mandoc/cgi.c - diff

Return to cgi.c CVS log

Up to [cvsweb.bsd.lv] / mandoc

Diff for /mandoc/cgi.c between version 1.85 and 1.100

version 1.85, 2014/07/25 16:56:06

version 1.100, 2014/10/28 17:36:19

Line 15

* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

#ifdef HAVE_CONFIG_H

#include "config.h"

#endif

#include <sys/types.h>

#include <sys/time.h>

#include <ctype.h>

#include <errno.h>

#include <fcntl.h>

#include <limits.h>

#include <stdint.h>

#include <stdio.h>

#include <stdlib.h>

#include <string.h>

Line 55 struct req {

Line 57 struct req {

static void catman(const struct req *, const char *);

static void format(const struct req *, const char *);

static void html_print(const char *);

static void html_printquery(const struct req *);

static void html_putchar(char);

static int http_decode(char *);

static void http_parse(struct req *, const char *);

static void http_print(const char *);

static void http_putchar(char);

static void http_printquery(const struct req *);

static void http_printquery(const struct req *, const char *);

static void pathgen(struct req *);

static void pg_error_badrequest(const char *);

static void pg_error_internal(void);

Line 91 static const char *const sec_names[] = {

Line 92 static const char *const sec_names[] = {

"All Sections",

"1 - General Commands",

"2 - System Calls",

"3 - Subroutines",

"3 - Library Functions",

"3p - Perl Subroutines",

"3p - Perl Library",

"4 - Special Files",

"4 - Device Drivers",

"5 - File Formats",

"6 - Games",

"7 - Macros and Conventions",

"7 - Miscellaneous Information",

"8 - Maintenance Commands",

"8 - System Manager\'s Manual",

"9 - Kernel Interface"

"9 - Kernel Developer\'s Manual"

};

static const int sec_MAX = sizeof(sec_names) / sizeof(char *);

Line 145 html_putchar(char c)

Line 146 html_putchar(char c)

}

static void

http_printquery(const struct req *req)

http_printquery(const struct req *req, const char *sep)

{

if (NULL != req->q.manpath) {

printf("&manpath=");

http_print(req->q.manpath);

}

if (NULL != req->q.sec) {

printf("&sec=");

http_print(req->q.sec);

}

if (NULL != req->q.arch) {

printf("&arch=");

http_print(req->q.arch);

}

if (NULL != req->q.query) {

printf("&query=");

printf("query=");

http_print(req->q.query);

}

if (0 == req->q.equal)

printf("&apropos=1");

printf("%sapropos=1", sep);

}

static void

html_printquery(const struct req *req)

{

if (NULL != req->q.manpath) {

printf("&manpath=");

html_print(req->q.manpath);

}

if (NULL != req->q.sec) {

printf("&sec=");

printf("%ssec=", sep);

html_print(req->q.sec);

http_print(req->q.sec);

}

if (NULL != req->q.arch) {

printf("&arch=");

printf("%sarch=", sep);

html_print(req->q.arch);

http_print(req->q.arch);

}

if (NULL != req->q.query) {

if (NULL != req->q.manpath &&

printf("&query=");

strcmp(req->q.manpath, req->p[0])) {

html_print(req->q.query);

printf("%smanpath=", sep);

http_print(req->q.manpath);

}

if (0 == req->q.equal)

printf("&apropos=1");

}

static void

Line 398 resp_begin_html(int code, const char *msg)

Line 376 resp_begin_html(int code, const char *msg)

resp_begin_http(code, msg);

printf("<!DOCTYPE HTML PUBLIC "

printf("<!DOCTYPE html>\n"

" \"-//W3C//DTD HTML 4.01//EN\""

" \"http://www.w3.org/TR/html4/strict.dtd\">\n"

"<HTML>\n"

"<HEAD>\n"

"<META HTTP-EQUIV=\"Content-Type\""

"<META CHARSET=\"UTF-8\" />\n"

" CONTENT=\"text/html; charset=utf-8\">\n"

"<LINK REL=\"stylesheet\" HREF=\"%s/man-cgi.css\""

" TYPE=\"text/css\" media=\"all\">\n"

"<LINK REL=\"stylesheet\" HREF=\"%s/man.css\""

Line 455 resp_searchform(const struct req *req)

Line 430 resp_searchform(const struct req *req)

printf( "</TD><TD>\n"

"<INPUT TYPE=\"radio\" ");

if (req->q.equal)

printf("CHECKED ");

printf("CHECKED=\"checked\" ");

printf( "NAME=\"apropos\" ID=\"show\" VALUE=\"0\">\n"

"<LABEL FOR=\"show\">Show named manual page</LABEL>\n");

/* Write section selector. */

printf( "</TD></TR><TR><TD>\n"

puts( "</TD></TR><TR><TD>\n"

