===================================================================
RCS file: /cvs/mandoc/cgi.c,v
retrieving revision 1.96
retrieving revision 1.103
diff -u -p -r1.96 -r1.103
--- mandoc/cgi.c	2014/08/26 11:21:40	1.96
+++ mandoc/cgi.c	2015/01/15 04:26:39	1.103
@@ -1,4 +1,4 @@
-/*	$Id: cgi.c,v 1.96 2014/08/26 11:21:40 schwarze Exp $ */
+/*	$Id: cgi.c,v 1.103 2015/01/15 04:26:39 schwarze Exp $ */
 /*
  * Copyright (c) 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv>
  * Copyright (c) 2014 Ingo Schwarze <schwarze@usta.de>
@@ -163,8 +163,7 @@ http_printquery(const struct req *req, const char *sep
 		printf("%sarch=", sep);
 		http_print(req->q.arch);
 	}
-	if (NULL != req->q.manpath &&
-	    strcmp(req->q.manpath, req->p[0])) {
+	if (strcmp(req->q.manpath, req->p[0])) {
 		printf("%smanpath=", sep);
 		http_print(req->q.manpath);
 	}
@@ -298,11 +297,6 @@ next:
 		if (*qs != '\0')
 			qs++;
 	}
-
-	/* Fall back to the default manpath. */
-
-	if (req->q.manpath == NULL)
-		req->q.manpath = mandoc_strdup(req->p[0]);
 }
 
 static void
@@ -376,13 +370,10 @@ resp_begin_html(int code, const char *msg)
 
 	resp_begin_http(code, msg);
 
-	printf("<!DOCTYPE HTML PUBLIC "
-	       " \"-//W3C//DTD HTML 4.01//EN\""
-	       " \"http://www.w3.org/TR/html4/strict.dtd\">\n"
+	printf("<!DOCTYPE html>\n"
 	       "<HTML>\n"
 	       "<HEAD>\n"
-	       "<META HTTP-EQUIV=\"Content-Type\""
-	       " CONTENT=\"text/html; charset=utf-8\">\n"
+	       "<META CHARSET=\"UTF-8\" />\n"
 	       "<LINK REL=\"stylesheet\" HREF=\"%s/man-cgi.css\""
 	       " TYPE=\"text/css\" media=\"all\">\n"
 	       "<LINK REL=\"stylesheet\" HREF=\"%s/man.css\""
@@ -472,8 +463,7 @@ resp_searchform(const struct req *req)
 		puts("<SELECT NAME=\"manpath\">");
 		for (i = 0; i < (int)req->psz; i++) {
 			printf("<OPTION ");
-			if (NULL == req->q.manpath ? 0 == i :
-			    0 == strcmp(req->q.manpath, req->p[i]))
+			if (strcmp(req->q.manpath, req->p[i]) == 0)
 				printf("SELECTED=\"selected\" ");
 			printf("VALUE=\"");
 			html_print(req->p[i]);
@@ -827,11 +817,11 @@ static void
 format(const struct req *req, const char *file)
 {
 	struct mparse	*mp;
+	struct mchars	*mchars;
 	struct mdoc	*mdoc;
 	struct man	*man;
 	void		*vp;
 	char		*opts;
-	enum mandoclevel rc;
 	int		 fd;
 	int		 usepath;
 
@@ -840,18 +830,12 @@ format(const struct req *req, const char *file)
 		return;
 	}
 
-	mp = mparse_alloc(MPARSE_SO, MANDOCLEVEL_FATAL, NULL,
-	    req->q.manpath);
-	rc = mparse_readfd(mp, fd, file);
+	mchars = mchars_alloc();
+	mp = mparse_alloc(MPARSE_SO, MANDOCLEVEL_BADARG, NULL,
+	    mchars, req->q.manpath);
+	mparse_readfd(mp, fd, file);
 	close(fd);
 
-	if (rc >= MANDOCLEVEL_FATAL) {
-		fprintf(stderr, "fatal mandoc error: %s/%s\n",
-		    req->q.manpath, file);
-		pg_error_internal();
-		return;
-	}
-
 	usepath = strcmp(req->q.manpath, req->p[0]);
 	mandoc_asprintf(&opts,
 	    "fragment,man=%s?query=%%N&sec=%%S%s%s%s%s",
@@ -867,10 +851,11 @@ format(const struct req *req, const char *file)
 		    req->q.manpath, file);
 		pg_error_internal();
 		mparse_free(mp);
+		mchars_free(mchars);
 		return;
 	}
 
