|
|
| version 1.185, 2009/05/04 09:26:19 | version 1.206, 2010/11/23 19:32:08 |
|---|---|
| Line 38 public: | Line 38 public: |
| VClassMAIN(); | VClassMAIN(); |
| }; | }; |
| // defines for globals | |
| #define CYCLE_DATA_NAME "CYCLE-DATA" | |
| // globals | |
| //^for & co | |
| String cycle_data_name(CYCLE_DATA_NAME); | |
| // defines for statics | // defines for statics |
| #define SWITCH_DATA_NAME "SWITCH-DATA" | #define SWITCH_DATA_NAME "SWITCH-DATA" |
| Line 70 static const String exception_var_name(E | Line 61 static const String exception_var_name(E |
| // helpers | // helpers |
| class Untaint_lang_name2enum: public Hash<const String::Body, String::Language> { | class Untaint_lang_name2enum: public HashString<String::Language> { |
| public: | public: |
| Untaint_lang_name2enum() { | Untaint_lang_name2enum() { |
| #define ULN(name, LANG) \ | #define ULN(name, LANG) \ |
| put(String::Body(name), (value_type)(String::L_##LANG)); | put(String::Body(name), (value_type)(String::L_##LANG)); |
| ULN("clean", CLEAN); | |
| ULN("as-is", AS_IS); | ULN("as-is", AS_IS); |
| ULN("optimized-as-is", AS_IS|String::L_OPTIMIZE_BIT); | ULN("optimized-as-is", AS_IS|String::L_OPTIMIZE_BIT); |
| ULN("file-spec", FILE_SPEC); | ULN("file-spec", FILE_SPEC); |
| Line 88 public: | Line 80 public: |
| ULN("html", HTML); | ULN("html", HTML); |
| ULN("optimized-html", HTML|String::L_OPTIMIZE_BIT); | ULN("optimized-html", HTML|String::L_OPTIMIZE_BIT); |
| ULN("regex", REGEX); | ULN("regex", REGEX); |
| ULN("parser-code", PARSER_CODE); | |
| ULN("json", JSON); | |
| #undef ULN | #undef ULN |
| } | } |
| } untaint_lang_name2enum; | } untaint_lang_name2enum; |
| Line 95 public: | Line 89 public: |
| // methods | // methods |
| static void _if(Request& r, MethodParams& params) { | static void _if(Request& r, MethodParams& params) { |
| bool condition=params.as_bool(0, "condition must be expression", r); | size_t max_param=params.count()-1; |
| if(condition) | size_t i=0; |
| r.process_write(*params.get(1)); | do { |
| else if(params.count()>2) | bool condition=params.as_bool(i, "condition must be expression", r); |
| r.process_write(*params.get(2)); | if(condition) { |
| r.process_write(*params.get(i+1)); | |
| return; | |
| } | |
| i+=2; | |
| } while (i < max_param); | |
| if(i == max_param) | |
| r.process_write(*params.get(i)); | |
| } | } |
| static String::Language get_untaint_lang(MethodParams& params, int index){ | static String::Language get_untaint_lang(MethodParams& params, int index){ |
| Line 123 static void _untaint(Request& r, MethodP | Line 125 static void _untaint(Request& r, MethodP |
| Value& vbody=params.as_junction(params.count()-1, "body must be code"); | Value& vbody=params.as_junction(params.count()-1, "body must be code"); |
| Temp_lang temp_lang(r, lang); // set temporarily specified ^untaint[language; | Temp_lang temp_lang(r, lang); // set temporarily specified ^untaint[language; |
| r.write_pass_lang(r.process(vbody)); // process marking tainted with that lang | StringOrValue result=r.process(vbody); // process marking tainted with that lang |
| r.write_assign_lang(result); | |
| } | } |
| } | } |
| Line 137 static void _taint(Request& r, MethodPar | Line 140 static void _taint(Request& r, MethodPar |
| { | { |
| Value& vbody=params.as_no_junction(params.count()-1, "body must not be code"); | Value& vbody=params.as_no_junction(params.count()-1, "body must not be code"); |
| String result; | String result(vbody.as_string(), lang); // force result language to specified |
| result.append( | r.write_assign_lang(result); |
| vbody.as_string(), // process marking tainted with that lang | |
| lang, true); // force result language to specified | |
