mandoc/cgi.c - diff

Return to cgi.c CVS log

Up to [cvsweb.bsd.lv] / mandoc

Diff for /mandoc/cgi.c between version 1.92 and 1.105

version 1.92, 2014/08/05 15:29:30

version 1.105, 2015/03/27 17:37:25

Line 7

* purpose with or without fee is hereby granted, provided that the above

* copyright notice and this permission notice appear in all copies.

* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES

* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES

* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF

* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR

* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR

* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES

* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN

* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF

* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

#ifdef HAVE_CONFIG_H

#include "config.h"

#endif

#include <sys/types.h>

#include <sys/time.h>

#include <ctype.h>

#include <errno.h>

#include <fcntl.h>

Line 32

Line 33

#include "mandoc.h"

#include "mandoc_aux.h"

#include "main.h"

#include "manpath.h"

#include "manconf.h"

#include "mansearch.h"

#include "cgi.h"

Line 57 static void catman(const struct req *, const char *)

Line 58 static void catman(const struct req *, const char *)

static void format(const struct req *, const char *);

static void html_print(const char *);

static void html_putchar(char);

static int http_decode(char *);

static void http_parse(struct req *, const char *);

static void http_print(const char *);

static void http_putchar(char);

static void http_printquery(const struct req *, const char *);

static void pathgen(struct req *);

static void pg_error_badrequest(const char *);

Line 91 static const char *const sec_names[] = {

Line 92 static const char *const sec_names[] = {

"All Sections",

"1 - General Commands",

"2 - System Calls",

"3 - Subroutines",

"3 - Library Functions",

"3p - Perl Subroutines",

"3p - Perl Library",

"4 - Special Files",

"4 - Device Drivers",

"5 - File Formats",

"6 - Games",

"7 - Macros and Conventions",

"7 - Miscellaneous Information",

"8 - Maintenance Commands",

"8 - System Manager\'s Manual",

"9 - Kernel Interface"

"9 - Kernel Developer\'s Manual"

};

static const int sec_MAX = sizeof(sec_names) / sizeof(char *);

Line 162 http_printquery(const struct req *req, const char *sep

Line 163 http_printquery(const struct req *req, const char *sep

printf("%sarch=", sep);

http_print(req->q.arch);

}

if (NULL != req->q.manpath &&

if (strcmp(req->q.manpath, req->p[0])) {

strcmp(req->q.manpath, req->p[0])) {

printf("%smanpath=", sep);

http_print(req->q.manpath);

}

Line 186 http_print(const char *p)

static void

html_print(const char *p)

{

if (NULL == p)

return;

while ('\0' != *p)

Line 297 next:

if (*qs != '\0')

qs++;

}

/* Fall back to the default manpath. */

if (req->q.manpath == NULL)

req->q.manpath = mandoc_strdup(req->p[0]);

}

static void

Line 375 resp_begin_html(int code, const char *msg)

Line 370 resp_begin_html(int code, const char *msg)

resp_begin_http(code, msg);

printf("<!DOCTYPE HTML PUBLIC "

printf("<!DOCTYPE html>\n"

" \"-//W3C//DTD HTML 4.01//EN\""

" \"http://www.w3.org/TR/html4/strict.dtd\">\n"

"<HTML>\n"

"<HEAD>\n"

"<META HTTP-EQUIV=\"Content-Type\""

"<META CHARSET=\"UTF-8\" />\n"

" CONTENT=\"text/html; charset=utf-8\">\n"

"<LINK REL=\"stylesheet\" HREF=\"%s/man-cgi.css\""

" TYPE=\"text/css\" media=\"all\">\n"

"<LINK REL=\"stylesheet\" HREF=\"%s/man.css\""

Line 471 resp_searchform(const struct req *req)

Line 463 resp_searchform(const struct req *req)

puts("<SELECT NAME=\"manpath\">");

for (i = 0; i < (int)req->psz; i++) {

printf("<OPTION ");

if (NULL == req->q.manpath ? 0 == i :

if (strcmp(req->q.manpath, req->p[i]) == 0)

