===================================================================
RCS file: /cvs/mandoc/cgi.c,v
retrieving revision 1.168
retrieving revision 1.180
diff -u -p -r1.168 -r1.180
--- mandoc/cgi.c	2019/10/01 17:54:14	1.168
+++ mandoc/cgi.c	2022/07/06 17:21:04	1.180
@@ -1,7 +1,8 @@
-/*	$Id: cgi.c,v 1.168 2019/10/01 17:54:14 schwarze Exp $ */
+/* $Id: cgi.c,v 1.180 2022/07/06 17:21:04 schwarze Exp $ */
 /*
+ * Copyright (c) 2014-2019, 2021, 2022 Ingo Schwarze <schwarze@usta.de>
  * Copyright (c) 2011, 2012 Kristaps Dzonsons <kristaps@bsd.lv>
- * Copyright (c) 2014-2019 Ingo Schwarze <schwarze@usta.de>
+ * Copyright (c) 2022 Anna Vyalkova <cyber@sysrq.in>
  *
  * Permission to use, copy, modify, and distribute this software for any
  * purpose with or without fee is hereby granted, provided that the above
@@ -14,6 +15,8 @@
  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
+ *
+ * Implementation of the man.cgi(8) program.
  */
 #include "config.h"
 
@@ -70,9 +73,9 @@ enum	focus {
 static	void		 html_print(const char *);
 static	void		 html_putchar(char);
 static	int		 http_decode(char *);
-static	void		 http_encode(const char *p);
+static	void		 http_encode(const char *);
 static	void		 parse_manpath_conf(struct req *);
-static	void		 parse_path_info(struct req *req, const char *path);
+static	void		 parse_path_info(struct req *, const char *);
 static	void		 parse_query_string(struct req *, const char *);
 static	void		 pg_error_badrequest(const char *);
 static	void		 pg_error_internal(void);
@@ -84,10 +87,10 @@ static	void		 pg_search(const struct req *);
 static	void		 pg_searchres(const struct req *,
 				struct manpage *, size_t);
 static	void		 pg_show(struct req *, const char *);
-static	void		 resp_begin_html(int, const char *, const char *);
+static	int		 resp_begin_html(int, const char *, const char *);
 static	void		 resp_begin_http(int, const char *);
 static	void		 resp_catman(const struct req *, const char *);
-static	void		 resp_copy(const char *);
+static	int		 resp_copy(const char *, const char *);
 static	void		 resp_end_html(void);
 static	void		 resp_format(const struct req *, const char *);
 static	void		 resp_searchform(const struct req *, enum focus);
@@ -120,16 +123,18 @@ static	const char *const sec_names[] = {
 static	const int sec_MAX = sizeof(sec_names) / sizeof(char *);
 
 static	const char *const arch_names[] = {
-    "amd64",       "alpha",       "armv7",	"arm64",
-    "hppa",        "i386",        "landisk",
-    "loongson",    "luna88k",     "macppc",      "mips64",
-    "octeon",      "sgi",         "socppc",      "sparc64",
+    "amd64",       "alpha",       "armv7",       "arm64",
+    "hppa",        "i386",        "landisk",     "loongson",
+    "luna88k",     "macppc",      "mips64",      "octeon",
+    "powerpc64",   "riscv64",     "sparc64",
+
     "amiga",       "arc",         "armish",      "arm32",
     "atari",       "aviion",      "beagle",      "cats",
     "hppa64",      "hp300",
     "ia64",        "mac68k",      "mvme68k",     "mvme88k",
     "mvmeppc",     "palm",        "pc532",       "pegasos",
-    "pmax",        "powerpc",     "solbourne",   "sparc",
+    "pmax",        "powerpc",     "sgi",         "socppc",
+    "solbourne",   "sparc",
     "sun3",        "vax",         "wgrisc",      "x68k",
     "zaurus"
 };
@@ -340,31 +345,38 @@ resp_begin_http(int code, const char *msg)
 
 	printf("Content-Type: text/html; charset=utf-8\r\n"
 	     "Cache-Control: no-cache\r\n"
+	     "Content-Security-Policy: default-src 'none'; "
+	     "style-src 'self' 'unsafe-inline'\r\n"
 	     "Pragma: no-cache\r\n"
 	     "\r\n");
 
 	fflush(stdout);
 }
 
-static void
-resp_copy(const char *filename)
+static int
+resp_copy(const char *element, const char *filename)
 {
 	char	 buf[4096];
 	ssize_t	 sz;
 	int	 fd;
 
-	if ((fd = open(filename, O_RDONLY)) != -1) {
-		fflush(stdout);
-		while ((sz = read(fd, buf, sizeof(buf))) > 0)
-			write(STDOUT_FILENO, buf, sz);
-		close(fd);
-	}
+	if ((fd = open(filename, O_RDONLY)) == -1)
+		return 0;
+
+	if (element != NULL)
+		printf("<%s>\n", element);
+	fflush(stdout);
+	while ((sz = read(fd, buf, sizeof(buf))) > 0)
+		write(STDOUT_FILENO, buf, sz);
+	close(fd);
+	return 1;
 }
 
