|
|
| version 1.107.2.16.2.18, 2003/05/30 09:47:11 | version 1.111.4.1, 2003/09/24 14:32:05 |
|---|---|
| Line 23 static const char* IDENT_FILE_C="$Date$" | Line 23 static const char* IDENT_FILE_C="$Date$" |
| #include "pa_dir.h" | #include "pa_dir.h" |
| #include "pa_vtable.h" | #include "pa_vtable.h" |
| #include "pa_charset.h" | #include "pa_charset.h" |
| #include "pa_charsets.h" | |
| // defines | // defines |
| #define TEXT_MODE_NAME "text" | #define TEXT_MODE_NAME "text" |
| #define STDIN_EXEC_PARAM_NAME "stdin" | #define STDIN_EXEC_PARAM_NAME "stdin" |
| #define CHARSET_EXEC_PARAM_NAME "charset" | |
| // class | // class |
| Line 96 static const char* suexec_safe_env_lst[] | Line 98 static const char* suexec_safe_env_lst[] |
| // statics | // statics |
| static const StringBody adate_name("adate"); | static const String::Body adate_name("adate"); |
| static const StringBody mdate_name("mdate"); | static const String::Body mdate_name("mdate"); |
| static const StringBody cdate_name("cdate"); | static const String::Body cdate_name("cdate"); |
| // methods | // methods |
| Line 186 static void _stat(Request& r, MethodPara | Line 188 static void _stat(Request& r, MethodPara |
| } | } |
| static bool is_safe_env_key(const char* key) { | static bool is_safe_env_key(const char* key) { |
| for(const char* validator=key; *validator; validator++) { | |
| char c=*validator; | |
| if(!(c>='A' && c<='Z' || c>='0' && c<='9' || c=='_' || c=='-')) | |
| return false; | |
| } | |
| if(strncasecmp(key, "HTTP_", 5)==0) | if(strncasecmp(key, "HTTP_", 5)==0) |
| return true; | return true; |
| if(strncasecmp(key, "CGI_", 4)==0) | if(strncasecmp(key, "CGI_", 4)==0) |
| Line 200 static bool is_safe_env_key(const char* | Line 207 static bool is_safe_env_key(const char* |
| struct Append_env_pair_info { | struct Append_env_pair_info { |
| HashStringString* env; | HashStringString* env; |
| Value* vstdin; | Value* vstdin; |
| Value* vcharset; | |
| }; | }; |
| #endif | #endif |
| static void append_env_pair( | static void append_env_pair( |
| Line 208 static void append_env_pair( | Line 216 static void append_env_pair( |
| Append_env_pair_info *info) { | Append_env_pair_info *info) { |
| if(akey==STDIN_EXEC_PARAM_NAME) { | if(akey==STDIN_EXEC_PARAM_NAME) { |
| info->vstdin=avalue; | info->vstdin=avalue; |
| } else if(akey==CHARSET_EXEC_PARAM_NAME) { | |
| info->vcharset=avalue; | |
| } else { | } else { |
| if(!is_safe_env_key(akey.cstr())) | if(!is_safe_env_key(akey.cstr())) |
| throw Exception("parser.runtime", | throw Exception("parser.runtime", |
| Line 248 static void _exec_cgi(Request& r, Method | Line 258 static void _exec_cgi(Request& r, Method |
| #define ECSTR(name, value_cstr) \ | #define ECSTR(name, value_cstr) \ |
| if(value_cstr) \ | if(value_cstr) \ |
| env.put( \ | env.put( \ |
| StringBody(#name), \ | String::Body(#name), \ |
| StringBody(value_cstr, 0)); \ | String::Body(value_cstr, 0)); \ |
| // passing SAPI::environment | // passing SAPI::environment |
| if(const char *const *pairs=SAPI::environment(r.sapi_info)) { | if(const char *const *pairs=SAPI::environment(r.sapi_info)) { |
| while(const char* pair=*pairs++) | while(const char* pair=*pairs++) |
| if(const char* eq_at=strchr(pair, '=')) | if(const char* eq_at=strchr(pair, '=')) |
| env.put( | if(eq_at[1]) // has value |
| StringBody(pair, eq_at-pair), | env.put( |
| StringBody(eq_at+1, 0)); | pa_strdup(pair, eq_at-pair), |
| pa_strdup(eq_at+1, 0)); | |
| } | } |
| // const | // const |
| Line 273 static void _exec_cgi(Request& r, Method | Line 284 static void _exec_cgi(Request& r, Method |
| //String content_length(content_length_cstr); | //String content_length(content_length_cstr); |
| ECSTR(CONTENT_LENGTH, content_length_cstr); | ECSTR(CONTENT_LENGTH, content_length_cstr); |
| // SCRIPT_* | // SCRIPT_* |
| env.put(StringBody("SCRIPT_NAME"), script_name); | env.put(String::Body("SCRIPT_NAME"), script_name); |
| //env.put(StringBody("SCRIPT_FILENAME"), ??&script_name); | //env.put(String::Body("SCRIPT_FILENAME"), ??&script_name); |