-	vp = html_alloc(opts);
+	vp = html_alloc(mchars, opts);
 
 	if (NULL != mdoc)
 		html_mdoc(vp, mdoc);
@@ -879,6 +864,7 @@ format(const struct req *req, const char *file)
 
 	html_free(vp);
 	mparse_free(mp);
+	mchars_free(mchars);
 	free(opts);
 }
 
@@ -954,10 +940,10 @@ pg_search(const struct req *req)
 	struct mansearch	  search;
 	struct manpaths		  paths;
 	struct manpage		 *res;
-	char			**cp;
-	const char		 *ep, *start;
+	char			**argv;
+	char			 *query, *rp, *wp;
 	size_t			  ressz;
-	int			  i, sz;
+	int			  argc;
 
 	/*
 	 * Begin by chdir()ing into the root of the manpath.
@@ -976,52 +962,52 @@ pg_search(const struct req *req)
 	search.sec = req->q.sec;
 	search.outkey = "Nd";
 	search.argmode = req->q.equal ? ARG_NAME : ARG_EXPR;
+	search.firstmatch = 1;
 
 	paths.sz = 1;
 	paths.paths = mandoc_malloc(sizeof(char *));
 	paths.paths[0] = mandoc_strdup(".");
 
 	/*
-	 * Poor man's tokenisation: just break apart by spaces.
-	 * Yes, this is half-ass.  But it works for now.
+	 * Break apart at spaces with backslash-escaping.
 	 */
 
-	ep = req->q.query;
-	while (ep && isspace((unsigned char)*ep))
-		ep++;
-
-	sz = 0;
-	cp = NULL;
-	while (ep && '\0' != *ep) {
-		cp = mandoc_reallocarray(cp, sz + 1, sizeof(char *));
-		start = ep;
-		while ('\0' != *ep && ! isspace((unsigned char)*ep))
-			ep++;
-		cp[sz] = mandoc_malloc((ep - start) + 1);
-		memcpy(cp[sz], start, ep - start);
-		cp[sz++][ep - start] = '\0';
-		while (isspace((unsigned char)*ep))
-			ep++;
+	argc = 0;
+	argv = NULL;
+	rp = query = mandoc_strdup(req->q.query);
+	for (;;) {
+		while (isspace((unsigned char)*rp))
+			rp++;
+		if (*rp == '\0')
+			break;
+		argv = mandoc_reallocarray(argv, argc + 1, sizeof(char *));
+		argv[argc++] = wp = rp;
+		for (;;) {
+			if (isspace((unsigned char)*rp)) {
+				*wp = '\0';
+				rp++;
+				break;
+			}
+			if (rp[0] == '\\' && rp[1] != '\0')
+				rp++;
+			if (wp != rp)
+				*wp = *rp;
+			if (*rp == '\0')
+				break;
+			wp++;
+			rp++;
+		}
 	}
 
-	if (0 == mansearch(&search, &paths, sz, cp, &res, &ressz))
+	if (0 == mansearch(&search, &paths, argc, argv, &res, &ressz))
 		pg_noresult(req, "You entered an invalid query.");
 	else if (0 == ressz)
 		pg_noresult(req, "No results found.");
 	else
 		pg_searchres(req, res, ressz);
 
-	for (i = 0; i < sz; i++)
-		free(cp[i]);
-	free(cp);
-
-	for (i = 0; i < (int)ressz; i++) {
-		free(res[i].file);
-		free(res[i].names);
-		free(res[i].output);
-	}
-	free(res);
-
+	free(query);
+	mansearch_free(res, ressz);
 	free(paths.paths[0]);
 	free(paths.paths);
 }
@@ -1037,9 +1023,9 @@ main(void)
 
 	/* Poor man's ReDoS mitigation. */
 
-	itimer.it_value.tv_sec = 1;
+	itimer.it_value.tv_sec = 2;
 	itimer.it_value.tv_usec = 0;
-	itimer.it_interval.tv_sec = 1;
+	itimer.it_interval.tv_sec = 2;
 	itimer.it_interval.tv_usec = 0;
 	if (setitimer(ITIMER_VIRTUAL, &itimer, NULL) == -1) {
 		fprintf(stderr, "setitimer: %s\n", strerror(errno));
@@ -1080,8 +1066,9 @@ main(void)
 	if (NULL != (querystring = getenv("QUERY_STRING")))
 		http_parse(&req, querystring);
 
-	if ( ! (NULL == req.q.manpath ||
-	    validate_manpath(&req, req.q.manpath))) {
+	if (req.q.manpath == NULL)
+		req.q.manpath = mandoc_strdup(req.p[0]);
+	else if ( ! validate_manpath(&req, req.q.manpath)) {
 		pg_error_badrequest(
 		    "You specified an invalid manpath.");
 		return(EXIT_FAILURE);
