mandoc/cgi.c - diff

Return to cgi.c CVS log

Up to [cvsweb.bsd.lv] / mandoc

Diff for /mandoc/cgi.c between version 1.96 and 1.108

version 1.96, 2014/08/26 11:21:40

version 1.108, 2015/04/18 16:34:25

Line 1

/* $Id$ */

* Permission to use, copy, modify, and distribute this software for any

* purpose with or without fee is hereby granted, provided that the above

* copyright notice and this permission notice appear in all copies.

* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES

* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR

* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

Line 30

#include <string.h>

#include <unistd.h>

#include "mandoc.h"

#include "mandoc_aux.h"

#include "mandoc.h"

#include "roff.h"

#include "main.h"

#include "manpath.h"

#include "manconf.h"

#include "mansearch.h"

#include "cgi.h"

Line 58 static void catman(const struct req *, const char *)

Line 59 static void catman(const struct req *, const char *)

static void format(const struct req *, const char *);

static void html_print(const char *);

static void html_putchar(char);

static int http_decode(char *);

static void http_parse(struct req *, const char *);

static void http_print(const char *);

static void http_putchar(char);

static void http_printquery(const struct req *, const char *);

static void pathgen(struct req *);

static void pg_error_badrequest(const char *);

Line 163 http_printquery(const struct req *req, const char *sep

Line 164 http_printquery(const struct req *req, const char *sep

printf("%sarch=", sep);

http_print(req->q.arch);

}

if (NULL != req->q.manpath &&

if (strcmp(req->q.manpath, req->p[0])) {

strcmp(req->q.manpath, req->p[0])) {

printf("%smanpath=", sep);

http_print(req->q.manpath);

}

Line 187 http_print(const char *p)

static void

html_print(const char *p)

{

if (NULL == p)

return;

while ('\0' != *p)

Line 298 next:

if (*qs != '\0')

qs++;

}

/* Fall back to the default manpath. */

if (req->q.manpath == NULL)

req->q.manpath = mandoc_strdup(req->p[0]);

}

static void

Line 376 resp_begin_html(int code, const char *msg)

Line 371 resp_begin_html(int code, const char *msg)

resp_begin_http(code, msg);

printf("<!DOCTYPE HTML PUBLIC "

printf("<!DOCTYPE html>\n"

" \"-//W3C//DTD HTML 4.01//EN\""

" \"http://www.w3.org/TR/html4/strict.dtd\">\n"

"<HTML>\n"

"<HEAD>\n"

"<META HTTP-EQUIV=\"Content-Type\""

"<META CHARSET=\"UTF-8\" />\n"

" CONTENT=\"text/html; charset=utf-8\">\n"

"<LINK REL=\"stylesheet\" HREF=\"%s/man-cgi.css\""

" TYPE=\"text/css\" media=\"all\">\n"

"<LINK REL=\"stylesheet\" HREF=\"%s/man.css\""

Line 472 resp_searchform(const struct req *req)

Line 464 resp_searchform(const struct req *req)

puts("<SELECT NAME=\"manpath\">");

for (i = 0; i < (int)req->psz; i++) {

printf("<OPTION ");

if (NULL == req->q.manpath ? 0 == i :

if (strcmp(req->q.manpath, req->p[i]) == 0)

0 == strcmp(req->q.manpath, req->p[i]))

printf("SELECTED=\"selected\" ");

printf("VALUE=\"");

html_print(req->p[i]);

Line 631 pg_searchres(const struct req *req, struct manpage *r,

Line 622 pg_searchres(const struct req *req, struct manpage *r,

for (i = 0; i < sz; i++) {

printf("<TR>\n"

"<TD CLASS=\"title\">\n"

"<A HREF=\"%s/%s/%s?",

scriptname, req->q.manpath, r[i].file);

http_printquery(req, "&");

printf("\">");

Line 711 catman(const struct req *req, const char *file)

Line 702 catman(const struct req *req, const char *file)

while (NULL != (p = fgetln(f, &len))) {

bold = italic = 0;

for (i = 0; i < (int)len - 1; i++) {

* This means that the catpage is out of state.

* Ignore it and keep going (although the

* catpage is bogus).

Line 752 catman(const struct req *req, const char *file)

Line 743 catman(const struct req *req, const char *file)

continue;

}

* Handle funny behaviour troff-isms.

* These grok'd from the original man2html.c.

Line 790 catman(const struct req *req, const char *file)

Line 781 catman(const struct req *req, const char *file)

}

/* Bold mode. */

if (italic)

printf("</I>");

if ( ! bold)

Line 801 catman(const struct req *req, const char *file)

Line 792 catman(const struct req *req, const char *file)

html_putchar(p[i]);

}

* Clean up the last character.

* We can get to a newline; don't print that.

if (italic)

Line 826 catman(const struct req *req, const char *file)

Line 817 catman(const struct req *req, const char *file)

static void

format(const struct req *req, const char *file)

{

struct manoutput conf;

struct mparse *mp;

struct mdoc *mdoc;

struct mchars *mchars;

struct man *man;

struct roff_man *man;

void *vp;

char *opts;

enum mandoclevel rc;

int fd;

int usepath;

Line 840 format(const struct req *req, const char *file)

Line 830 format(const struct req *req, const char *file)

return;

}

mp = mparse_alloc(MPARSE_SO, MANDOCLEVEL_FATAL, NULL,

mchars = mchars_alloc();

req->q.manpath);

mp = mparse_alloc(MPARSE_SO, MANDOCLEVEL_BADARG, NULL,

rc = mparse_readfd(mp, fd, file);

mchars, req->q.manpath);

mparse_readfd(mp, fd, file);

close(fd);

if (rc >= MANDOCLEVEL_FATAL) {

memset(&conf, 0, sizeof(conf));

fprintf(stderr, "fatal mandoc error: %s/%s\n",

conf.fragment = 1;

req->q.manpath, file);

pg_error_internal();

return;