| r.write_pass_lang(result); | |
| } | } |
| } | } |
| static void _apply_taint(Request& r, MethodParams& params) { | |
| String::Language lang=params.count()==1 ? String::L_AS_IS : get_untaint_lang(params, 0); | |
| const String &sbody=params.as_string(params.count()-1, "body must be string"); | |
| String::Body result_body=sbody.cstr_to_string_body_untaint(lang, 0, &r.charsets); | |
| r.write_pass_lang(*new String(result_body, String::L_AS_IS)); | |
| } | |
| static void _process(Request& r, MethodParams& params) { | static void _process(Request& r, MethodParams& params) { |
| Method* main_method; | Method* main_method; |
| Line 158 static void _process(Request& r, MethodP | Line 165 static void _process(Request& r, MethodP |
| } | } |
| { | { |
| VStateless_class *target_class=target_self->get_last_derived_class(); | VStateless_class *target_class=target_self->get_class(); |
| if(!target_class) | if(!target_class) |
| throw Exception(PARSER_RUNTIME, | throw Exception(PARSER_RUNTIME, |
| 0, | 0, |
| "no target class"); | "no target class"); |
| // temporary remove language change | // temporary remove language change |
| Temp_lang temp_lang(r, String::L_PASS_APPENDED); | Temp_lang temp_lang(r, String::L_PARSER_CODE); |
| // temporary zero @main so to maybe-replace it in processed code | // temporary zero @main so to maybe-replace it in processed code |
| Temp_method temp_method_main(*target_class, main_method_name, 0); | Temp_method temp_method_main(*target_class, main_method_name, 0); |
| // temporary zero @auto so it wouldn't be auto-called in Request::use_buf | // temporary zero @auto so it wouldn't be auto-called in Request::use_buf |
| Line 174 static void _process(Request& r, MethodP | Line 181 static void _process(Request& r, MethodP |
| size_t options_index=index+1; | size_t options_index=index+1; |
| HashStringValue* options=0; | HashStringValue* options=0; |
| if(options_index<params.count()) { | if(options_index<params.count()) { |
| Value& voptions=params.as_no_junction(options_index, "options must not be code"); | Value& voptions=params.as_no_junction(options_index, OPTIONS_MUST_NOT_BE_CODE); |
| options=voptions.get_hash(); | options=voptions.get_hash(); |
| if(!options) | if(!options) |
| throw Exception(PARSER_RUNTIME, | throw Exception(PARSER_RUNTIME, 0, OPTIONS_MUST_BE_HASH); |
| 0, | |
| "options must be hash"); | |
| } | } |
| const String* main_alias=0; | const String* main_alias=0; |
| Line 201 static void _process(Request& r, MethodP | Line 206 static void _process(Request& r, MethodP |
| } | } |
| if(valid_options!=options->count()) | if(valid_options!=options->count()) |
| throw Exception(PARSER_RUNTIME, | throw Exception(PARSER_RUNTIME, 0, CALLED_WITH_INVALID_OPTION); |
| 0, | |
| "called with invalid option"); | |
| } | } |
| uint processe_file_no=file_alias? | uint processe_file_no=file_alias? |
| Line 214 static void _process(Request& r, MethodP | Line 217 static void _process(Request& r, MethodP |
| // evaluate source to process | // evaluate source to process |
| const String& source=r.process_to_string(vjunction); | const String& source=r.process_to_string(vjunction); |
| r.use_buf(*target_class, | r.use_buf(*target_class, |
| source.cstr(String::L_UNSPECIFIED, r.connection(false)), | source.untaint_cstr(String::L_AS_IS, r.connection(false)), |
| main_alias, | main_alias, |
| processe_file_no, | processe_file_no, |
| line_no_alias_offset); | line_no_alias_offset); |
| Line 225 static void _process(Request& r, MethodP | Line 228 static void _process(Request& r, MethodP |
| // after restoring current-request-lang | // after restoring current-request-lang |
| // maybe-execute @main[] | // maybe-execute @main[] |
