SUMM: Zeros sent to CGI shell scripts

From: Mike Grau <m.grau_at_kcc.state.ks.us>
Date: Mon, 10 Mar 1997 15:52:19 -0600
(Original question at end)
2 Responses: Both suggesting to use the internal support. However, since NSCA says
(see below) the command line may be used in the case of an ISINDEX query, and the
"calendar" script is such a query, and the query runs OK at the NCSA site, that the "zero"
problem was perhaps a quirk of DU. I assume the scripts they run as examples are also
the one's they distribute. At any rate:

$CAL `echo $QUERY_STRING | sed -e "s/+/ /"`
or similiar works, while
$CAL $*
does not. Just seems like a shame.

From: Lucio Chiappetti:
  Beware however that the CGI tutorial documentation seems to imply
  that argstring shall not be used, and env variable QUERY_STRING 
  shall be used instead ...

  See e.g. http://hoohoo.ncsa.uiuc.edu/cgi/primer.html
  http://hoohoo.ncsa.uiuc.edu/cgi/interface.html

  I believe this changed some time ago.
  I note that the example scripts in the NCSA distribution use QUERY_STRING

From Neil Schellenberger:
I had a similar problem with an imagemap/cgi pair which I originally
wrote some time ago and only recently resurrected.  I found that the
current verion of our server (also NCSA 1.5.?) was escaping certain
characters (zero and capital A, for example).  This hosed up the (old)
external imagemap CGI program.  My workaround: use the internal support,
which handles the escapes properly.

*****************************************************************************************************************************
From NCSA:
"The command line is only used in the case of an ISINDEX query. It is not used in the
case of an HTML form or any as yet undefined query type. The server should search
the query information (the QUERY_STRING environment variable) for a non-encoded
= character to determine if the command line is to be used, if it finds one, the
command line is not to be used. This trusts the clients to encode the = sign in
ISINDEX queries, a practice which was considered safe at the time of the design
of this specification."

"For example, use the finger script and the ISINDEX interface to look up "httpd". You
will see that the script will call itself with /cgi-bin/finger?httpd and will actually
execute "finger httpd" on the command line and output the results to you."
*******************************************************************************************************

Original question:
I'm running NSCA httpd on DU3.2c. Whenever a zero is sent in a query to
a cgi script, the variable $* (or $whatever) fails to get the zero and
everything after the zero. The command (like cal) fails with a bad
argument. For example, the test-cgi script (#!/bin/sh) run with
"test-cgi?3+1998" returns:

"argc is 2. argv is 3 1998"  -followed by the variables SERVER_SOFTWARE,
QUERY_STRING, etc.

while test-cgi?3+2001 returns:

"argc is 2. argv is 3 2"  -followed by nothing or just part of the
return page.
The QUERY_STRING looks good in every case.
I've tried Netscape, Explorer, and Mosaic; and run browsers on MAC, PC,
and UNIX. The results are the same in every case. I've used both NCSA
1.5.1 and 1.5.2 with no difference. IDEAS?? What tree should I be
barking under -- DU or HTTPD. The cgi's work fine as long as I don't try
to send 'em a zero. TIA. Any suggestions welcome!  Received on Mon Mar 10 1997 - 23:08:26 NZDT

This archive was generated by hypermail 2.4.0 : Wed Nov 08 2023 - 11:53:36 NZDT