| bool stdin_specified=false; | bool stdin_specified=false; |
| // environment & stdin from param | // environment & stdin from param |
| String in; | String *in=new String(); |
| Charset *charset=0; // default script works raw_in 'source' charset = no transcoding needed | |
| if(params.count()>1) { | if(params.count()>1) { |
| Value& venv=params.as_no_junction(1, "env must not be code"); | Value& venv=params.as_no_junction(1, "env must not be code"); |
| if(HashStringValue* user_env=venv.get_hash()) { | if(HashStringValue* user_env=venv.get_hash()) { |
| Append_env_pair_info info={&env}; | Append_env_pair_info info={&env}; |
| user_env->for_each(append_env_pair, &info); | user_env->for_each(append_env_pair, &info); |
| // $.stdin | |
| if(info.vstdin) { | if(info.vstdin) { |
| stdin_specified=true; | stdin_specified=true; |
| if(const String* sstdin=info.vstdin->get_string()) { | if(const String* sstdin=info.vstdin->get_string()) { |
| in.append(*sstdin, String::L_CLEAN, true); | in->append(*sstdin, String::L_CLEAN, true); |
| } else | } else |
| if(VFile* vfile=static_cast<VFile *>(info.vstdin->as("file", false))) | if(VFile* vfile=static_cast<VFile *>(info.vstdin->as("file", false))) |
| in.append_know_length((const char* )vfile->value_ptr(), vfile->value_size(), String::L_TAINTED); | in->append_know_length((const char* )vfile->value_ptr(), vfile->value_size(), String::L_TAINTED); |
| else | else |
| throw Exception("parser.runtime", | throw Exception("parser.runtime", |
| 0, | 0, |
| STDIN_EXEC_PARAM_NAME " parameter must be string or file"); | STDIN_EXEC_PARAM_NAME " parameter must be string or file"); |
| } | } |
| // $.charset | |
| if(info.vcharset) | |
| charset=&charsets.get(info.vcharset->as_string() | |
| .change_case(r.charsets.source(), String::CC_UPPER)); | |
| } | } |
| } | } |
| Line 306 static void _exec_cgi(Request& r, Method | Line 323 static void _exec_cgi(Request& r, Method |
| argv+=¶ms.as_string(i, "parameter must be string"); | argv+=¶ms.as_string(i, "parameter must be string"); |
| } | } |
| // passing POST data | // transcode if necessary |
| if(!stdin_specified) // if $.stdin[...] not specified @todo zeroterminate post_data! | if(charset) { |
| in.append_know_length(r.request_info.post_data, r.request_info.post_size, String::L_CLEAN); | Charset::transcode(env, r.charsets.source(), *charset); |
| Charset::transcode(argv, r.charsets.source(), *charset); | |
| in=&Charset::transcode(*in, r.charsets.source(), *charset); | |
| } | |
| // @todo | |
| // ifdef WIN32 do OEM->ANSI transcode on some(.cmd?) programs to | |
| // match silent conversion in OS | |
| // exec! | // exec! |
| PA_exec_result execution= | PA_exec_result execution= |
| pa_exec(false/*forced_allow*/, script_name, &env, argv, in); | pa_exec(false/*forced_allow*/, script_name, &env, argv, *in); |
| String *real_out=&execution.out; | |
| String *real_err=&execution.err; | |
| // transcode if necessary | |
| if(charset) { | |
| real_out=&Charset::transcode(*real_out, *charset, r.charsets.source()); | |
| real_err=&Charset::transcode(*real_err, *charset, r.charsets.source()); | |
| } | |
| VFile& self=GET_SELF(r, VFile); | VFile& self=GET_SELF(r, VFile); |
| const String* body=&execution.out; // ^file:exec | const String* body=real_out; // ^file:exec |
| Value* content_type=0; | Value* content_type=0; |
| const char* eol_marker=0; size_t eol_marker_size; | const char* eol_marker=0; size_t eol_marker_size; |
| const String* header=0; | const String* header=0; |
| if(cgi) { // ^file:cgi | if(cgi) { // ^file:cgi |
| // construct with 'out' body and header | // construct with 'out' body and header |
| size_t dos_pos=execution.out.pos("\r\n\r\n", 4); | size_t dos_pos=real_out->pos("\r\n\r\n", 4); |
| size_t unix_pos=execution.out.pos("\n\n", 2); | size_t unix_pos=real_out->pos("\n\n", 2); |
| bool unix_header_break; | bool unix_header_break; |
