Environment variables from host are sent to scripts

[gar3thjon3s]

The host operating system environment variables are being passed along to the scripts as they run. This should be restricted, with perhaps an option to add to a list (defaults to empty) of environment variables to "inherit" from the host operating system.

FIRST.

[asergeyev]

Is there any standard that says which variables are ok to pass? Any other HTTP server does the same?

[asergeyev]

Apache has directive for passing, no variables are passed by default https://httpd.apache.org/docs/2.4/mod/mod_env.html#passenv

Maybe websocketd might have no environment vars copied unless --passenv flag used?

[joewalnes]

Default should be only a select list of whitelisted variables. See http://golang.org/src/pkg/net/http/cgi/host.go#L34 for a good list.

I like the passenv flag. Users should be able to list multiple values. e.g. --passenv NAME1,NAME2

[asergeyev]

Ok, without passenv I will keep safe ones from cgi module, with passenv only those that's specified will be staying in env for launcher.

Also if passenv specified even cgi script will deal with sanitized environment.

[asergeyev]

Not changing examples at this point.

I'm also not sure what to do if someone decides to overwrite HTTP_ or other variable using bypass. Not sure how it should've worked.... Right now parent ENV will be a priority over created headers from the call.. Probably should just never pass those from outside that are in CGI spec
and in use...

[asergeyev]

Ok, that was confusing.... I suggest that for all passed variables if there is a need to create variable inside of env with same name, the value passed from outside be overwritten.

Also the variables that exist only in certain context (e.g. HTTPS) would not make any effect when passed using --passenv.

[asergeyev]

You seem not to be using config.Env but I'm not sure if it could be needed for something.

https://github.com/asergeyev/websocketd/compare/passenv

Variables in ParentEnv have very low priority and Env - very large. Let me know what you think please. Variable SERVER_SOFTWARE is only one that could be sent via passenv to override default... Not sure if it's undesirable but I find it nice to hide with "SERVER_SOFTWARE=Apache" in certain cases.

[asergeyev]

Note this conflicts with expectations set by #1

[asergeyev]

@gar3thjon3s I don't think you are following this ticket but if you decide to reopen it, go ahead.

So far it looks like problem you described should be fixed.