-static void
+static int
 resp_begin_html(int code, const char *msg, const char *file)
 {
-	char	*cp;
+	const char	*name, *sec, *cp;
+	int		 namesz, secsz;
 
 	resp_begin_http(code, msg);
 
@@ -379,27 +391,42 @@ resp_begin_html(int code, const char *msg, const char 
 	       "  <title>",
 	       CSS_DIR);
 	if (file != NULL) {
-		if ((cp = strrchr(file, '/')) != NULL)
-			file = cp + 1;
-		if ((cp = strrchr(file, '.')) != NULL) {
-			printf("%.*s(%s) - ", (int)(cp - file), file, cp + 1);
-		} else
-			printf("%s - ", file);
+		cp = strrchr(file, '/');
+		name = cp == NULL ? file : cp + 1;
+		cp = strrchr(name, '.');
+		namesz = cp == NULL ? strlen(name) : cp - name;
+		sec = NULL;
+		if (cp != NULL && cp[1] != '0') {
+			sec = cp + 1;
+			secsz = strlen(sec);
+		} else if (name - file > 1) {
+			for (cp = name - 2; cp >= file; cp--) {
+				if (*cp < '1' || *cp > '9')
+					continue;
+				sec = cp;
+				secsz = name - cp - 1;
+				break;
+			}
+		}
+		printf("%.*s", namesz, name);
+		if (sec != NULL)
+			printf("(%.*s)", secsz, sec);
+		fputs(" - ", stdout);
 	}
 	printf("%s</title>\n"
 	       "</head>\n"
 	       "<body>\n",
 	       CUSTOMIZE_TITLE);
 
-	resp_copy(MAN_DIR "/header.html");
+	return resp_copy("header", MAN_DIR "/header.html");
 }
 
 static void
 resp_end_html(void)
 {
+	if (resp_copy("footer", MAN_DIR "/footer.html"))
+		puts("</footer>");
 
-	resp_copy(MAN_DIR "/footer.html");
-
 	puts("</body>\n"
 	     "</html>");
 }
@@ -409,20 +436,22 @@ resp_searchform(const struct req *req, enum focus focu
 {
 	int		 i;
 
-	printf("<form action=\"/%s\" method=\"get\">\n"
+	printf("<form role=\"search\" action=\"/%s\" method=\"get\" "
+	       "autocomplete=\"off\" autocapitalize=\"none\">\n"
 	       "  <fieldset>\n"
 	       "    <legend>Manual Page Search Parameters</legend>\n",
 	       scriptname);
 
 	/* Write query input box. */
 
-	printf("    <input type=\"search\" name=\"query\" value=\"");
+	printf("    <label>Search query:\n"
+	       "      <input type=\"search\" name=\"query\" value=\"");
 	if (req->q.query != NULL)
 		html_print(req->q.query);
-	printf( "\" size=\"40\"");
+	printf("\" size=\"40\"");
 	if (focus == FOCUS_QUERY)
 		printf(" autofocus");
-	puts(">");
+	puts(">\n    </label>");
 
 	/* Write submission buttons. */
 
@@ -434,7 +463,7 @@ resp_searchform(const struct req *req, enum focus focu
 
 	/* Write section selector. */
 
-	puts("    <select name=\"sec\">");
+	puts("    <select name=\"sec\" aria-label=\"Manual section\">");
 	for (i = 0; i < sec_MAX; i++) {
 		printf("      <option value=\"%s\"", sec_numbers[i]);
 		if (NULL != req->q.sec &&
@@ -446,7 +475,7 @@ resp_searchform(const struct req *req, enum focus focu
 
 	/* Write architecture selector. */
 
-	printf(	"    <select name=\"arch\">\n"
+	printf(	"    <select name=\"arch\" aria-label=\"CPU architecture\">\n"
 		"      <option value=\"default\"");
 	if (NULL == req->q.arch)
 		printf(" selected=\"selected\"");
@@ -463,7 +492,8 @@ resp_searchform(const struct req *req, enum focus focu
 	/* Write manpath selector. */
 
