Bug 79659

Comment 1 Simon L. B. Nielsen 2005-04-08 08:40:19 UTC

On 2005.04.07 20:03:11 -0400, Dan Langille wrote:

> cvsweb cannot cope with files containing %


A quick check of my local FreeBSD source mirror shows that the most
recent cvsweb (which can be found in ports/) seem to handle this, so
the solution is probably to upgrade cvsweb on www.FreeBSD.org.

We should probably test that FreshPorts can work with the new version
before setting it in "production".

I have CC'ed the cvsweb maintainer to hear if he has any comments on
the impact of doing an upgrade (mainly if there are any know
incompatibilities).

-- 
Simon L. Nielsen

On 8 Apr 2005 at 9:40, Simon L. Nielsen wrote:

> On 2005.04.07 20:03:11 -0400, Dan Langille wrote:
> 
> > cvsweb cannot cope with files containing %
> 
> A quick check of my local FreeBSD source mirror shows that the most
> recent cvsweb (which can be found in ports/) seem to handle this, so
> the solution is probably to upgrade cvsweb on www.FreeBSD.org.

Thank you for looking in this.

I have an unproven theory that the problem is not cvsweb.

> We should probably test that FreshPorts can work with the new version
> before setting it in "production".

Your investigation prompted me to check my local repository which 
uses cvsweb-2.0.6.  cvsweb has no problem with that file.  I see that 
FreeBSD is using FreeBSD-CVSweb 2.0.6.  It has a problem with that 
file.

This suggests that the problem may not be with cvsweb, but with 
something else.  The error message:

Bad Request
Your browser sent a request that this server could not understand.

A grep of the repo projects/cvsweb does not find "Bad Request".  This 
also suggests it could be something other than cvsweb that is 
displaying this message.

> I have CC'ed the cvsweb maintainer to hear if he has any comments on
> the impact of doing an upgrade (mainly if there are any know
> incompatibilities).

Perhaps he knows about the above mentioned error message displayed 
when browsing to 
http://www.freebsd.org/cgi/cvsweb.cgi/ports/devel/gdb6/files/patch-
i386%25nm-fbsd64.h

thanks

-- 
Dan Langille : http://www.langille.org/
BSDCan - The Technical BSD Conference - http://www.bsdcan.org/
   NEW brochure available at http://www.bsdcan.org/2005/advocacy/

On Fri, Apr 08, 2005 at 10:40:09AM +0000, Dan Langille wrote:

>  Your investigation prompted me to check my local repository which 
>  uses cvsweb-2.0.6.  cvsweb has no problem with that file.  I see that 
>  FreeBSD is using FreeBSD-CVSweb 2.0.6.  It has a problem with that 
>  file.
>  
>  This suggests that the problem may not be with cvsweb, but with 
>  something else.  The error message:
>  
>  Bad Request
>  Your browser sent a request that this server could not understand.
>  
>  A grep of the repo projects/cvsweb does not find "Bad Request".  This 
>  also suggests it could be something other than cvsweb that is 
>  displaying this message.

It's Apache.  From the CHANGES file in Apache 0.8.15:

  *) Reject paths containing %-escaped '%' or null characters [David Robinson]

Googling seems to suggest that this was done because it was deemed
forbidden by RFC 2396, which is not the case.

Ceri
-- 
Only two things are infinite, the universe and human stupidity, and I'm
not sure about the former.			  -- Einstein (attrib.)

On 8 Apr 2005 at 12:24, Ceri Davies wrote:

> On Fri, Apr 08, 2005 at 10:40:09AM +0000, Dan Langille wrote:
> 
> >  Your investigation prompted me to check my local repository which 
> >  uses cvsweb-2.0.6.  cvsweb has no problem with that file.  I see that 
> >  FreeBSD is using FreeBSD-CVSweb 2.0.6.  It has a problem with that 
> >  file.
> >  
> >  This suggests that the problem may not be with cvsweb, but with 
> >  something else.  The error message:
> >  
> >  Bad Request
> >  Your browser sent a request that this server could not understand.
> >  
> >  A grep of the repo projects/cvsweb does not find "Bad Request".  This 
> >  also suggests it could be something other than cvsweb that is 
> >  displaying this message.
> 
> It's Apache.  From the CHANGES file in Apache 0.8.15:
> 
>   *) Reject paths containing %-escaped '%' or null characters [David Robinson]
> 
> Googling seems to suggest that this was done because it was deemed
> forbidden by RFC 2396, which is not the case.