"<SELECT NAME=\"sec\">");

for (i = 0; i < sec_MAX; i++) {

printf("<OPTION VALUE=\"%s\"", sec_numbers[i]);

if (NULL != req->q.sec &&

0 == strcmp(sec_numbers[i], req->q.sec))

printf(" SELECTED");

printf(" SELECTED=\"selected\"");

printf(">%s</OPTION>\n", sec_names[i]);

}

puts("</SELECT>");

Line 477 resp_searchform(const struct req *req)

Line 452 resp_searchform(const struct req *req)

printf( "<SELECT NAME=\"arch\">\n"

"<OPTION VALUE=\"default\"");

if (NULL == req->q.arch)

printf(" SELECTED");

printf(" SELECTED=\"selected\"");

puts(">All Architectures</OPTION>");

for (i = 0; i < arch_MAX; i++) {

printf("<OPTION VALUE=\"%s\"", arch_names[i]);

if (NULL != req->q.arch &&

0 == strcmp(arch_names[i], req->q.arch))

printf(" SELECTED");

printf(" SELECTED=\"selected\"");

printf(">%s</OPTION>\n", arch_names[i]);

}

puts("</SELECT>");

Line 496 resp_searchform(const struct req *req)

Line 471 resp_searchform(const struct req *req)

printf("<OPTION ");

if (NULL == req->q.manpath ? 0 == i :

0 == strcmp(req->q.manpath, req->p[i]))

printf("SELECTED ");

printf("SELECTED=\"selected\" ");

printf("VALUE=\"");

html_print(req->p[i]);

printf("\">");

Line 511 resp_searchform(const struct req *req)

Line 486 resp_searchform(const struct req *req)

printf( "</TD><TD>\n"

"<INPUT TYPE=\"radio\" ");

if (0 == req->q.equal)

printf("CHECKED ");

printf("CHECKED=\"checked\" ");

printf( "NAME=\"apropos\" ID=\"search\" VALUE=\"1\">\n"

"<LABEL FOR=\"search\">Search with apropos query</LABEL>\n");

Line 569 pg_index(const struct req *req)

Line 544 pg_index(const struct req *req)

resp_begin_html(200, NULL);

resp_searchform(req);

printf("<P>\n"

"This web interface is documented in the "

"This web interface is documented in the\n"

"<A HREF=\"%s/mandoc/man8/man.cgi.8\">man.cgi</A> "

"<A HREF=\"%s/mandoc/man8/man.cgi.8\">man.cgi</A>\n"

"manual, and the "

"manual, and the\n"

"<A HREF=\"%s/mandoc/man1/apropos.1\">apropos</A> "

"<A HREF=\"%s/mandoc/man1/apropos.1\">apropos</A>\n"

"manual explains the query syntax.\n"

"</P>\n",

scriptname, scriptname);

Line 638 pg_searchres(const struct req *req, struct manpage *r,

Line 613 pg_searchres(const struct req *req, struct manpage *r,

printf("Status: 303 See Other\r\n");

printf("Location: http://%s%s/%s/%s?",

HTTP_HOST, scriptname, req->q.manpath, r[0].file);

http_printquery(req);

http_printquery(req, "&");

printf("\r\n"

"Content-Type: text/html; charset=utf-8\r\n"

"\r\n");

Line 655 pg_searchres(const struct req *req, struct manpage *r,

Line 630 pg_searchres(const struct req *req, struct manpage *r,

"<TD CLASS=\"title\">\n"

"<A HREF=\"%s/%s/%s?",

scriptname, req->q.manpath, r[i].file);

html_printquery(req);

http_printquery(req, "&");

printf("\">");

html_print(r[i].names);

printf("</A>\n"

Line 849 static void

Line 824 static void

format(const struct req *req, const char *file)

{

struct mparse *mp;

int fd;

struct mchars *mchars;

struct mdoc *mdoc;

struct man *man;

void *vp;

char *opts;

enum mandoclevel rc;

char opts[PATH_MAX + 128];

int fd;

int usepath;

if (-1 == (fd = open(file, O_RDONLY, 0))) {

puts("<P>You specified an invalid manual file.</P>");

return;

}

mchars = mchars_alloc();

mp = mparse_alloc(MPARSE_SO, MANDOCLEVEL_FATAL, NULL,

req->q.manpath);

mchars, req->q.manpath);

rc = mparse_readfd(mp, fd, file);

close(fd);

Line 873 format(const struct req *req, const char *file)

Line 851 format(const struct req *req, const char *file)

return;

}

snprintf(opts, sizeof(opts), "fragment,man=%s?"

usepath = strcmp(req->q.manpath, req->p[0]);

"manpath=%s&query=%%N&sec=%%S&arch=%s",

mandoc_asprintf(&opts,

scriptname, req->q.manpath,

"fragment,man=%s?query=%%N&sec=%%S%s%s%s%s",

req->q.arch ? req->q.arch : "");

scriptname,

req->q.arch ? "&arch=" : "",

req->q.arch ? req->q.arch : "",

usepath ? "&manpath=" : "",

usepath ? req->q.manpath : "");

mparse_result(mp, &mdoc, &man, NULL);

if (NULL == man && NULL == mdoc) {

Line 884 format(const struct req *req, const char *file)