| if(main_method) { | if(main_method) { |
| // temporarily set method_frame's self to target_self | VMethodFrame frame(*main_method, r.get_method_frame()->caller(), *target_self); |
| Temp_method_frame_self tmfs(*r.get_method_frame(), *target_self); | frame.empty_params(); |
| // execute! | r.op_call(frame); |
| r.execute(*main_method->parser_code); | r.write_pass_lang(frame.result()); |
| } | } |
| } | } |
| Line 237 static void _rem(Request&, MethodParams& | Line 240 static void _rem(Request&, MethodParams& |
| } | } |
| static void _while(Request& r, MethodParams& params) { | static void _while(Request& r, MethodParams& params) { |
| Temp_hash_value<const String::Body, void*> | InCycle temp(r); |
| cycle_data_setter(r.classes_conf, cycle_data_name, /*any not null flag*/&r); | |
| Value& vcondition=params.as_expression(0, "condition must be number, bool or expression"); | Value& vcondition=params.as_expression(0, "condition must be number, bool or expression"); |
| Line 247 static void _while(Request& r, MethodPar | Line 249 static void _while(Request& r, MethodPar |
| // while... | // while... |
| int endless_loop_count=0; | int endless_loop_count=0; |
| if(delim_maybe_code){ | if(delim_maybe_code){ // delimiter set |
| bool need_delim=false; | bool need_delim=false; |
| while(true) { | while(true) { |
| if(++endless_loop_count>=MAX_LOOPS) // endless loop? | if(++endless_loop_count>=MAX_LOOPS) // endless loop? |
| Line 260 static void _while(Request& r, MethodPar | Line 262 static void _while(Request& r, MethodPar |
| StringOrValue sv_processed=r.process(body_code); | StringOrValue sv_processed=r.process(body_code); |
| Request::Skip lskip=r.get_skip(); r.set_skip(Request::SKIP_NOTHING); | Request::Skip lskip=r.get_skip(); r.set_skip(Request::SKIP_NOTHING); |
| const String* s_processed=sv_processed.get_string(); | const String* s_processed=sv_processed.get_string(); |
| if(delim_maybe_code && s_processed && s_processed->length()) { // delimiter set and we have body | if(s_processed && !s_processed->is_empty()) { // we have body |
| if(need_delim) // need delim & iteration produced string? | if(need_delim) // need delim & iteration produced string? |
| r.write_pass_lang(r.process(*delim_maybe_code)); | r.write_pass_lang(r.process(*delim_maybe_code)); |
| else | else |
| Line 293 static void _while(Request& r, MethodPar | Line 296 static void _while(Request& r, MethodPar |
| static void _use(Request& r, MethodParams& params) { | static void _use(Request& r, MethodParams& params) { |
| Value& vfile=params.as_no_junction(0, FILE_NAME_MUST_NOT_BE_CODE); | Value& vfile=params.as_no_junction(0, FILE_NAME_MUST_NOT_BE_CODE); |
| r.use_file(r.main_class, vfile.as_string()); | |
| // _use could be called from the parser3 method only, so caller is always defined | |
| r.use_file(r.main_class, vfile.as_string(), r.get_method_filename(&r.get_method_frame()->caller()->method)); | |
| } | } |
| static void set_skip(Request& r, Request::Skip askip) { | static void set_skip(Request& r, Request::Skip askip) { |
| void* data=r.classes_conf.get(cycle_data_name); | if(!r.get_in_cycle()) |
| if(!data) | |
| throw Exception(PARSER_RUNTIME, | throw Exception(PARSER_RUNTIME, |
| 0, | 0, |
| "without cycle"); | "without cycle"); |
| Line 315 static void _continue(Request& r, Method | Line 319 static void _continue(Request& r, Method |
| } | } |
| static void _for(Request& r, MethodParams& params) { | static void _for(Request& r, MethodParams& params) { |
| Temp_hash_value<const String::Body, void*> | InCycle temp(r); |
| cycle_data_setter(r.classes_conf, cycle_data_name, /*any not null flag*/&r); | |