Oh...

Apache is unlikely to be changed.  Any filenames within the FreeBSD 
CVS repository that contain a '%' will break FreshPorts.  FreshPorts 
uses cvsweb to fetch the files associated with the commit.

-- 
Dan Langille : http://www.langille.org/
BSDCan - The Technical BSD Conference - http://www.bsdcan.org/
   NEW brochure available at http://www.bsdcan.org/2005/advocacy/

On 8 Apr 2005 at 12:24, Ceri Davies wrote:

> On Fri, Apr 08, 2005 at 10:40:09AM +0000, Dan Langille wrote:
> 
> >  Your investigation prompted me to check my local repository which 
> >  uses cvsweb-2.0.6.  cvsweb has no problem with that file.  I see that 
> >  FreeBSD is using FreeBSD-CVSweb 2.0.6.  It has a problem with that 
> >  file.
> >  
> >  This suggests that the problem may not be with cvsweb, but with 
> >  something else.  The error message:
> >  
> >  Bad Request
> >  Your browser sent a request that this server could not understand.
> >  
> >  A grep of the repo projects/cvsweb does not find "Bad Request".  This 
> >  also suggests it could be something other than cvsweb that is 
> >  displaying this message.
> 
> It's Apache.  From the CHANGES file in Apache 0.8.15:
> 
>   *) Reject paths containing %-escaped '%' or null characters [David Robinson]
> 
> Googling seems to suggest that this was done because it was deemed
> forbidden by RFC 2396, which is not the case.

Hold on.... why do we see the problem at www.freebsd.org but not on 
my local (private) cvsweb?  I'm running apache-1.3.33_1
-- 
Dan Langille : http://www.langille.org/
BSDCan - The Technical BSD Conference - http://www.bsdcan.org/
   NEW brochure available at http://www.bsdcan.org/2005/advocacy/

On Fri, Apr 08, 2005 at 08:38:42AM -0400, Dan Langille wrote:
> On 8 Apr 2005 at 12:24, Ceri Davies wrote:
> > On Fri, Apr 08, 2005 at 10:40:09AM +0000, Dan Langille wrote:
> > 
> > >  Your investigation prompted me to check my local repository which 
> > >  uses cvsweb-2.0.6.  cvsweb has no problem with that file.  I see that 
> > >  FreeBSD is using FreeBSD-CVSweb 2.0.6.  It has a problem with that 
> > >  file.
> > >  
> > >  This suggests that the problem may not be with cvsweb, but with 
> > >  something else.  The error message:
> > >  
> > >  Bad Request
> > >  Your browser sent a request that this server could not understand.
> > >  
> > >  A grep of the repo projects/cvsweb does not find "Bad Request".  This 
> > >  also suggests it could be something other than cvsweb that is 
> > >  displaying this message.
> > 
> > It's Apache.  From the CHANGES file in Apache 0.8.15:
> > 
> >   *) Reject paths containing %-escaped '%' or null characters [David Robinson]
> > 
> > Googling seems to suggest that this was done because it was deemed
> > forbidden by RFC 2396, which is not the case.
> 
> Hold on.... why do we see the problem at www.freebsd.org but not on 
> my local (private) cvsweb?  I'm running apache-1.3.33_1

Because you are not using mod_rewrite.

Ceri
-- 
Only two things are infinite, the universe and human stupidity, and I'm
not sure about the former.			  -- Einstein (attrib.)

