Bug 1651746

I hit an old bug in mod_fcgid with mod_fcgid-2.3.9-12.el8.x86_64 already reported to upstream <https://bz.apache.org/bugzilla/show_bug.cgi?id=52710> about wrong PATH_INFO FastCGI variable past to a virtual FcgidWrapper script.

If you configure mod_fcgid to pass all requests to /usr/local/bin/psgiwrapper.fcgi FCGI program with following /etc/httpd/conf.d/fcgid.conf httpd configuration:

<Location />
  SetHandler fcgid-script
  Options +ExecCGI
  FcgidWrapper "/usr/local/bin/psgiwrapper.fcgi" virtual
</Location>

and the purpose of /usr/local/bin/psgiwrapper.fcgi is to return all FCGI (and POSIX) environment variables, e.g. with this Perl program (you need FCGI Perl module for that not available in RHEL, compile and install perl-FCGI package from Fedora):

#!/usr/bin/perl
use FCGI ();
my %fenv;
my $request = FCGI::Request(\*STDIN, \*STDOUT, \*STDERR, \%fenv, 0,
        FCGI::FAIL_ACCEPT_ON_INTR);
use Data::Dumper ();
$Data::Dumper::Sortkeys = 1;
while($request->Accept() >= 0) {
        print("Content-Type: text/plain\r\n\r\n");
        print("fenv: " . Data::Dumper::Dumper(\%fenv));
        print("ENV: " . Data::Dumper::Dumper(\%ENV));
}

Then you can try various requests toward localhost to see the FastCGI variables passed from httpd to the /usr/local/bin/psgiwrapper.fcgi script.

E.g. requesting root document shows no PATH_INFO variable and '/' SCRIPT_NAME:

$ wget -S -O - -q http://localhost/
  HTTP/1.1 200 OK
  Date: Tue, 20 Nov 2018 16:15:28 GMT
  Server: Apache/2.4.35 (Red Hat Enterprise Linux) mod_fcgid/2.3.9
  Keep-Alive: timeout=5, max=100
  Connection: Keep-Alive
  Transfer-Encoding: chunked
  Content-Type: text/plain; charset=UTF-8
fenv: $VAR1 = {
          'CONTEXT_DOCUMENT_ROOT' => '/var/www/html',
          'CONTEXT_PREFIX' => '',
          'DOCUMENT_ROOT' => '/var/www/html',
          'FCGI_ROLE' => 'RESPONDER',
          'GATEWAY_INTERFACE' => 'CGI/1.1',
          'HTTP_ACCEPT' => '*/*',
          'HTTP_ACCEPT_ENCODING' => 'identity',
          'HTTP_CONNECTION' => 'close',
          'HTTP_HOST' => 'localhost',
          'HTTP_USER_AGENT' => 'Wget/1.19.5 (linux-gnu)',
          'PATH' => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin',
          'QUERY_STRING' => '',
          'REMOTE_ADDR' => '::1',
          'REMOTE_PORT' => '37730',
          'REQUEST_METHOD' => 'GET',
          'REQUEST_SCHEME' => 'http',
          'REQUEST_URI' => '/',
          'SCRIPT_FILENAME' => '/var/www/html/',
          'SCRIPT_NAME' => '/',
          'SERVER_ADDR' => '::1',
          'SERVER_ADMIN' => 'root@localhost',
          'SERVER_NAME' => 'localhost',
          'SERVER_PORT' => '80',
          'SERVER_PROTOCOL' => 'HTTP/1.1',
          'SERVER_SIGNATURE' => '',
          'SERVER_SOFTWARE' => 'Apache/2.4.35 (Red Hat Enterprise Linux) mod_fcgid/2.3.9',
          'UNIQUE_ID' => 'W-QzIPCUedqsHkC4H1DVcwAAABA'
        };
ENV: $VAR1 = {
          'PATH' => '/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin'
        };

Requesting /foo returns:

          NO PATH_NAME variable and
          'SCRIPT_NAME' => '/foo',

Requesting /foo/ returns:

          'PATH_INFO' => '/',
          'SCRIPT_NAME' => '/foo',

Requesting /foo/bar returns:

          'PATH_INFO' => '/bar',
          'SCRIPT_NAME' => '/foo',

Requesting /foo/bar/ returns:

          'PATH_INFO' => '/bar/',
          'SCRIPT_NAME' => '/foo',

Requesting /foo/bar/baz returns:

          'PATH_INFO' => '/bar/baz',
          'SCRIPT_NAME' => '/foo',

I will repeat requesting / returns:

          NO PATH_NAME variable and
          'SCRIPT_NAME' => '/',

And this is the issue. It seems like PATH_INFO is always missing the fist-level path component except for because httpd thinks it's the SCRIPT_NAME. But virtual wrapper directive <https://httpd.apache.org/mod_fcgid/mod/mod_fcgid.html#fcgidwrapper> means there is no real script. Thus the invoked URI path should go to PATH_INFO and SCRIPT_NAME should be empty.

The meaning of the variables is defined in <https://tools.ietf.org/html/rfc3875>. Apache httpd follows CGI convention for FastCGI (https://bz.apache.org/bugzilla/show_bug.cgi?id=50851).

This bug prevents an FCGI application mounted into the document root ("/") from retrieving the application path properly. From the RFC:

  The PATH_INFO variable specifies a path to be interpreted by the CGI script.

In case of mod_fcgid, the PATH_INFO is missing the first path component and thus provides wrong input to FCGI applications.