0 == strcmp(req->q.manpath, req->p[i]))

printf("SELECTED=\"selected\" ");

printf("VALUE=\"");

html_print(req->p[i]);

Line 630 pg_searchres(const struct req *req, struct manpage *r,

Line 621 pg_searchres(const struct req *req, struct manpage *r,

for (i = 0; i < sz; i++) {

printf("<TR>\n"

"<TD CLASS=\"title\">\n"

"<A HREF=\"%s/%s/%s?",

scriptname, req->q.manpath, r[i].file);

http_printquery(req, "&");

printf("\">");

Line 710 catman(const struct req *req, const char *file)

Line 701 catman(const struct req *req, const char *file)

while (NULL != (p = fgetln(f, &len))) {

bold = italic = 0;

for (i = 0; i < (int)len - 1; i++) {

* This means that the catpage is out of state.

* Ignore it and keep going (although the

* catpage is bogus).

Line 751 catman(const struct req *req, const char *file)

Line 742 catman(const struct req *req, const char *file)

continue;

}

* Handle funny behaviour troff-isms.

* These grok'd from the original man2html.c.

Line 789 catman(const struct req *req, const char *file)

Line 780 catman(const struct req *req, const char *file)

}

/* Bold mode. */

if (italic)

printf("</I>");

if ( ! bold)

Line 800 catman(const struct req *req, const char *file)

Line 791 catman(const struct req *req, const char *file)

html_putchar(p[i]);

}

* Clean up the last character.

* We can get to a newline; don't print that.

if (italic)

Line 826 static void

Line 817 static void

format(const struct req *req, const char *file)

{

struct mparse *mp;

struct mchars *mchars;

struct mdoc *mdoc;

struct man *man;

void *vp;

char *opts;

enum mandoclevel rc;

int fd;

int usepath;

Line 839 format(const struct req *req, const char *file)

Line 830 format(const struct req *req, const char *file)

return;

}

mp = mparse_alloc(MPARSE_SO, MANDOCLEVEL_FATAL, NULL,

mchars = mchars_alloc();

req->q.manpath);

mp = mparse_alloc(MPARSE_SO, MANDOCLEVEL_BADARG, NULL,

rc = mparse_readfd(mp, fd, file);

mchars, req->q.manpath);

mparse_readfd(mp, fd, file);

close(fd);

if (rc >= MANDOCLEVEL_FATAL) {

fprintf(stderr, "fatal mandoc error: %s/%s\n",

req->q.manpath, file);

pg_error_internal();

return;

}

usepath = strcmp(req->q.manpath, req->p[0]);

mandoc_asprintf(&opts,

"fragment,man=%s?query=%%N&sec=%%S%s%s%s%s",

Line 866 format(const struct req *req, const char *file)

Line 851 format(const struct req *req, const char *file)

req->q.manpath, file);

pg_error_internal();

mparse_free(mp);

mchars_free(mchars);

return;

}

vp = html_alloc(opts);

vp = html_alloc(mchars, opts);

if (NULL != mdoc)

html_mdoc(vp, mdoc);

Line 878 format(const struct req *req, const char *file)

Line 864 format(const struct req *req, const char *file)

html_free(vp);

mparse_free(mp);

mchars_free(mchars);

free(opts);

}

Line 904 pg_show(struct req *req, const char *fullpath)

Line 891 pg_show(struct req *req, const char *fullpath)

pg_error_badrequest(

"You did not specify a page to show.");

return;

}

manpath = mandoc_strndup(fullpath, file - fullpath);

file++;

Line 953 pg_search(const struct req *req)

Line 940 pg_search(const struct req *req)

struct mansearch search;

struct manpaths paths;

struct manpage *res;

char **cp;

char **argv;

const char *ep, *start;

char *query, *rp, *wp;

size_t ressz;

int i, sz;

int argc;

* Begin by chdir()ing into the root of the manpath.

