escape space, etc in $memcached_key

3 files changed, 41 insertions, 11 deletions

diff --git a/src/core/ngx_string.c b/src/core/ngx_string.c
index 6a927b03b..a07dbebeb 100644
--- a/src/core/ngx_string.c
+++ b/src/core/ngx_string.c
@@ -1059,7 +1059,27 @@ ngx_escape_uri(u_char *dst, u_char *src, size_t size, ngx_uint_t type)
         0xffffffff  /* 1111 1111 1111 1111  1111 1111 1111 1111 */
     };
 
-    static uint32_t  *map[] = { uri, args, html, refresh };
+                    /* " ", %00-%1F */
+
+    static uint32_t   memcached[] = {
+        0xffffffff, /* 1111 1111 1111 1111  1111 1111 1111 1111 */
+
+                    /* ?>=< ;:98 7654 3210  /.-, +*)( '&%$ #"!  */
+        0x00000001, /* 0000 0000 0000 0000  0000 0000 0000 0001 */
+
+                    /* _^]\ [ZYX WVUT SRQP  ONML KJIH GFED CBA@ */
+        0x00000000, /* 0000 0000 0000 0000  0000 0000 0000 0000 */
+
+                    /*  ~}| {zyx wvut srqp  onml kjih gfed cba` */
+        0x00000000, /* 0000 0000 0000 0000  0000 0000 0000 0000 */
+
+        0x00000000, /* 0000 0000 0000 0000  0000 0000 0000 0000 */
+        0x00000000, /* 0000 0000 0000 0000  0000 0000 0000 0000 */
+        0x00000000, /* 0000 0000 0000 0000  0000 0000 0000 0000 */
+        0x00000000, /* 0000 0000 0000 0000  0000 0000 0000 0000 */
+    };
+
+    static uint32_t  *map[] = { uri, args, html, refresh, memcached };
 
 
     escape = map[type];
diff --git a/src/core/ngx_string.h b/src/core/ngx_string.h
index 9e0b06394..b4a96c543 100644
--- a/src/core/ngx_string.h
+++ b/src/core/ngx_string.h
@@ -150,12 +150,13 @@ size_t ngx_utf_length(u_char *p, size_t n);
 u_char *ngx_utf_cpystrn(u_char *dst, u_char *src, size_t n);
 
 
-#define NGX_ESCAPE_URI       0
-#define NGX_ESCAPE_ARGS      1
-#define NGX_ESCAPE_HTML      2
-#define NGX_ESCAPE_REFRESH   3
+#define NGX_ESCAPE_URI        0
+#define NGX_ESCAPE_ARGS       1
+#define NGX_ESCAPE_HTML       2
+#define NGX_ESCAPE_REFRESH    3
+#define NGX_ESCAPE_MEMCACHED  4
 
-#define NGX_UNESCAPE_URI     1
+#define NGX_UNESCAPE_URI      1
 
 uintptr_t ngx_escape_uri(u_char *dst, u_char *src, size_t size,
     ngx_uint_t type);
@@ -164,11 +165,11 @@ void ngx_unescape_uri(u_char **dst, u_char **src, size_t size, ngx_uint_t type);
 
 void ngx_sort(void *base, size_t n, size_t size,
     int (*cmp)(const void *, const void *));
-#define ngx_qsort            qsort
+#define ngx_qsort             qsort
 
 
-#define ngx_value_helper(n)  #n
-#define ngx_value(n)         ngx_value_helper(n)
+#define ngx_value_helper(n)   #n
+#define ngx_value(n)          ngx_value_helper(n)
 
 
 #endif /* _NGX_STRING_H_INCLUDED_ */
diff --git a/src/http/modules/ngx_http_memcached_module.c b/src/http/modules/ngx_http_memcached_module.c
index 3430cbb65..f7205418c 100644
--- a/src/http/modules/ngx_http_memcached_module.c
+++ b/src/http/modules/ngx_http_memcached_module.c
@@ -226,6 +226,7 @@ static ngx_int_t
 ngx_http_memcached_create_request(ngx_http_request_t *r)
 {
     size_t                          len;
+    uintptr_t                       escape;
     ngx_buf_t                      *b;
     ngx_chain_t                    *cl;
     ngx_http_memcached_ctx_t       *ctx;
@@ -242,7 +243,9 @@ ngx_http_memcached_create_request(ngx_http_request_t *r)
         return NGX_ERROR;
     }
 
-    len = sizeof("get ") - 1 + vv->len + sizeof(CRLF) - 1;
+    escape = 2 * ngx_escape_uri(NULL, vv->data, vv->len, NGX_ESCAPE_MEMCACHED);
+
+    len = sizeof("get ") - 1 + vv->len + escape + sizeof(CRLF) - 1;
 
     b = ngx_create_temp_buf(r->pool, len);
     if (b == NULL) {
@@ -265,7 +268,13 @@ ngx_http_memcached_create_request(ngx_http_request_t *r)
 
     ctx->key.data = b->last;
 
-    b->last = ngx_copy(b->last, vv->data, vv->len);
+    if (escape == 0) {
+        b->last = ngx_copy(b->last, vv->data, vv->len);
+
+    } else {
+        b->last = (u_char *) ngx_escape_uri(b->last, vv->data, vv->len,
+                                            NGX_ESCAPE_MEMCACHED);
+    }
 
     ctx->key.len = b->last - ctx->key.data;