src/protocol/file/cgi.c

   1 /* Internal "cgi" protocol implementation */
   2
   3 #ifdef HAVE_CONFIG_H
   4 #include "config.h"
   5 #endif
   6
   7 #include <errno.h>
   8 #include <stdio.h>
   9 #include <stdlib.h>
  10 #include <sys/types.h>
  11 #include <sys/stat.h> /* OS/2 needs this after sys/types.h */
  12 #ifdef HAVE_FCNTL_H
  13 #include <fcntl.h> /* OS/2 needs this after sys/types.h */
  14 #endif
  15 #ifdef HAVE_UNISTD_H
  16 #include <unistd.h>
  17 #endif
  18
  19 #include "elinks.h"
  20
  21 #include "config/options.h"
  22 #include "cookies/cookies.h"
  23 #include "intl/gettext/libintl.h"
  24 #include "mime/backend/common.h"
  25 #include "network/connection.h"
  26 #include "network/socket.h"
  27 #include "osdep/osdep.h"
  28 #include "osdep/sysname.h"
  29 #include "protocol/common.h"
  30 #include "protocol/file/cgi.h"
  31 #include "protocol/http/http.h"
  32 #include "protocol/uri.h"
  33 #include "terminal/terminal.h"
  34 #include "util/conv.h"
  35 #include "util/env.h"
  36 #include "util/string.h"
  37
  38 static struct option_info cgi_options[] = {
  39         INIT_OPT_TREE("protocol.file", N_("Local CGI"),
  40                 "cgi", 0,
  41                 N_("Local CGI specific options.")),
  42
  43         INIT_OPT_STRING("protocol.file.cgi", N_("Path"),
  44                 "path", 0, "",
  45                 N_("Colon separated list of directories, where CGI scripts are stored.")),
  46
  47         INIT_OPT_BOOL("protocol.file.cgi", N_("Allow local CGI"),
  48                 "policy", 0, 0,
  49                 N_("Whether to execute local CGI scripts.")),
  50         NULL_OPTION_INFO,
  51 };
  52
  53 struct module cgi_protocol_module = struct_module(
  54         /* name: */             N_("CGI"),
  55         /* options: */          cgi_options,
  56         /* hooks: */            NULL,
  57         /* submodules: */       NULL,
  58         /* data: */             NULL,
  59         /* init: */             NULL,
  60         /* done: */             NULL
  61 );
  62
  63 static void
  64 close_pipe_and_read(struct socket *data_socket)
  65 {
  66         struct connection *conn = data_socket->conn;
  67         struct read_buffer *rb = alloc_read_buffer(conn->socket);
  68
  69         if (!rb) return;
  70
  71         memcpy(rb->data, "HTTP/1.0 200 OK\r\n", 17);
  72         rb->length = 17;
  73         rb->freespace -= 17;
  74
  75         conn->unrestartable = 1;
  76         close(conn->cgi_pipes[1]);
  77         data_socket->fd = conn->cgi_pipes[1] = -1;
  78
  79         conn->socket->state = SOCKET_END_ONCLOSE;
  80         read_from_socket(conn->socket, rb, S_SENT, http_got_header);
  81 }
  82
  83 static void
  84 send_post_data(struct connection *conn)
  85 {
  86 #define POST_BUFFER_SIZE 4096
  87         unsigned char *post = conn->uri->post;
  88         unsigned char *postend;
  89         unsigned char buffer[POST_BUFFER_SIZE];
  90         struct string data;
  91         int n = 0;
  92
  93         if (!init_string(&data)) {
  94                 abort_connection(conn, S_OUT_OF_MEM);
  95                 return;
  96         }
  97         postend = strchr(post, '\n');
  98         if (postend) post = postend + 1;
  99
 100         /* FIXME: Code duplication with protocol/http/http.c! --witekfl */
 101         while (post[0] && post[1]) {
 102                 int h1, h2;
 103
 104                 h1 = unhx(post[0]);
 105                 assert(h1 >= 0 && h1 < 16);
 106                 if_assert_failed h1 = 0;
 107
 108                 h2 = unhx(post[1]);
 109                 assert(h2 >= 0 && h2 < 16);
 110                 if_assert_failed h2 = 0;
 111
 112                 buffer[n++] = (h1<<4) + h2;
 113                 post += 2;
 114                 if (n == POST_BUFFER_SIZE) {
 115                         add_bytes_to_string(&data, buffer, n);
 116                         n = 0;
 117                 }
 118         }
 119         if (n)
 120                 add_bytes_to_string(&data, buffer, n);
 121
 122         /* Use data socket for passing the pipe. It will be cleaned up in
 123          * close_pipe_and_read(). */
 124         conn->data_socket->fd = conn->cgi_pipes[1];
 125
 126         write_to_socket(conn->data_socket, data.source, data.length,
 127                         S_SENT, close_pipe_and_read);
 128
 129         done_string(&data);
 130 #undef POST_BUFFER_SIZE
 131 }
 132
 133 static void
 134 send_request(struct connection *conn)
 135 {
 136         if (conn->uri->post) send_post_data(conn);
 137         else close_pipe_and_read(conn->data_socket);
 138 }
 139
 140 /* This function sets CGI environment variables. */
 141 static int
 142 set_vars(struct connection *conn, unsigned char *script)
 143 {
 144         unsigned char *post = conn->uri->post;
 145         unsigned char *query = get_uri_string(conn->uri, URI_QUERY);
