: Needs review » Needs work

The last submitted patch, 31: htaccess_fix-3095854-30.patch, failed testing. View results

Version: 9.3.x-dev » 9.4.x-dev

Drupal 9.3.0-rc1 was released on November 26, 2021, which means new developments and disruptive changes should now be targeted for the 9.4.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

quietone’s picture

quietone commented
Related issues: +#3050261: index.php randomly appears in friendly URLs

Adding a related issue.

Version: 9.4.x-dev » 9.5.x-dev

Drupal 9.4.0-alpha1 was released on May 6, 2022, which means new developments and disruptive changes should now be targeted for the 9.5.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 9.5.x-dev » 10.1.x-dev

Drupal 9.5.0-beta2 and Drupal 10.0.0-beta2 were released on September 29, 2022, which means new developments and disruptive changes should now be targeted for the 10.1.x-dev branch. For more information see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 10.1.x-dev » 11.x-dev

Drupal core is moving towards using a “main” branch. As an interim step, a new 11.x branch has been opened, as Drupal.org infrastructure cannot currently fully support a branch named main. New developments and disruptive changes should now be targeted for the 11.x branch, which currently accepts only minor-version allowed changes. For more information, see the Drupal core minor version schedule and the Allowed changes during the Drupal core release cycle.

Version: 11.x-dev » main

Drupal core is now using the main branch as the primary development branch. New developments and disruptive changes should now be targeted to the main branch.

Read more in the announcement.