On Fri, Apr 08, 2005 at 02:58:29PM +0100, Ceri Davies wrote:
> On Fri, Apr 08, 2005 at 08:38:42AM -0400, Dan Langille wrote:
> > On 8 Apr 2005 at 12:24, Ceri Davies wrote:
> > > On Fri, Apr 08, 2005 at 10:40:09AM +0000, Dan Langille wrote:
> > > 
> > > >  Your investigation prompted me to check my local repository which 
> > > >  uses cvsweb-2.0.6.  cvsweb has no problem with that file.  I see that 
> > > >  FreeBSD is using FreeBSD-CVSweb 2.0.6.  It has a problem with that 
> > > >  file.
> > > >  
> > > >  This suggests that the problem may not be with cvsweb, but with 
> > > >  something else.  The error message:
> > > >  
> > > >  Bad Request
> > > >  Your browser sent a request that this server could not understand.
> > > >  
> > > >  A grep of the repo projects/cvsweb does not find "Bad Request".  This 
> > > >  also suggests it could be something other than cvsweb that is 
> > > >  displaying this message.
> > > 
> > > It's Apache.  From the CHANGES file in Apache 0.8.15:
> > > 
> > >   *) Reject paths containing %-escaped '%' or null characters [David Robinson]
> > > 
> > > Googling seems to suggest that this was done because it was deemed
> > > forbidden by RFC 2396, which is not the case.
> > 
> > Hold on.... why do we see the problem at www.freebsd.org but not on 
> > my local (private) cvsweb?  I'm running apache-1.3.33_1
> 
> Because you are not using mod_rewrite.

Check it out; with mod_rewrite the % needs escaping twice:
http://www.freebsd.org/cgi/cvsweb.cgi/ports/devel/gdb6/files/patch-i386%2525nm-fbsd64.h

Ceri
-- 
Only two things are infinite, the universe and human stupidity, and I'm
not sure about the former.			  -- Einstein (attrib.)

On 8 Apr 2005 at 15:13, Ceri Davies wrote:

> On Fri, Apr 08, 2005 at 02:58:29PM +0100, Ceri Davies wrote:
> > On Fri, Apr 08, 2005 at 08:38:42AM -0400, Dan Langille wrote:
> > > On 8 Apr 2005 at 12:24, Ceri Davies wrote:
> > > > On Fri, Apr 08, 2005 at 10:40:09AM +0000, Dan Langille wrote:
> > > > 
> > > > >  Your investigation prompted me to check my local repository which 
> > > > >  uses cvsweb-2.0.6.  cvsweb has no problem with that file.  I see that 
> > > > >  FreeBSD is using FreeBSD-CVSweb 2.0.6.  It has a problem with that 
> > > > >  file.
> > > > >  
> > > > >  This suggests that the problem may not be with cvsweb, but with 
> > > > >  something else.  The error message:
> > > > >  
> > > > >  Bad Request
> > > > >  Your browser sent a request that this server could not understand.
> > > > >  
> > > > >  A grep of the repo projects/cvsweb does not find "Bad Request".  This 
> > > > >  also suggests it could be something other than cvsweb that is 
> > > > >  displaying this message.
> > > > 
> > > > It's Apache.  From the CHANGES file in Apache 0.8.15:
> > > > 
> > > >   *) Reject paths containing %-escaped '%' or null characters [David Robinson]
> > > > 
> > > > Googling seems to suggest that this was done because it was deemed
> > > > forbidden by RFC 2396, which is not the case.
> > > 
> > > Hold on.... why do we see the problem at www.freebsd.org but not on 
> > > my local (private) cvsweb?  I'm running apache-1.3.33_1
> > 
> > Because you are not using mod_rewrite.
> 
> Check it out; with mod_rewrite the % needs escaping twice:
> http://www.freebsd.org/cgi/cvsweb.cgi/ports/devel/gdb6/files/patch-i386%2525nm-fbsd64.h

Oh good!

So this is a cvsweb bug.  Thank you.