 146         unsigned char *str;
 147         int res = env_set("QUERY_STRING", empty_string_or_(query), -1);
 148
 149         mem_free_if(query);
 150         if (res) return -1;
 151
 152         if (post) {
 153                 unsigned char *postend = strchr(post, '\n');
 154                 unsigned char buf[16];
 155
 156                 if (postend) {
 157                         res = env_set("CONTENT_TYPE", post, postend - post);
 158                         if (res) return -1;
 159                         post = postend + 1;
 160                 }
 161                 snprintf(buf, 16, "%d", (int) strlen(post) / 2);
 162                 if (env_set("CONTENT_LENGTH", buf, -1)) return -1;
 163         }
 164
 165         if (env_set("REQUEST_METHOD", post ? "POST" : "GET", -1)) return -1;
 166         if (env_set("SERVER_SOFTWARE", "ELinks/" VERSION, -1)) return -1;
 167         if (env_set("SERVER_PROTOCOL", "HTTP/1.0", -1)) return -1;
 168         /* XXX: Maybe it is better to set this to an empty string? --pasky */
 169         if (env_set("SERVER_NAME", "localhost", -1)) return -1;
 170         /* XXX: Maybe it is better to set this to an empty string? --pasky */
 171         if (env_set("REMOTE_ADDR", "127.0.0.1", -1)) return -1;
 172         if (env_set("GATEWAY_INTERFACE", "CGI/1.1", -1)) return -1;
 173         /* This is the path name extracted from the URI and decoded, per
 174          * http://cgi-spec.golux.com/draft-coar-cgi-v11-03-clean.html#8.1 */
 175         if (env_set("SCRIPT_NAME", script, -1)) return -1;
 176         if (env_set("SCRIPT_FILENAME", script, -1)) return -1;
 177         if (env_set("PATH_TRANSLATED", script, -1)) return -1;
 178         if (env_set("REDIRECT_STATUS", "1", -1)) return -1;
 179
 180         /* From now on, just HTTP-like headers are being set. Missing variables
 181          * due to full environment are not a problem according to the CGI/1.1
 182          * standard, so we already filled our environment with we have to have
 183          * there and we won't fail anymore if it won't work out. */
 184
 185         str = get_opt_str("protocol.http.user_agent");
 186         if (*str && strcmp(str, " ")) {
 187                 unsigned char *ustr, ts[64] = "";
 188
 189                 if (!list_empty(terminals)) {
 190                         unsigned int tslen = 0;
 191                         struct terminal *term = terminals.prev;
 192
 193                         ulongcat(ts, &tslen, term->width, 3, 0);
 194                         ts[tslen++] = 'x';
 195                         ulongcat(ts, &tslen, term->height, 3, 0);
 196                 }
 197                 ustr = subst_user_agent(str, VERSION_STRING, system_name, ts);
 198
 199                 if (ustr) {
 200                         env_set("HTTP_USER_AGENT", ustr, -1);
 201                         mem_free(ustr);
 202                 }
 203         }
 204
 205         switch (get_opt_int("protocol.http.referer.policy")) {
 206         case REFERER_NONE:
 207                 /* oh well */
 208                 break;
 209
 210         case REFERER_FAKE:
 211                 str = get_opt_str("protocol.http.referer.fake");
 212                 env_set("HTTP_REFERER", str, -1);
 213                 break;
 214
 215         case REFERER_TRUE:
 216                 /* XXX: Encode as in add_url_to_http_string() ? --pasky */
 217                 if (conn->referrer)
 218                         env_set("HTTP_REFERER", struri(conn->referrer), -1);
 219                 break;
 220
 221         case REFERER_SAME_URL:
 222                 str = get_uri_string(conn->uri, URI_HTTP_REFERRER);
 223                 if (str) {
 224                         env_set("HTTP_REFERER", str, -1);
 225                         mem_free(str);
 226                 }
 227                 break;
 228         }
 229
 230         /* Protection against vim cindent bugs ;-). */
 231         env_set("HTTP_ACCEPT", "*/" "*", -1);
 232
 233         /* We do not set HTTP_ACCEPT_ENCODING. Yeah, let's let the CGI script
 234          * gzip the stuff so that the CPU doesn't at least sit idle. */
 235
 236         str = get_opt_str("protocol.http.accept_language");
 237         if (*str) {
 238                 env_set("HTTP_ACCEPT_LANGUAGE", str, -1);
 239         }
 240 #ifdef CONFIG_NLS
 241         else if (get_opt_bool("protocol.http.accept_ui_language")) {
 242                 env_set("HTTP_ACCEPT_LANGUAGE",
 243                         language_to_iso639(current_language), -1);
 244         }
 245 #endif
 246
 247         if (conn->cached && !conn->cached->incomplete && conn->cached->head
 248             && conn->cached->last_modified
 249             && conn->cache_mode <= CACHE_MODE_CHECK_IF_MODIFIED) {
 250                 env_set("HTTP_IF_MODIFIED_SINCE", conn->cached->last_modified, -1);
 251         }
 252
 253         if (conn->cache_mode >= CACHE_MODE_FORCE_RELOAD) {