}

usepath = strcmp(req->q.manpath, req->p[0]);

mandoc_asprintf(&opts,

mandoc_asprintf(&conf.man, "%s?query=%%N&sec=%%S%s%s%s%s",

"fragment,man=%s?query=%%N&sec=%%S%s%s%s%s",

scriptname,

req->q.arch ? "&arch=" : "",

req->q.arch ? req->q.arch : "",

usepath ? "&manpath=" : "",

usepath ? req->q.manpath : "");

mparse_result(mp, &mdoc, &man, NULL);

mparse_result(mp, &man, NULL);

if (NULL == man && NULL == mdoc) {

if (man == NULL) {

fprintf(stderr, "fatal mandoc error: %s/%s\n",

req->q.manpath, file);

pg_error_internal();

mparse_free(mp);

mchars_free(mchars);

return;

}

vp = html_alloc(opts);

vp = html_alloc(mchars, &conf);

if (NULL != mdoc)

if (man->macroset == MACROSET_MDOC)

html_mdoc(vp, mdoc);

html_mdoc(vp, man);

else

html_man(vp, man);

html_free(vp);

mparse_free(mp);

free(opts);

mchars_free(mchars);

free(conf.man);

}

static void

Line 905 pg_show(struct req *req, const char *fullpath)

Line 892 pg_show(struct req *req, const char *fullpath)

pg_error_badrequest(

"You did not specify a page to show.");

return;

}

manpath = mandoc_strndup(fullpath, file - fullpath);

file++;

Line 954 pg_search(const struct req *req)

Line 941 pg_search(const struct req *req)

struct mansearch search;

struct manpaths paths;

struct manpage *res;

char **cp;

char **argv;

const char *ep, *start;

char *query, *rp, *wp;

size_t ressz;

int i, sz;

int argc;

* Begin by chdir()ing into the root of the manpath.

Line 976 pg_search(const struct req *req)

Line 963 pg_search(const struct req *req)

search.sec = req->q.sec;

search.outkey = "Nd";

search.argmode = req->q.equal ? ARG_NAME : ARG_EXPR;

search.firstmatch = 1;

paths.sz = 1;

paths.paths = mandoc_malloc(sizeof(char *));

paths.paths[0] = mandoc_strdup(".");

* Poor man's tokenisation: just break apart by spaces.

* Break apart at spaces with backslash-escaping.

* Yes, this is half-ass. But it works for now.

ep = req->q.query;

argc = 0;

while (ep && isspace((unsigned char)*ep))

argv = NULL;

ep++;

rp = query = mandoc_strdup(req->q.query);

for (;;) {

sz = 0;

while (isspace((unsigned char)*rp))

cp = NULL;

rp++;

while (ep && '\0' != *ep) {

if (*rp == '\0')

cp = mandoc_reallocarray(cp, sz + 1, sizeof(char *));

break;

start = ep;

argv = mandoc_reallocarray(argv, argc + 1, sizeof(char *));

while ('\0' != *ep && ! isspace((unsigned char)*ep))

argv[argc++] = wp = rp;

ep++;

for (;;) {

cp[sz] = mandoc_malloc((ep - start) + 1);

if (isspace((unsigned char)*rp)) {

memcpy(cp[sz], start, ep - start);

*wp = '\0';

cp[sz++][ep - start] = '\0';

rp++;

while (isspace((unsigned char)*ep))

break;

ep++;

}

if (rp[0] == '\\' && rp[1] != '\0')

rp++;

if (wp != rp)

*wp = *rp;

if (*rp == '\0')

break;

wp++;

rp++;

}

if (0 == mansearch(&search, &paths, sz, cp, &res, &ressz))

if (0 == mansearch(&search, &paths, argc, argv, &res, &ressz))

pg_noresult(req, "You entered an invalid query.");

else if (0 == ressz)

pg_noresult(req, "No results found.");

else

pg_searchres(req, res, ressz);

for (i = 0; i < sz; i++)

free(query);

free(cp[i]);

mansearch_free(res, ressz);

free(cp);

for (i = 0; i < (int)ressz; i++) {

free(res[i].file);

free(res[i].names);

free(res[i].output);

}

free(res);

free(paths.paths[0]);

free(paths.paths);

}

Line 1037 main(void)

Line 1024 main(void)

/* Poor man's ReDoS mitigation. */

itimer.it_value.tv_sec = 1;

itimer.it_value.tv_sec = 2;

itimer.it_value.tv_usec = 0;

itimer.it_interval.tv_sec = 1;

itimer.it_interval.tv_sec = 2;

itimer.it_interval.tv_usec = 0;

if (setitimer(ITIMER_VIRTUAL, &itimer, NULL) == -1) {

fprintf(stderr, "setitimer: %s\n", strerror(errno));

Line 1070 main(void)

Line 1057 main(void)

MAN_DIR, strerror(errno));

pg_error_internal();

return(EXIT_FAILURE);

}

memset(&req, 0, sizeof(struct req));

pathgen(&req);

Line 1080 main(void)

Line 1067 main(void)

if (NULL != (querystring = getenv("QUERY_STRING")))

http_parse(&req, querystring);

if ( ! (NULL == req.q.manpath ||

if (req.q.manpath == NULL)

validate_manpath(&req, req.q.manpath))) {

req.q.manpath = mandoc_strdup(req.p[0]);

else if ( ! validate_manpath(&req, req.q.manpath)) {

pg_error_badrequest(

"You specified an invalid manpath.");

return(EXIT_FAILURE);

CVSweb