Perl, CGI, IIS 6 and query string without =

blahblah.cgi?query gives CGI error

[JollyK]

Okay. There's an IIS 6 server where any Perl CGI script when called as:

[whatever...]

or

[whatever...]

works fine.

However, a cgi script called as

[whatever...]

gives "CGI Script Error." (Windows equivalent of "Internal Server Error.") I've verified this with a script that just does

print "Content-type: text/html\n\n";
print "Query string is $ENV{'QUERY_STRING'}";

Now, I've worked with a lot of CGI scripts on a lot of platforms over the years, and I have never, ever seen any problem with calling a script as blahblah.cgi?someargument.

I've searched around and haven't found an answer. Does anyone have any idea why this might be happening? Or where to look for a solution? Is this something I missed in the CGI specification that Microsoft is finally enforcing?

JK

[jatar_k]

Hm strange, can't say I know why exactly it is doing that. As soon as you drop the = it bombs.

Anyone have any ideas?

[sugarkane]

At a guess, it could be related to the various query string related exploits that have hit IIS over the last couple of years.

Maybe the developers have made the query parser overly strict in what it will accept, and anything that doesn't match the traditional?var=value format is rejected?

AFAIK the RFCs allow the query to be in any format so long as it's properly URL encoded...

[JollyK]

According to the CGI specification, blah.cgi?argument sets $ARGV[0] (in Perl terms) to "argument". As soon as there is an unescaped = sign, then $ARGV[0] doesn't get set at all.

So, this usage is legitimate by spec. My thinking was that it was some sort of security thing too, sugarkane. Grr.

Wish I knew exactly what setting it was, though, so I could tell 'em. All I have is IIS 5 or Apache on Win 2000, and I don't want to buy Win 2003/IIS 6 just to figure out this one weirdness. :-)

Thanks for your insight, folks.

JK

[JollyK]

More info: We tried a script like this:

#!/usr/bin/perl

print "Content-type: text/html\n\n";
print "Query string is '$ENV{'QUERY_STRING'}'<br>";

Calling it as script.cgi?blah gave the error.

Calling it as script.cgi?blah=blah printed "Query string is 'blah=blah'". So it's definitely something odd with just that bit.

Guess I'm off to rewrite everything to use key=value or POST instead.

Grr. Be nice if I knew exactly what config option that was in IIS 6, though, or if it's a default config of some sort.