 254                 env_set("HTTP_PRAGMA", "no-cache", -1);
 255                 env_set("HTTP_CACHE_CONTROL", "no-cache", -1);
 256         }
 257
 258         /* TODO: HTTP auth support. On the other side, it was weird over CGI
 259          * IIRC. --pasky */
 260
 261 #ifdef CONFIG_COOKIES
 262         {
 263                 struct string *cookies = send_cookies(conn->uri);
 264
 265                 if (cookies) {
 266                         env_set("HTTP_COOKIE", cookies->source, -1);
 267
 268                         done_string(cookies);
 269                 }
 270         }
 271 #endif
 272
 273         return 0;
 274 }
 275
 276 static int
 277 test_path(unsigned char *path)
 278 {
 279         unsigned char *cgi_path = get_opt_str("protocol.file.cgi.path");
 280         unsigned char **path_ptr;
 281         unsigned char *filename;
 282
 283         for (path_ptr = &cgi_path;
 284              (filename = get_next_path_filename(path_ptr, ':'));
 285              ) {
 286                 int filelen = strlen(filename);
 287                 int res;
 288
 289                 if (filename[filelen - 1] != '/') {
 290                         add_to_strn(&filename, "/");
 291                         filelen++;
 292                 }
 293
 294                 res = strncmp(path, filename, filelen);
 295                 mem_free(filename);
 296                 if (!res) return 0;
 297         }
 298         return 1;
 299 }
 300
 301 int
 302 execute_cgi(struct connection *conn)
 303 {
 304         unsigned char *last_slash;
 305         unsigned char *script;
 306         int scriptlen;
 307         struct stat buf;
 308         pid_t pid;
 309         enum connection_state state = S_OK;
 310         int pipe_read[2], pipe_write[2];
 311
 312         if (!get_opt_bool("protocol.file.cgi.policy")) return 1;
 313
 314         /* Not file referrer */
 315         if (conn->referrer && conn->referrer->protocol != PROTOCOL_FILE) {
 316                 return 1;
 317         }
 318
 319         script = get_uri_string(conn->uri, URI_PATH);
 320         if (!script) {
 321                 state = S_OUT_OF_MEM;
 322                 goto end2;
 323         }
 324         decode_uri(script);
 325         scriptlen = strlen(script);
 326
 327         if (stat(script, &buf) || !(S_ISREG(buf.st_mode))
 328                 || !(buf.st_mode & S_IXUSR)) {
 329                 mem_free(script);
 330                 return 1;
 331         }
 332
 333         last_slash = strrchr(script, '/');
 334         if (last_slash++) {
 335                 unsigned char storage;
 336                 int res;
 337
 338                 /* We want to compare against path with the trailing slash. */
 339                 storage = *last_slash;
 340                 *last_slash = 0;
 341                 res = test_path(script);
 342                 *last_slash = storage;
 343                 if (res) {
 344                         mem_free(script);
 345                         return 1;
 346                 }
 347         } else {
 348                 mem_free(script);
 349                 return 1;
 350         }
 351
 352         if (c_pipe(pipe_read) || c_pipe(pipe_write)) {
 353                 state = -errno;
 354                 goto end1;
 355         }
 356
 357         pid = fork();
 358         if (pid < 0) {
 359                 state = -errno;
 360                 goto end0;
 361         }
 362         if (!pid) { /* CGI script */
 363                 if (set_vars(conn, script)) {
 364                         _exit(1);
 365                 }
 366                 if ((dup2(pipe_write[0], STDIN_FILENO) < 0)
 367                         || (dup2(pipe_read[1], STDOUT_FILENO) < 0)) {
 368                         _exit(2);
 369                 }
 370                 /* We implicitly chain stderr to ELinks' stderr. */
 371                 close_all_non_term_fd();
 372
 373                 last_slash[-1] = 0; set_cwd(script); last_slash[-1] = '/';
 374                 if (execl(script, script, NULL)) {
 375                         _exit(3);
 376                 }
 377
 378         } else { /* ELinks */
 379
 380                 if (!init_http_connection_info(conn, 1, 0, 1))
 381                         return 0;
 382
 383                 mem_free(script);
 384
 385                 close(pipe_read[1]); close(pipe_write[0]);
 386                 conn->cgi_pipes[0] = pipe_read[0];
 387                 conn->cgi_pipes[1] = pipe_write[1];
 388                 conn->socket->fd = conn->cgi_pipes[0];
 389
 390                 send_request(conn);
 391                 return 0;
 392         }
 393
 394 end0:
 395         close(pipe_read[0]); close(pipe_read[1]);
 396         close(pipe_write[0]); close(pipe_write[1]);
 397 end1:
 398         mem_free(script);
 399 end2:
 400         abort_connection(conn, state);
 401         return 0;
 402 }