util_script.c revision c13d541615044010381184f9edf948c0a4c6723e
2d2eda71267231c2526be701fe655db125852c1ffielding/* ====================================================================
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * The Apache Software License, Version 1.1
bc8fd1b0b1afdf89b8d28eefa8cd74e26ba97986fielding * Copyright (c) 2000-2001 The Apache Software Foundation. All rights
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * reserved.
2d2eda71267231c2526be701fe655db125852c1ffielding * Redistribution and use in source and binary forms, with or without
2d2eda71267231c2526be701fe655db125852c1ffielding * modification, are permitted provided that the following conditions
2d2eda71267231c2526be701fe655db125852c1ffielding * 1. Redistributions of source code must retain the above copyright
2d2eda71267231c2526be701fe655db125852c1ffielding * notice, this list of conditions and the following disclaimer.
2d2eda71267231c2526be701fe655db125852c1ffielding * 2. Redistributions in binary form must reproduce the above copyright
2d2eda71267231c2526be701fe655db125852c1ffielding * notice, this list of conditions and the following disclaimer in
2d2eda71267231c2526be701fe655db125852c1ffielding * the documentation and/or other materials provided with the
2d2eda71267231c2526be701fe655db125852c1ffielding * distribution.
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * 3. The end-user documentation included with the redistribution,
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * if any, must include the following acknowledgment:
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * "This product includes software developed by the
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * Apache Software Foundation (http://www.apache.org/)."
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * Alternately, this acknowledgment may appear in the software itself,
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * if and wherever such third-party acknowledgments normally appear.
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * 4. The names "Apache" and "Apache Software Foundation" must
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * not be used to endorse or promote products derived from this
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * software without prior written permission. For written
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * permission, please contact apache@apache.org.
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * 5. Products derived from this software may not be called "Apache",
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * nor may "Apache" appear in their name, without prior written
64185f9824e42f21ca7b9ae6c004484215c031a7rbb * permission of the Apache Software Foundation.
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
2d2eda71267231c2526be701fe655db125852c1ffielding * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * SUCH DAMAGE.
2d2eda71267231c2526be701fe655db125852c1ffielding * ====================================================================
2d2eda71267231c2526be701fe655db125852c1ffielding * This software consists of voluntary contributions made by many
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * individuals on behalf of the Apache Software Foundation. For more
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * information on the Apache Software Foundation, please see
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * Portions of this software are based upon public domain software
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * originally written at the National Center for Supercomputing Applications,
f062ed7bd262a37a909dd77ce5fc23b446818823fielding * University of Illinois, Urbana-Champaign.
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * Various utility functions which are common to a whole lot of
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * script-type extensions mechanisms, and might as well be gathered
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * in one place (if only to avoid creating inter-module dependancies
2d2eda71267231c2526be701fe655db125852c1ffielding * where there don't have to be).
8af88bd6958b80c224e964892b8237720b13ab1ajerenkrantz#define MALFORMED_MESSAGE "malformed header from script. Bad header="
61fd0cab072a05b855cbef9c585702401ac5ae29rbb while (*++cp) {
61fd0cab072a05b855cbef9c585702401ac5ae29rbbAP_DECLARE(char **) ap_create_environment(apr_pool_t *p, apr_table_t *t)
61fd0cab072a05b855cbef9c585702401ac5ae29rbb apr_table_entry_t *elts = (apr_table_entry_t *) env_arr->elts;
2d2eda71267231c2526be701fe655db125852c1ffielding char **env = (char **) apr_palloc(p, (env_arr->nelts + 2) * sizeof(char *));
7bdef86e15d47d16dcbe7a5611683191774bd5fbgstein env[j] = apr_pstrcat(p, elts[i].key, "=", elts[i].val, NULL);
c9a95767fbf0f5fb0976a06b97a256033925e433rbb const char *rem_logname;
c9a95767fbf0f5fb0976a06b97a256033925e433rbb const char *host;
c9a95767fbf0f5fb0976a06b97a256033925e433rbb apr_array_header_t *hdrs_arr = apr_table_elts(r->headers_in);
c9a95767fbf0f5fb0976a06b97a256033925e433rbb apr_table_entry_t *hdrs = (apr_table_entry_t *) hdrs_arr->elts;
61fd0cab072a05b855cbef9c585702401ac5ae29rbb /* use a temporary apr_table_t which we'll overlap onto
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * r->subprocess_env later
61fd0cab072a05b855cbef9c585702401ac5ae29rbb /* First, add environment vars from headers... this is as per
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * CGI specs, though other sorts of scripting interfaces see
3d96ee83babeec32482c9082c9426340cee8c44dwrowe * the same vars...
