www-cgi/: Decentralize the whitelist of environment variables.

[userv-utils.git] / www-cgi / ucgi.c

diff --git a/www-cgi/ucgi.c b/www-cgi/ucgi.c
index 431d280c9cd0e1a4304e06c420b63e6f0e949e28..006f8ae4cd93223986d15c146967d032908eeefa 100644 (file)
--- a/www-cgi/ucgi.c
+++ b/www-cgi/ucgi.c
@@ -30,6 +30,25 @@
 
 #include "ucgi.h"
 
+static const char *const envok[] = {
+  "AUTH_TYPE",
+  "CONTENT_TYPE",
+  "CONTENT_LENGTH",
+  "DOCUMENT_ROOT",
+  "GATEWAY_INTERFACE",
+  "HTTP_*",
+  "HTTPS",
+  "PATH_INFO",
+  "PATH_TRANSLATED",
+  "QUERY_STRING",
+  "REMOTE_*",
+  "REQUEST_METHOD",
+  "REQUEST_URI",
+  "SCRIPT_*",
+  "SERVER_*",
+  0
+};
+
 struct buildargs {
   const char **v;
   int n, max;
@@ -40,8 +59,9 @@ static void addarg(struct buildargs *args, const char *a) {
   args->v[args->n++]= a;
 }
 
-static void add_userv_var(const char *en, const char *ev,
-                         struct buildargs *args) {
+static void add_userv_var(const char *fulln,
+                         const char *en, const char *ev, void *p) {
+  struct buildargs *args= p;
   size_t l;
   char *a;
 
@@ -53,8 +73,7 @@ static void add_userv_var(const char *en, const char *ev,
 
 int main(int argc, const char **argv) {
   char *username;
-  const char *slash2, *pathi, *ev, *en, *av;
-  const char *const *ep;
+  const char *slash2, *pathi, *av;
   size_t usernamelen, l;
   struct buildargs args;
   pid_t child, rchild;
@@ -90,16 +109,13 @@ int main(int argc, const char **argv) {
   if (!isalpha(username[0])) error("username 1st character is not alphabetic");
   xsetenv("PATH_INFO",slash2,1);
 
-  args.n= 0; args.max= argc + nenvok + 10;
+  args.n= 0; args.max= argc + MAX_ENVVARS + 10;
   args.v= xmalloc(args.max * sizeof(*args.v));
   
   addarg(&args, "userv");
   if (debugmode) addarg(&args, "-DDEBUG=1");
 
-  for (ep= envok; (en= *ep); ep++) {
-    ev= getenv(en); if (!ev) continue;
-    add_userv_var(en, ev, &args);
-  }
+  filter_environment(FILTF_WILDCARD, "", envok, add_userv_var, &args);
 
   addarg(&args, username);
   addarg(&args, "www-cgi");