Note: escaping the % twice on my system gives:

Error: ports/devel/gdb6/files/patch-i386%25nm-fbsd64.h: no such file 
or directory

So any fix must check for mod_rewrite.

-- 
Dan Langille : http://www.langille.org/
BSDCan - The Technical BSD Conference - http://www.bsdcan.org/
   NEW brochure available at http://www.bsdcan.org/2005/advocacy/

On Fri, Apr 08, 2005 at 10:24:33AM -0400, Dan Langille wrote:
> On 8 Apr 2005 at 15:13, Ceri Davies wrote:
> 
> > On Fri, Apr 08, 2005 at 02:58:29PM +0100, Ceri Davies wrote:
> > > On Fri, Apr 08, 2005 at 08:38:42AM -0400, Dan Langille wrote:
> > > > On 8 Apr 2005 at 12:24, Ceri Davies wrote:
> > > > > On Fri, Apr 08, 2005 at 10:40:09AM +0000, Dan Langille wrote:
> > > > > 
> > > > > >  Your investigation prompted me to check my local repository which 
> > > > > >  uses cvsweb-2.0.6.  cvsweb has no problem with that file.  I see that 
> > > > > >  FreeBSD is using FreeBSD-CVSweb 2.0.6.  It has a problem with that 
> > > > > >  file.
> > > > > >  
> > > > > >  This suggests that the problem may not be with cvsweb, but with 
> > > > > >  something else.  The error message:
> > > > > >  
> > > > > >  Bad Request
> > > > > >  Your browser sent a request that this server could not understand.
> > > > > >  
> > > > > >  A grep of the repo projects/cvsweb does not find "Bad Request".  This 
> > > > > >  also suggests it could be something other than cvsweb that is 
> > > > > >  displaying this message.
> > > > > 
> > > > > It's Apache.  From the CHANGES file in Apache 0.8.15:
> > > > > 
> > > > >   *) Reject paths containing %-escaped '%' or null characters [David Robinson]
> > > > > 
> > > > > Googling seems to suggest that this was done because it was deemed
> > > > > forbidden by RFC 2396, which is not the case.
> > > > 
> > > > Hold on.... why do we see the problem at www.freebsd.org but not on 
> > > > my local (private) cvsweb?  I'm running apache-1.3.33_1
> > > 
> > > Because you are not using mod_rewrite.
> > 
> > Check it out; with mod_rewrite the % needs escaping twice:
> > http://www.freebsd.org/cgi/cvsweb.cgi/ports/devel/gdb6/files/patch-i386%2525nm-fbsd64.h
> 
> Oh good!
> 
> So this is a cvsweb bug.  Thank you.

Could be argued that it's an apache configuration bug, I suppose.  Up to
one of the webmasters and scop to fight that battle though.

Ceri
-- 
Only two things are infinite, the universe and human stupidity, and I'm
not sure about the former.			  -- Einstein (attrib.)

Comment 10 scop 2005-04-09 22:53:37 UTC

On Fri, 2005-04-08 at 06:37 -0400, Dan Langille wrote:
> On 8 Apr 2005 at 9:40, Simon L. Nielsen wrote:
> > On 2005.04.07 20:03:11 -0400, Dan Langille wrote:
>
> > We should probably test that FreshPorts can work with the new version
> > before setting it in "production".

IIRC, cvsweb 3.x should be backwards URI compatible with 2.x, so
external services referring to it should not need changes.

But upgrading the version running on www.freebsd.org should be done
carefully as there are some new required CPAN modules, newer required
version of Perl, and some incompatible configuration changes.
http://www.freebsd.org/cgi/cvsweb.cgi/projects/cvsweb/INSTALL?rev=.

But see also below.

> Your investigation prompted me to check my local repository which 
> uses cvsweb-2.0.6.  cvsweb has no problem with that file.  I see that 
> FreeBSD is using FreeBSD-CVSweb 2.0.6.  It has a problem with that 
> file.
> 
> This suggests that the problem may not be with cvsweb, but with 
> something else.  The error message:
> 
> Bad Request
> Your browser sent a request that this server could not understand.
> 
> A grep of the repo projects/cvsweb does not find "Bad Request".  This 
> also suggests it could be something other than cvsweb that is 
> displaying this message.