7bdef86e15d47d16dcbe7a5611683191774bd5fbgstein /* A few headers are special cased --- Authorization to prevent
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * rogue scripts from capturing passwords; content-type and -length
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * for no particular reason.
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * You really don't want to disable this check, since it leaves you
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * wide open to CGIs stealing passwords and people viewing them
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * in the environment with "ps -e". But, if you must...
2d2eda71267231c2526be701fe655db125852c1ffielding || !strcasecmp(hdrs[i].key, "Proxy-Authorization")) {
2d2eda71267231c2526be701fe655db125852c1ffielding apr_table_addn(e, http2env(r->pool, hdrs[i].key), hdrs[i].val);
61fd0cab072a05b855cbef9c585702401ac5ae29rbb apr_table_addn(e, "PATH", apr_pstrdup(r->pool, env_path));
62db15de4c1f335a64d45821796ae197cff94ef8rbb apr_table_addn(e, "SERVER_SIGNATURE", ap_psignature("", r));
62db15de4c1f335a64d45821796ae197cff94ef8rbb apr_table_addn(e, "SERVER_SOFTWARE", ap_get_server_version());
62db15de4c1f335a64d45821796ae197cff94ef8rbb apr_table_addn(e, "SERVER_NAME", ap_get_server_name(r));
62db15de4c1f335a64d45821796ae197cff94ef8rbb apr_table_addn(e, "SERVER_ADDR", r->connection->local_ip); /* Apache */
48d2edbfb84e5559b5da0f8d614ccab805cc67a8rbb host = ap_get_remote_host(c, r->per_dir_config, REMOTE_HOST, NULL);
62db15de4c1f335a64d45821796ae197cff94ef8rbb apr_table_addn(e, "DOCUMENT_ROOT", ap_document_root(r)); /* Apache */
62db15de4c1f335a64d45821796ae197cff94ef8rbb apr_table_addn(e, "SERVER_ADMIN", s->server_admin); /* Apache */
62db15de4c1f335a64d45821796ae197cff94ef8rbb apr_table_addn(e, "SCRIPT_FILENAME", r->filename); /* Apache */
62db15de4c1f335a64d45821796ae197cff94ef8rbb apr_socket_addr_get(&remotesa, APR_REMOTE, c->client_socket);
62db15de4c1f335a64d45821796ae197cff94ef8rbb apr_table_addn(e, "REMOTE_PORT", apr_psprintf(r->pool, "%d", rport));
91f0d8da77152d24e4bbb31ce199282b3fd6e3b2coar apr_table_addn(e, "REMOTE_IDENT", apr_pstrdup(r->pool, rem_logname));
91f0d8da77152d24e4bbb31ce199282b3fd6e3b2coar /* Apache custom error responses. If we have redirected set two new vars */
91f0d8da77152d24e4bbb31ce199282b3fd6e3b2coar apr_table_addn(e, "REDIRECT_QUERY_STRING", r->prev->args);
91f0d8da77152d24e4bbb31ce199282b3fd6e3b2coar apr_table_overlap(r->subprocess_env, e, APR_OVERLAP_TABLES_SET);
91f0d8da77152d24e4bbb31ce199282b3fd6e3b2coar/* This "cute" little function comes about because the path info on
91f0d8da77152d24e4bbb31ce199282b3fd6e3b2coar * filenames and URLs aren't always the same. So we take the two,
91f0d8da77152d24e4bbb31ce199282b3fd6e3b2coar * and find as much of the two that match as possible.
91f0d8da77152d24e4bbb31ce199282b3fd6e3b2coarAP_DECLARE(int) ap_find_path_info(const char *uri, const char *path_info)
3d96ee83babeec32482c9082c9426340cee8c44dwrowe apr_table_setn(e, "QUERY_STRING", r->args ? r->args : "");
91f0d8da77152d24e4bbb31ce199282b3fd6e3b2coar /* Note that the code below special-cases scripts run from includes,
91f0d8da77152d24e4bbb31ce199282b3fd6e3b2coar * because it "knows" that the sub_request has been hacked to have the
91f0d8da77152d24e4bbb31ce199282b3fd6e3b2coar * args and path_info of the original request, and not any that may have
91f0d8da77152d24e4bbb31ce199282b3fd6e3b2coar * come with the script URI in the include command. Ugh.
db08da9ddcd65c31f9ea44b823898b72a1b24fbestoddard int path_info_start = ap_find_path_info(r->uri, r->path_info);
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * To get PATH_TRANSLATED, treat PATH_INFO as a URI path.