| const String& var_name=params.as_string(0, "var name must be string"); | const String& var_name=params.as_string(0, "var name must be string"); |
| int from=params.as_int(1, "from must be int", r); | int from=params.as_int(1, "from must be int", r); |
| int to=params.as_int(2, "to must be int", r); | int to=params.as_int(2, "to must be int", r); |
| Value& body_code=params.as_junction(3, "body must be code"); | Value& body_code=params.as_junction(3, "body must be code"); |
| Value* delim_maybe_code=params.count()>4?¶ms[4]:0; | Value* delim_maybe_code=params.count()>4?¶ms[4]:0; |
| if(to-from>=MAX_LOOPS) // too long loop? | if(to-from>=MAX_LOOPS) // too long loop? |
| Line 332 static void _for(Request& r, MethodParam | Line 335 static void _for(Request& r, MethodParam |
| VInt* vint=new VInt(0); | VInt* vint=new VInt(0); |
| VMethodFrame& caller=*r.get_method_frame()->caller(); | VMethodFrame& caller=*r.get_method_frame()->caller(); |
| caller.put_element(caller, var_name, vint, false); | caller.put_element(var_name, vint, false); |
| if(delim_maybe_code){ | if(delim_maybe_code){ // delimiter set |
| bool need_delim=false; | bool need_delim=false; |
| for(int i=from; i<=to; i++) { | for(int i=from; i<=to; i++) { |
| Line 341 static void _for(Request& r, MethodParam | Line 344 static void _for(Request& r, MethodParam |
| StringOrValue sv_processed=r.process(body_code); | StringOrValue sv_processed=r.process(body_code); |
| Request::Skip lskip=r.get_skip(); r.set_skip(Request::SKIP_NOTHING); | Request::Skip lskip=r.get_skip(); r.set_skip(Request::SKIP_NOTHING); |
| const String* s_processed=sv_processed.get_string(); | const String* s_processed=sv_processed.get_string(); |
| if(s_processed && s_processed->length()) { // delimiter set and we have body | if(s_processed && !s_processed->is_empty()) { // we have body |
| if(need_delim) // need delim & iteration produced string? | if(need_delim) // need delim & iteration produced string? |
| r.write_pass_lang(r.process(*delim_maybe_code)); | r.write_pass_lang(r.process(*delim_maybe_code)); |
| else | else |
| Line 390 struct timeval mt[2]; | Line 394 struct timeval mt[2]; |
| Value& body_code=params.as_junction(1, "body must be code"); | Value& body_code=params.as_junction(1, "body must be code"); |
| Table* protocol2driver_and_client=0; | Table* protocol2driver_and_client=0; |
| if(Value* sql=r.main_class.get_element(String(MAIN_SQL_NAME), r.main_class, false)) { | if(Value* sql=r.main_class.get_element(String(MAIN_SQL_NAME))) { |
| if(Value* element=sql->get_element(String(MAIN_SQL_DRIVERS_NAME), *sql, false)) { | if(Value* element=sql->get_element(String(MAIN_SQL_DRIVERS_NAME))) { |
| protocol2driver_and_client=element->get_table(); | protocol2driver_and_client=element->get_table(); |
| } | } |
| } | } |
| Line 419 r.sql_connect_time+=t[1]-t[0]; | Line 423 r.sql_connect_time+=t[1]-t[0]; |
| Temp_connection temp_connection(r, connection); | Temp_connection temp_connection(r, connection); |
| // execute body | // execute body |
| try { | try { |
| r.write_assign_lang(r.process(body_code)); | r.process_write(body_code); |
| connection->commit(); | connection->commit(); |
| connection->close(); | connection->close(); |
| } catch(...) { // process problem | } catch(...) { // process problem |
| Line 539 static Try_catch_result try_catch(Reques | Line 543 static Try_catch_result try_catch(Reques |
| Junction* junction=catch_code->get_junction(); | Junction* junction=catch_code->get_junction(); |
| Value* method_frame=junction->method_frame; | Value* method_frame=junction->method_frame; |
| Value* saved_exception_var_value=method_frame->get_element(exception_var_name, *method_frame, false); | Value* saved_exception_var_value=method_frame->get_element(exception_var_name); |
