X-Git-Url: http://www.chiark.greenend.org.uk/ucgi/~ian/git?p=userv-utils.git;a=blobdiff_plain;f=www-cgi%2Fucgi.c;h=fc9888b0637529e37696e80fa01f8ffe52b534b4;hp=0e11624a357ed216da0c33bc8555b6173f9b0f84;hb=2cbcd670c5dfcda374720737fa5a5cd0be93e338;hpb=a33962bafa2a1e3d54e4ca1e2e8f3161d6cdf6b0 diff --git a/www-cgi/ucgi.c b/www-cgi/ucgi.c index 0e11624..fc9888b 100644 --- a/www-cgi/ucgi.c +++ b/www-cgi/ucgi.c @@ -2,11 +2,16 @@ * Usage: as CGI script */ /* - * Copyright (C) 1998-1999 Ian Jackson + * Copyright 1996-2013,2016 Ian Jackson + * Copyright 1998 David Damerell + * Copyright 1999,2003 + * Chancellor Masters and Scholars of the University of Cambridge + * Copyright 2010 Tony Finch + * Copyright 2013,2016 Mark Wooding * * This is free software; you can redistribute it and/or modify it * under the terms of the GNU General Public License as published by - * the Free Software Foundation; either version 2 of the License, or + * the Free Software Foundation; either version 3 of the License, or * (at your option) any later version. * * This program is distributed in the hope that it will be useful, but @@ -15,10 +20,7 @@ * General Public License for more details. * * You should have received a copy of the GNU General Public License - * along with userv-utils; if not, write to the Free Software - * Foundation, 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA. - * - * $Id$ + * along with userv-utils; if not, see http://www.gnu.org/licenses/. */ #include @@ -30,14 +32,58 @@ #include "ucgi.h" +static const char *const default_envok[] = { + "AUTH_TYPE", + "CONTENT_TYPE", + "CONTENT_LENGTH", + "DOCUMENT_ROOT", + "GATEWAY_INTERFACE", + "HTTP_*", + "HTTPS", + "PATH_INFO", + "PATH_TRANSLATED", + "QUERY_STRING", + "REDIRECT_*", + "REMOTE_*", + "REQUEST_METHOD", + "REQUEST_URI", + "SCRIPT_*", + "SERVER_*", + "SSL_*", + 0 +}; + +struct buildargs { + const char **v; + int n, max; +}; + +static void addarg(struct buildargs *args, const char *a) { + if (args->n > args->max) error("too many arguments", 500); + args->v[args->n++]= a; +} + +static void add_userv_var(const char *fulln, + const char *en, const char *ev, void *p) { + struct buildargs *args= p; + size_t l; + char *a; + + l= strlen(ev); + if (l > MAX_ENVVAR_VALUE) error("environment variable too long", 500); + a= xmalloc(strlen(en)+l+6); + sprintf(a,"-DE_%s=%s",en,ev); + addarg(args, a); +} + int main(int argc, const char **argv) { - char *defarg, *username; - const char *slash2, *pathi, *ev, *en, *av; - const char *const *ep; - const char **arguments; + char *username; + const char *slash2, *pathi, *ev, *av; + const char *const *envok = 0; size_t usernamelen, l; + struct buildargs args; pid_t child, rchild; - int nargs, status; + int status; l= strlen(argv[0]); if (l>6 && !strcmp(argv[0]+l-6,"-debug")) debugmode= 1; @@ -46,41 +92,54 @@ int main(int argc, const char **argv) { if (fputs("Content-Type: text/plain\n\n",stdout)==EOF || fflush(stdout)) syserror("write stdout"); if (dup2(1,2)<0) { perror("dup stdout to stderr"); exit(-1); } + D( printf(";;; UCGI\n"); ) } - if (argc > MAX_ARGS) error("too many arguments"); + if (argc > MAX_ARGS) error("too many arguments", 500); + + ev= getenv("UCGI_ENV_FILTER"); + if (ev) + envok= load_filters(LOADF_MUST, ev, LF_END); + else + envok= load_filters(0, "/etc/userv/ucgi.env-filter", LF_END); pathi= getenv("PATH_INFO"); - if (!pathi) error("PATH_INFO not found"); - if (pathi[0] != '/' || pathi[1] != '~') error("PATH_INFO must start with /~"); - slash2= strchr(pathi+2,'/'); if (!slash2) error("PATH_INFO must have more than one /"); + if (!pathi) error("PATH_INFO not found", 500); + D( if (debugmode) { + printf(";; find user name...\n" + ";; initial PATH_INFO = `%s'\n", + pathi); + } ) + if (pathi[0] != '/' || pathi[1] != '~') + error("PATH_INFO must start with /~", 400); + slash2= strchr(pathi+2,'/'); + if (!slash2) error("PATH_INFO must have more than one /", 400); usernamelen= slash2-(pathi+2); - if (usernamelen > MAX_USERNAME_LEN) error("PATH_INFO username too long"); + if (usernamelen > MAX_USERNAME_LEN) error("PATH_INFO username too long", 400); username= xmalloc(usernamelen+1); memcpy(username,pathi+2,usernamelen); username[usernamelen]= 0; - if (!isalpha(username[0])) error("username 1st character is not alphabetic"); + D( if (debugmode) + printf(";; user = `%s'; tail = `%s'\n", username, slash2); ) + if (!isalpha(username[0])) + error("username 1st character is not alphabetic", 400); xsetenv("PATH_INFO",slash2,1); + + args.n= 0; args.max= argc + MAX_ENVVARS + 10; + args.v= xmalloc(args.max * sizeof(*args.v)); - arguments= xmalloc(sizeof(const char*)*(nenvok+argc+10)); - nargs= 0; - - arguments[nargs++]= "userv"; - if (debugmode) arguments[nargs++]= "-DDEBUG=1"; - - for (ep= envok; (en= *ep); ep++) { - ev= getenv(en); if (!ev) continue; - l= strlen(ev); if (l > MAX_ENVVAR_VALUE) error("environment variable too long"); - defarg= xmalloc(strlen(en)+l+6); - sprintf(defarg,"-DE_%s=%s",en,ev); - arguments[nargs++]= defarg; - } + addarg(&args, "userv"); + if (debugmode) addarg(&args, "-DDEBUG=1"); + + filter_environment(FILTF_WILDCARD, "", envok, default_envok, + add_userv_var, &args); - arguments[nargs++]= username; - arguments[nargs++]= "www-cgi"; - while ((av= (*++argv))) arguments[nargs++]= av; - arguments[nargs++]= 0; + addarg(&args, username); + addarg(&args, "www-cgi"); + while ((av= (*++argv))) addarg(&args, av); + addarg(&args, 0); if (debugmode) { + D( fflush(stdout); ) child= fork(); if (child==-1) syserror("fork"); if (child) { rchild= waitpid(child,&status,0); @@ -90,7 +149,16 @@ int main(int argc, const char **argv) { } } - execvp("userv",(char*const*)arguments); + D( if (debugmode) { + int i; + + printf(";; final command line...\n"); + for (i = 0; args.v[i]; i++) + printf(";; %s\n", args.v[i]); + fflush(stdout); + } ) + + execvp("userv",(char*const*)args.v); syserror("exec userv"); return -1; }