 	if (req->psz > 1) {
-		puts("    <select name=\"manpath\">");
+		puts("    <select name=\"manpath\""
+		     " aria-label=\"Manual path\">");
 		for (i = 0; i < (int)req->psz; i++) {
 			printf("      <option");
 			if (strcmp(req->q.manpath, req->p[i]) == 0)
@@ -531,16 +561,21 @@ validate_filename(const char *file)
 static void
 pg_index(const struct req *req)
 {
-
-	resp_begin_html(200, NULL, NULL);
+	if (resp_begin_html(200, NULL, NULL) == 0)
+		puts("<header>");
 	resp_searchform(req, FOCUS_QUERY);
-	printf("<p>\n"
+	printf("</header>\n"
+	       "<main>\n"
+	       "<p role=\"doc-notice\" aria-label=\"Usage\">\n"
 	       "This web interface is documented in the\n"
-	       "<a class=\"Xr\" href=\"/%s%sman.cgi.8\">man.cgi(8)</a>\n"
+	       "<a class=\"Xr\" href=\"/%s%sman.cgi.8\""
+	       " aria-label=\"man dot CGI, section 8\">man.cgi(8)</a>\n"
 	       "manual, and the\n"
-	       "<a class=\"Xr\" href=\"/%s%sapropos.1\">apropos(1)</a>\n"
+	       "<a class=\"Xr\" href=\"/%s%sapropos.1\""
+	       " aria-label=\"apropos, section 1\">apropos(1)</a>\n"
 	       "manual explains the query syntax.\n"
-	       "</p>\n",
+	       "</p>\n"
+	       "</main>\n",
 	       scriptname, *scriptname == '\0' ? "" : "/",
 	       scriptname, *scriptname == '\0' ? "" : "/");
 	resp_end_html();
@@ -550,33 +585,40 @@ static void
 pg_noresult(const struct req *req, int code, const char *http_msg,
     const char *user_msg)
 {
-	resp_begin_html(code, http_msg, NULL);
+	if (resp_begin_html(code, http_msg, NULL) == 0)
+		puts("<header>");
 	resp_searchform(req, FOCUS_QUERY);
-	puts("<p>");
+	puts("</header>");
+	puts("<main>");
+	puts("<p role=\"doc-notice\" aria-label=\"No result\">");
 	puts(user_msg);
 	puts("</p>");
+	puts("</main>");
 	resp_end_html();
 }
 
 static void
 pg_error_badrequest(const char *msg)
 {
-
-	resp_begin_html(400, "Bad Request", NULL);
-	puts("<h1>Bad Request</h1>\n"
-	     "<p>\n");
+	if (resp_begin_html(400, "Bad Request", NULL))
+		puts("</header>");
+	puts("<main>\n"
+	     "<h1>Bad Request</h1>\n"
+	     "<p role=\"doc-notice\" aria-label=\"Bad Request\">");
 	puts(msg);
 	printf("Try again from the\n"
 	       "<a href=\"/%s\">main page</a>.\n"
-	       "</p>", scriptname);
+	       "</p>\n"
+	       "</main>\n", scriptname);
 	resp_end_html();
 }
 
 static void
 pg_error_internal(void)
 {
-	resp_begin_html(500, "Internal Server Error", NULL);
-	puts("<p>Internal Server Error</p>");
+	if (resp_begin_html(500, "Internal Server Error", NULL))
+		puts("</header>");
+	puts("<main><p role=\"doc-notice\">Internal Server Error</p></main>");
 	resp_end_html();
 }
 
@@ -607,6 +649,7 @@ pg_searchres(const struct req *req, struct manpage *r,
 	size_t		 i, iuse;
 	int		 archprio, archpriouse;
 	int		 prio, priouse;
+	int		 have_header;
 
 	for (i = 0; i < sz; i++) {
 		if (validate_filename(r[i].file))
@@ -673,14 +716,18 @@ pg_searchres(const struct req *req, struct manpage *r,
 			priouse = prio;
 			iuse = i;
 		}
-		resp_begin_html(200, NULL, r[iuse].file);
+		have_header = resp_begin_html(200, NULL, r[iuse].file);
 	} else
-		resp_begin_html(200, NULL, NULL);
+		have_header = resp_begin_html(200, NULL, NULL);
 
+	if (have_header == 0)
+		puts("<header>");
 	resp_searchform(req,
 	    req->q.equal || sz == 1 ? FOCUS_NONE : FOCUS_QUERY);
+	puts("</header>");
 
 	if (sz > 1) {
+		puts("<nav>");
 		puts("<table class=\"results\">");
 		for (i = 0; i < sz; i++) {
 			printf("  <tr>\n"
@@ -699,6 +746,7 @@ pg_searchres(const struct req *req, struct manpage *r,
 			     "  </tr>");
 		}
 		puts("</table>");
+		puts("</nav>");
 	}
 
 	if (req->q.equal || sz == 1) {
@@ -720,7 +768,9 @@ resp_catman(const struct req *req, const char *file)
 	int		 italic, bold;
 
 	if ((f = fopen(file, "r")) == NULL) {
-		puts("<p>You specified an invalid manual file.</p>");
+		puts("<p role=\"doc-notice\">\n"
+		     "  You specified an invalid manual file.\n"
+		     "</p>");
 		return;
 	}
 
@@ -856,8 +906,10 @@ resp_format(const struct req *req, const char *file)
 	int		 fd;
 	int		 usepath;
 
-	if (-1 == (fd = open(file, O_RDONLY, 0))) {
-		puts("<p>You specified an invalid manual file.</p>");
+	if (-1 == (fd = open(file, O_RDONLY))) {
+		puts("<p role=\"doc-notice\">\n"
+		     "  You specified an invalid manual file.\n"
+		     "</p>");
 		return;
 	}
 
@@ -943,8 +995,10 @@ pg_show(struct req *req, const char *fullpath)
 		return;
 	}
 
-	resp_begin_html(200, NULL, file);
+	if (resp_begin_html(200, NULL, file) == 0)
+		puts("<header>");
 	resp_searchform(req, FOCUS_NONE);
+	puts("</header>");
 	resp_show(req, file);
 	resp_end_html();
 }