facebook / hhvm

A virtual machine for executing programs written in Hack.
https://hhvm.com
Other
18.14k stars 2.99k forks source link

The admin interface handles FCGI requests incorrectly #3379

Open lavagetto opened 10 years ago

lavagetto commented 10 years ago

While working on setting up a monitoring-management virtual host for the admin interface, I discovered that the HHVM admin interface just considers the original url of the HTTP request in order to build a response, and not the FastCGI variables like SCRIPT_NAME et cetera.

This makes practically impossible to serve the admin interface under a mountpoint: if I do like follows (for example, using apache):

ProxyPassMatch ^/hhvm-admin/(.*)$ fcgi://localhost:9500/$1

and then try to see the help page:

curl http://localhost/hhvm-admin/

I get inexpectedly a 404 with a message "Unknown command: hhvm-admin/"

I traced this to method AdminRequestHandler::handleRequest in hphp/runtime/server/admin-request-handler.cpp: at line 122 I see that the cmd variable that will later be used as the command to execute gets assigned as follows

std::string cmd = transport->getCommand();

and the transport->getCommand method ends up calling URL::getCommand() which will (I guess, I had no time/ability to investigate further) operate on the HTTP_URL and not on the appropriate FastCGI variables, thus making any attempt at serving the admin interface in any way but with a dedicated VirtualHost vane.

lavagetto commented 10 years ago

For the sake of completeness, I wrote a small perl script to dump the variables apache with mod-proxy-fastcgi passes to the hhvm server, tampered with them and resubmitted via a fastcgi client. I was able to determine that the admin fcgi interface does indeed use SCRIPT_NAME and simply ignores any other CGI variable set by the server, and not the SCRIPT_FILENAME in any way. It isn't the most standard way of implementing RFC 3875 server-side, but still with nginx instead of Apache it's possible to work around this issue. This could just become a documentation issue if you wish.