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * Need to re-escape it for this, since the entire URI was
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * un-escaped before we determined where the PATH_INFO began.
a6b9ed64fdf548c61de9714e2cfb999ec59d149cgstein pa_req = ap_sub_req_lookup_uri(ap_escape_uri(r->pool, r->path_info), r,
61fd0cab072a05b855cbef9c585702401ac5ae29rbb char *pt = apr_pstrcat(r->pool, pa_req->filename, pa_req->path_info,
61fd0cab072a05b855cbef9c585702401ac5ae29rbb /* We need to make this a real Windows path name */
61fd0cab072a05b855cbef9c585702401ac5ae29rbb apr_table_setn(e, "PATH_TRANSLATED", apr_pstrdup(r->pool, buffer));
61fd0cab072a05b855cbef9c585702401ac5ae29rbbstatic int set_cookie_doo_doo(void *v, const char *key, const char *val)
a6b9ed64fdf548c61de9714e2cfb999ec59d149cgsteinAP_DECLARE(int) ap_scan_script_header_err_core(request_rec *r, char *buffer,
61fd0cab072a05b855cbef9c585702401ac5ae29rbb int (*getsfunc) (char *, int, void *),
61fd0cab072a05b855cbef9c585702401ac5ae29rbb char *w, *l;
61fd0cab072a05b855cbef9c585702401ac5ae29rbb /* temporary place to hold headers to merge in later */
3d96ee83babeec32482c9082c9426340cee8c44dwrowe /* The HTTP specification says that it is legal to merge duplicate
2d2eda71267231c2526be701fe655db125852c1ffielding * headers into one. Some browsers that support Cookies don't like
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * merged headers and prefer that each Set-Cookie header is sent
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * separately. Lets humour those browsers by not merging.
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * Oh what a pain it is.
61fd0cab072a05b855cbef9c585702401ac5ae29rbb apr_table_do(set_cookie_doo_doo, cookie_table, r->err_headers_out, "Set-Cookie", NULL);
2d2eda71267231c2526be701fe655db125852c1ffielding while (1) {
2d2eda71267231c2526be701fe655db125852c1ffielding if ((*getsfunc) (w, MAX_STRING_LEN - 1, getsfunc_data) == 0) {
2d2eda71267231c2526be701fe655db125852c1ffielding ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
3d96ee83babeec32482c9082c9426340cee8c44dwrowe /* Delete terminal (CR?)LF */
d839a9822ee53ce00da24c15f2d9fe054233d342gstein /* Indeed, the host's '\n':
d839a9822ee53ce00da24c15f2d9fe054233d342gstein '\012' for UNIX; '\015' for MacOS; '\025' for OS/390
d839a9822ee53ce00da24c15f2d9fe054233d342gstein -- whatever the script generates.
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * If we've finished reading the headers, check to make sure any
346029f34d03eb20d84fc35664426d3874b00f9ewrowe * HTTP/1.1 conditions are met. If so, we're done; normal processing
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * will handle the script's output. If not, just return the error.
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * The appropriate thing to do would be to send the script process a
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * SIGPIPE to let it know we're ignoring it, close the channel to the
346029f34d03eb20d84fc35664426d3874b00f9ewrowe * script process, and *then* return the failed-to-meet-condition
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * error. Otherwise we'd be waiting for the script to finish
eda25307d712abd132e100e2b40ae1de5497d3e2trawick * blithering before telling the client the output was no good.
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * However, we don't have the information to do that, so we have to
3d96ee83babeec32482c9082c9426340cee8c44dwrowe * leave it to an upper layer.