| switch((dos_pos!=STRING_NOT_FOUND?10:00) + (unix_pos!=STRING_NOT_FOUND?01:00)) { | switch((dos_pos!=STRING_NOT_FOUND?10:00) + (unix_pos!=STRING_NOT_FOUND?01:00)) { |
| Line 343 static void _exec_cgi(Request& r, Method | Line 374 static void _exec_cgi(Request& r, Method |
| "output does not contain CGI header; " | "output does not contain CGI header; " |
| "exit status=%d; stdoutsize=%u; stdout: \"%s\"; stderrsize=%u; stderr: \"%s\"", | "exit status=%d; stdoutsize=%u; stdout: \"%s\"; stderrsize=%u; stderr: \"%s\"", |
| execution.status, | execution.status, |
| (uint)execution.out.length(), execution.out.cstr(), | (uint)real_out->length(), real_out->cstr(), |
| (uint)execution.err.length(), execution.err.cstr()); | (uint)real_err->length(), real_err->cstr()); |
| break; //never reached | break; //never reached |
| } | } |
| Line 357 static void _exec_cgi(Request& r, Method | Line 388 static void _exec_cgi(Request& r, Method |
| eol_marker="\r\n"; eol_marker_size=2; | eol_marker="\r\n"; eol_marker_size=2; |
| } | } |
| header=&execution.out.mid(0, header_break_pos); | header=&real_out->mid(0, header_break_pos); |
| body=&execution.out.mid(header_break_pos+eol_marker_size*2, execution.out.length()); | body=&real_out->mid(header_break_pos+eol_marker_size*2, real_out->length()); |
| } | } |
| // body | // body |
| self.set(false/*not tainted*/, body->cstr(), body->length()); | self.set(false/*not tainted*/, body->cstr(), body->length()); |
| Line 368 static void _exec_cgi(Request& r, Method | Line 399 static void _exec_cgi(Request& r, Method |
| ArrayString rows; | ArrayString rows; |
| size_t pos_after=0; | size_t pos_after=0; |
| header->split(rows, pos_after, eol_marker); | header->split(rows, pos_after, eol_marker); |
| Pass_cgi_header_attribute_info info; | Pass_cgi_header_attribute_info info={0}; |
| info.charset=&r.charsets.source(); | info.charset=&r.charsets.source(); |
| info.fields=&self.fields(); | info.fields=&self.fields(); |
| rows.for_each(pass_cgi_header_attribute, &info); | rows.for_each(pass_cgi_header_attribute, &info); |
| Line 380 static void _exec_cgi(Request& r, Method | Line 411 static void _exec_cgi(Request& r, Method |
| self.fields().put(file_status_name, new VInt(execution.status)); | self.fields().put(file_status_name, new VInt(execution.status)); |
| // $stderr | // $stderr |
| if(execution.err.length()) | if(real_err->length()) |
| self.fields().put( | self.fields().put( |
| StringBody("stderr"), | String::Body("stderr"), |
| new VString(execution.err)); | new VString(*real_err)); |
| } | } |
| static void _exec(Request& r, MethodParams& params) { | static void _exec(Request& r, MethodParams& params) { |
| _exec_cgi(r, params, false); | _exec_cgi(r, params, false); |
| Line 469 static void lock_execute_body(int , void | Line 500 static void lock_execute_body(int , void |
| info.r->write_assign_lang(info.r->process(*info.body_code)); | info.r->write_assign_lang(info.r->process(*info.body_code)); |
| }; | }; |
| static void _lock(Request& r, MethodParams& params) { | static void _lock(Request& r, MethodParams& params) { |
| Lock_execute_body_info info; | Lock_execute_body_info info={0}; |
| info.r=&r; | info.r=&r; |
| const String& file_spec=r.absolute(params.as_string(0, "file name must be string")); | const String& file_spec=r.absolute(params.as_string(0, "file name must be string")); |
| info.body_code=¶ms.as_junction(1, "body must be code"); | info.body_code=¶ms.as_junction(1, "body must be code"); |
| Line 482 static int lastposafter(const String& s, | Line 513 static int lastposafter(const String& s, |
| if(beforelast) | if(beforelast) |
| size=s.length(); | size=s.length(); |
| int at; | int at; |
| while((at=s.pos(StringBody(substr, substr_size), after))!=STRING_NOT_FOUND) { | while((at=s.pos(String::Body(substr, substr_size), after))!=STRING_NOT_FOUND) { |
| size_t newafter=at+substr_size/*skip substr*/; | size_t newafter=at+substr_size/*skip substr*/; |
| if(beforelast && newafter==size) | if(beforelast && newafter==size) |
| break; | break; |