| VMethodFrame& frame=*junction->method_frame; | VMethodFrame& frame=*junction->method_frame; |
| frame.put_element(frame, exception_var_name, &details.vhash, false); | frame.put_element(exception_var_name, &details.vhash, false); |
| result.processed_code=r.process(*catch_code); | result.processed_code=r.process(*catch_code); |
| // retriving $exception.handled, restoring $exception var | // retriving $exception.handled, restoring $exception var |
| Value* vhandled=details.vhash.hash().get(exception_handled_part_name); | Value* vhandled=details.vhash.hash().get(exception_handled_part_name); |
| frame.put_element(frame, exception_var_name, saved_exception_var_value, false); | frame.put_element(exception_var_name, saved_exception_var_value, false); |
| bool bhandled=false; | bool bhandled=false; |
| if(vhandled) { | if(vhandled) { |
| Line 710 static Cache_get_result cache_get(Reques | Line 714 static Cache_get_result cache_get(Reques |
| static time_t as_expires(Request& r, MethodParams& params, | static time_t as_expires(Request& r, MethodParams& params, |
| int index, time_t now) { | int index, time_t now) { |
| time_t result; | time_t result; |
| if(Value* vdate=params[index].as(VDATE_TYPE, false)) | if(Value* vdate=params[index].as(VDATE_TYPE)) |
| result=static_cast<VDate*>(vdate)->get_time(); | result=static_cast<VDate*>(vdate)->get_time(); |
| else | else |
| result=now+(time_t)params.as_double(index, "lifespan must be date or number", r); | result=now+(time_t)params.as_double(index, "lifespan must be date or number", r); |
| Line 872 static void _throw_operator(Request&, Me | Line 876 static void _throw_operator(Request&, Me |
| static void _sleep_operator(Request& r, MethodParams& params) { | static void _sleep_operator(Request& r, MethodParams& params) { |
| double seconds=params.as_double(0, "seconds must be double", r); | double seconds=params.as_double(0, "seconds must be double", r); |
| pa_sleep((int)trunc(seconds), (int)trunc(seconds*1000)); | if(seconds>0) |
| pa_sleep((int)trunc(seconds), (int)trunc((seconds-trunc(seconds))*1000000)); | |
| } | } |
| #if defined(WIN32) && defined(_DEBUG) | #if defined(WIN32) && defined(_DEBUG) |
| Line 894 VClassMAIN::VClassMAIN(): VClass() { | Line 899 VClassMAIN::VClassMAIN(): VClass() { |
| // ^if(condition){code-when-true} | // ^if(condition){code-when-true} |
| // ^if(condition){code-when-true}{code-when-false} | // ^if(condition){code-when-true}{code-when-false} |
| add_native_method("if", Method::CT_ANY, _if, 2, 3, Method::CO_WITHOUT_FRAME); | // ^if(condition){code-when-true} (another condition){code-when-true} ... {code-when-false} |
| add_native_method("if", Method::CT_ANY, _if, 2, 10000, Method::CO_WITHOUT_FRAME); | |
| // ^untaint[as-is|uri|sql|js|html|html-typo|regex|parser-code]{code} | |
| add_native_method("untaint", Method::CT_ANY, _untaint, 1, 2, Method::CO_WITHOUT_FRAME); | |
| // ^untaint[as-is|uri|sql|js|html|html-typo|regex]{code} | // ^taint[as-is|uri|sql|js|html|html-typo|regex|parser-code]{code} |
| add_native_method("untaint", Method::CT_ANY, _untaint, 1, 2, Method::CO_NONE); | add_native_method("taint", Method::CT_ANY, _taint, 1, 2, Method::CO_WITHOUT_FRAME); |
| // ^taint[as-is|uri|sql|js|html|html-typo|regex]{code} | // ^apply-taint[untaint lang][string] |
| add_native_method("taint", Method::CT_ANY, _taint, 1, 2, Method::CO_NONE); | add_native_method("apply-taint", Method::CT_ANY, _apply_taint, 1, 2, Method::CO_WITHOUT_FRAME); |
| // ^process[code] | // ^process[code] |
| add_native_method("process", Method::CT_ANY, _process, 1, 3); | add_native_method("process", Method::CT_ANY, _process, 1, 3); |