Indeed.  As far as I can tell, there's nothing wrong with the markup or
the link generated by cvsweb in this case, so upgrading it to a newer
version wouldn't help.

> > I have CC'ed the cvsweb maintainer to hear if he has any comments on
> > the impact of doing an upgrade (mainly if there are any know
> > incompatibilities).

See above.

> Perhaps he knows about the above mentioned error message displayed 
> when browsing to 
> http://www.freebsd.org/cgi/cvsweb.cgi/ports/devel/gdb6/files/patch-
> i386%25nm-fbsd64.h

It's probably generated by a broken/misbehaving proxy somewhere in front
of that cvsweb instance.  Responses from that URL contain: "X-Cache: HIT
from localhost, MISS from www.FreeBSD.org".  Wherever the proxy server
announcing itself proudly as "localhost" and producing a HIT is, one
might find the problem too.  Anyway, even if it wouldn't be the guilty
one, it could be a good idea to configure the proxy software to send a
sane hostname...

On 10 Apr 2005 at 0:53, Ville Skytt=E4 wrote:

> On Fri, 2005-04-08 at 06:37 -0400, Dan Langille wrote:
> > Your investigation prompted me to check my local repository which 
> > uses cvsweb-2.0.6.  cvsweb has no problem with that file.  I see that 
> > FreeBSD is using FreeBSD-CVSweb 2.0.6.  It has a problem with that 
> > file.
> > 
> > This suggests that the problem may not be with cvsweb, but with 
> > something else.  The error message:
> > 
> > Bad Request
> > Your browser sent a request that this server could not understand.
> > 
> > A grep of the repo projects/cvsweb does not find "Bad Request".  This 
> > also suggests it could be something other than cvsweb that is 
> > displaying this message.
> 
> Indeed.  As far as I can tell, there's nothing wrong with the markup or
> the link generated by cvsweb in this case, so upgrading it to a newer
> version wouldn't help.

It is valid HTML.  

http://validator.w3.org/check?uri=3Dhttp%3A%2F%2Fwww.freebsd.org%2Fcgi%2
Fcvsweb.cgi%2Fports%2Fdevel%2Fgdb6%2Ffiles%2F&charset=3Dutf-
8&doctype=3DInline&verbose=3D1

[also available as http://tinyurl.com/5dbao ]

> It's probably generated by a broken/misbehaving proxy somewhere in front
> of that cvsweb instance.  Responses from that URL contain: "X-Cache: HIT
> from localhost, MISS from www.FreeBSD.org".  Wherever the proxy server
> announcing itself proudly as "localhost" and producing a HIT is, one
> might find the problem too.  Anyway, even if it wouldn't be the guilty
> one, it could be a good idea to configure the proxy software to send a
> sane hostname...

Interesting....
-- 
Dan Langille : http://www.langille.org/
BSDCan - The Technical BSD Conference - http://www.bsdcan.org/
   NEW brochure available at http://www.bsdcan.org/2005/advocacy/

FYI and FWIW:

I was advised via IRC that "kuriama made some hack so it at least 
works."

And it does.  I gave FreshPorts a nudge and it successfully processed 
the affected commit.

-- 
Dan Langille : http://www.langille.org/
BSDCan - The Technical BSD Conference - http://www.bsdcan.org/
   NEW brochure available at http://www.bsdcan.org/2005/advocacy/

This PR can be closed IMHO.  cvsweb is now working as expected.

My thanks to those that helped resolve this problems.

-- 
Dan Langille : http://www.langille.org/
BSDCan - The Technical BSD Conference - http://www.bsdcan.org/
   NEW brochure available at http://www.bsdcan.org/2005/advocacy/

Comment 14 Pav Lucistnik 2005-04-19 16:43:37 UTC

State Changed
From-To: open->closed

Submitter reports the problem is resolved