Line 866 format(const struct req *req, const char *file)

req->q.manpath, file);

pg_error_internal();

mparse_free(mp);

mchars_free(mchars);

return;

}

vp = html_alloc(opts);

vp = html_alloc(mchars, opts);

if (NULL != mdoc)

html_mdoc(vp, mdoc);

Line 896 format(const struct req *req, const char *file)

Line 879 format(const struct req *req, const char *file)

html_free(vp);

mparse_free(mp);

mchars_free(mchars);

free(opts);

}

static void

Line 970 pg_search(const struct req *req)

Line 955 pg_search(const struct req *req)

struct mansearch search;

struct manpaths paths;

struct manpage *res;

char **cp;

char **argv;

const char *ep, *start;

char *query, *rp, *wp;

size_t ressz;

int i, sz;

int argc;

* Begin by chdir()ing into the root of the manpath.

Line 990 pg_search(const struct req *req)

Line 975 pg_search(const struct req *req)

search.arch = req->q.arch;

search.sec = req->q.sec;

search.deftype = req->q.equal ? TYPE_Nm : (TYPE_Nm | TYPE_Nd);

search.outkey = "Nd";

search.flags = req->q.equal ? MANSEARCH_MAN : 0;

search.argmode = req->q.equal ? ARG_NAME : ARG_EXPR;

paths.sz = 1;

paths.paths = mandoc_malloc(sizeof(char *));

paths.paths[0] = mandoc_strdup(".");

* Poor man's tokenisation: just break apart by spaces.

* Break apart at spaces with backslash-escaping.

* Yes, this is half-ass. But it works for now.

ep = req->q.query;

argc = 0;

while (ep && isspace((unsigned char)*ep))

argv = NULL;

ep++;

rp = query = mandoc_strdup(req->q.query);

for (;;) {

sz = 0;

while (isspace((unsigned char)*rp))

cp = NULL;

rp++;

while (ep && '\0' != *ep) {

if (*rp == '\0')

cp = mandoc_reallocarray(cp, sz + 1, sizeof(char *));

break;

start = ep;

argv = mandoc_reallocarray(argv, argc + 1, sizeof(char *));

while ('\0' != *ep && ! isspace((unsigned char)*ep))

argv[argc++] = wp = rp;

ep++;

for (;;) {

cp[sz] = mandoc_malloc((ep - start) + 1);

if (isspace((unsigned char)*rp)) {

memcpy(cp[sz], start, ep - start);

*wp = '\0';

cp[sz++][ep - start] = '\0';

rp++;

while (isspace((unsigned char)*ep))

break;

ep++;

}

if (rp[0] == '\\' && rp[1] != '\0')

rp++;

if (wp != rp)

*wp = *rp;

if (*rp == '\0')

break;

wp++;

rp++;

}

if (0 == mansearch(&search, &paths, sz, cp, "Nd", &res, &ressz))

if (0 == mansearch(&search, &paths, argc, argv, &res, &ressz))

pg_noresult(req, "You entered an invalid query.");

else if (0 == ressz)

pg_noresult(req, "No results found.");

else

pg_searchres(req, res, ressz);

for (i = 0; i < sz; i++)

free(query);

free(cp[i]);

mansearch_free(res, ressz);

free(cp);

for (i = 0; i < (int)ressz; i++) {

free(res[i].file);

free(res[i].names);

free(res[i].output);

}

free(res);

free(paths.paths[0]);

free(paths.paths);

}

Line 1046 int

Line 1030 int

main(void)

{

struct req req;

struct itimerval itimer;

const char *path;

const char *querystring;

int i;

/* Poor man's ReDoS mitigation. */

itimer.it_value.tv_sec = 2;

itimer.it_value.tv_usec = 0;

itimer.it_interval.tv_sec = 2;

itimer.it_interval.tv_usec = 0;

if (setitimer(ITIMER_VIRTUAL, &itimer, NULL) == -1) {

fprintf(stderr, "setitimer: %s\n", strerror(errno));

pg_error_internal();

return(EXIT_FAILURE);

}

/* Scan our run-time environment. */

if (NULL == (scriptname = getenv("SCRIPT_NAME")))

Line 1083 main(void)

Line 1080 main(void)

if (NULL != (querystring = getenv("QUERY_STRING")))

http_parse(&req, querystring);

if ( ! validate_manpath(&req, req.q.manpath)) {

if ( ! (NULL == req.q.manpath ||

validate_manpath(&req, req.q.manpath))) {

pg_error_badrequest(

"You specified an invalid manpath.");

return(EXIT_FAILURE);

CVSweb