61fd0cab072a05b855cbef9c585702401ac5ae29rbb if (w[0] == '\0') {
61fd0cab072a05b855cbef9c585702401ac5ae29rbb if ((cgi_status == HTTP_OK) && (r->method_number == M_GET)) {
3d96ee83babeec32482c9082c9426340cee8c44dwrowe /* the cookies have already been copied to the cookie_table */
61fd0cab072a05b855cbef9c585702401ac5ae29rbb /* if we see a bogus header don't ignore it. Shout and scream */
61fd0cab072a05b855cbef9c585702401ac5ae29rbb /* Chances are that we received an ASCII header text instead of
11a7b0dff22d26770b532c174d1cf2e7b56ec244wrowe * the expected EBCDIC header lines. Try to auto-detect:
a6b9ed64fdf548c61de9714e2cfb999ec59d149cgstein ap_log_error(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r->server,
61fd0cab072a05b855cbef9c585702401ac5ae29rbb "CGI Interface Error: Script headers apparently ASCII: (CGI = %s)",
3d96ee83babeec32482c9082c9426340cee8c44dwrowe#endif /*APR_CHARSET_EBCDIC*/
3d96ee83babeec32482c9082c9426340cee8c44dwrowe /* Soak up all the script output - may save an outright kill */
a6b9ed64fdf548c61de9714e2cfb999ec59d149cgstein while ((*getsfunc) (w, MAX_STRING_LEN - 1, getsfunc_data)) {
61fd0cab072a05b855cbef9c585702401ac5ae29rbb ap_log_rerror(APLOG_MARK, APLOG_NOERRNO|APLOG_ERR, 0, r,
61fd0cab072a05b855cbef9c585702401ac5ae29rbb *l++ = '\0';
61fd0cab072a05b855cbef9c585702401ac5ae29rbb while (*l && apr_isspace(*l)) {
61fd0cab072a05b855cbef9c585702401ac5ae29rbb /* Nuke trailing whitespace */
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * If the script returned a specific status, that's what
346029f34d03eb20d84fc35664426d3874b00f9ewrowe * we'll use - otherwise we assume 200 OK.
fd8b91502bc200ed4cca3810560a2a570522b3debrianp * If the script gave us a Last-Modified header, we can't just
fd8b91502bc200ed4cca3810560a2a570522b3debrianp * pass it on blindly because of restrictions on future values.
45613d36b9466a48def0498cffa07f48980720f8jerenkrantzstatic int getsfunc_FILE(char *buf, int len, void *f)
fd8b91502bc200ed4cca3810560a2a570522b3debrianp return apr_file_gets(buf, len, (apr_file_t *) f) == APR_SUCCESS;
45613d36b9466a48def0498cffa07f48980720f8jerenkrantzAP_DECLARE(int) ap_scan_script_header_err(request_rec *r, apr_file_t *f,
4111de96e9f75c58e77c2bdda23be83b8ebf81ccgregames return ap_scan_script_header_err_core(r, buffer, getsfunc_FILE, f);
4111de96e9f75c58e77c2bdda23be83b8ebf81ccgregames const char *curpos;
4111de96e9f75c58e77c2bdda23be83b8ebf81ccgregamesstatic int getsfunc_STRING(char *w, int len, void *pvastrs)
61fd0cab072a05b855cbef9c585702401ac5ae29rbb const char *p;
5a9667916c79d8c699b069068e5570aa1c331c80gstein w[t] = '\0';
61fd0cab072a05b855cbef9c585702401ac5ae29rbb/* ap_scan_script_header_err_strs() accepts additional const char* args...
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * each is treated as one or more header lines, and the first non-header
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * character is returned to **arg, **data. (The first optional arg is
61fd0cab072a05b855cbef9c585702401ac5ae29rbb * counted as 0.)
61fd0cab072a05b855cbef9c585702401ac5ae29rbbAP_DECLARE_NONSTD(int) ap_scan_script_header_err_strs(request_rec *r,
a6b9ed64fdf548c61de9714e2cfb999ec59d149cgstein const char **termch,
a6b9ed64fdf548c61de9714e2cfb999ec59d149cgstein res = ap_scan_script_header_err_core(r, buffer, getsfunc_STRING, (void *) &strs);
a6b9ed64fdf548c61de9714e2cfb999ec59d149cgsteinAP_DECLARE(void) ap_send_size(apr_ssize_t size, request_rec *r)
61fd0cab072a05b855cbef9c585702401ac5ae29rbb /* XXX: this -1 thing is a gross hack */
61fd0cab072a05b855cbef9c585702401ac5ae29rbb else if (!size) {
fcc25eda7b150e226d3c1cdaea66a943d3fdee4erbb ap_rprintf(r, "%4" APR_SSIZE_T_FMT "k", (size + 512) / 1024);
8b7047e519340545e6807c9749576a40a76b6d3frbb ap_rprintf(r, "%4" APR_SSIZE_T_FMT "M", (size + 524288) / 1048576);