Line 973 pg_search(const struct req *req)

Line 960 pg_search(const struct req *req)

search.arch = req->q.arch;

search.sec = req->q.sec;

search.deftype = req->q.equal ? TYPE_Nm : (TYPE_Nm | TYPE_Nd);

search.outkey = "Nd";

search.flags = req->q.equal ? MANSEARCH_MAN : 0;

search.argmode = req->q.equal ? ARG_NAME : ARG_EXPR;

search.firstmatch = 1;

paths.sz = 1;

paths.paths = mandoc_malloc(sizeof(char *));

paths.paths[0] = mandoc_strdup(".");

* Poor man's tokenisation: just break apart by spaces.

* Break apart at spaces with backslash-escaping.

* Yes, this is half-ass. But it works for now.

ep = req->q.query;

argc = 0;

while (ep && isspace((unsigned char)*ep))

argv = NULL;

ep++;

rp = query = mandoc_strdup(req->q.query);

for (;;) {

sz = 0;

while (isspace((unsigned char)*rp))

cp = NULL;

rp++;

while (ep && '\0' != *ep) {

if (*rp == '\0')

cp = mandoc_reallocarray(cp, sz + 1, sizeof(char *));

break;

start = ep;

argv = mandoc_reallocarray(argv, argc + 1, sizeof(char *));

while ('\0' != *ep && ! isspace((unsigned char)*ep))

argv[argc++] = wp = rp;

ep++;

for (;;) {

cp[sz] = mandoc_malloc((ep - start) + 1);

if (isspace((unsigned char)*rp)) {

memcpy(cp[sz], start, ep - start);

*wp = '\0';

cp[sz++][ep - start] = '\0';

rp++;

while (isspace((unsigned char)*ep))

break;

ep++;

}

if (rp[0] == '\\' && rp[1] != '\0')

rp++;

if (wp != rp)

*wp = *rp;

if (*rp == '\0')

break;

wp++;

rp++;

}

if (0 == mansearch(&search, &paths, sz, cp, "Nd", &res, &ressz))

if (0 == mansearch(&search, &paths, argc, argv, &res, &ressz))

pg_noresult(req, "You entered an invalid query.");

else if (0 == ressz)

pg_noresult(req, "No results found.");

else

pg_searchres(req, res, ressz);

for (i = 0; i < sz; i++)

free(query);

free(cp[i]);

mansearch_free(res, ressz);

free(cp);

for (i = 0; i < (int)ressz; i++) {

free(res[i].file);

free(res[i].names);

free(res[i].output);

}

free(res);

free(paths.paths[0]);

free(paths.paths);

}

Line 1029 int

Line 1016 int

main(void)

{

struct req req;

struct itimerval itimer;

const char *path;

const char *querystring;

int i;

/* Poor man's ReDoS mitigation. */

itimer.it_value.tv_sec = 2;

itimer.it_value.tv_usec = 0;

itimer.it_interval.tv_sec = 2;

itimer.it_interval.tv_usec = 0;

if (setitimer(ITIMER_VIRTUAL, &itimer, NULL) == -1) {

fprintf(stderr, "setitimer: %s\n", strerror(errno));

pg_error_internal();

return(EXIT_FAILURE);

}

/* Scan our run-time environment. */

if (NULL == (scriptname = getenv("SCRIPT_NAME")))

Line 1056 main(void)

MAN_DIR, strerror(errno));

pg_error_internal();

return(EXIT_FAILURE);

}

memset(&req, 0, sizeof(struct req));

pathgen(&req);

Line 1066 main(void)

if (NULL != (querystring = getenv("QUERY_STRING")))

http_parse(&req, querystring);

if ( ! (NULL == req.q.manpath ||

if (req.q.manpath == NULL)

validate_manpath(&req, req.q.manpath))) {

req.q.manpath = mandoc_strdup(req.p[0]);

else if ( ! validate_manpath(&req, req.q.manpath)) {

pg_error_badrequest(

"You specified an invalid manpath.");

return(EXIT_FAILURE);

CVSweb