X-Git-Url: https://git.plutz.net/?p=cgilite;a=blobdiff_plain;f=cgilite.sh;h=b47a3e2e683219b773af4383059a6701f2d44d46;hp=b6ccd7fc4feb25aa2771dc8b9d6547841e150c6d;hb=9bb22561275a9ce0d5403a12fe7e8aeeeb2792e9;hpb=32cacdeb99a6b9c864be839fcd4963d8ec502e29 diff --git a/cgilite.sh b/cgilite.sh index b6ccd7f..b47a3e2 100755 --- a/cgilite.sh +++ b/cgilite.sh @@ -1,6 +1,6 @@ #!/bin/sh -# Copyright 2017 Paul Hänsch +# Copyright 2017 - 2021 Paul Hänsch # # This is CGIlite. # A collection of posix shell functions for writing CGI scripts. @@ -18,141 +18,333 @@ # You should have received a copy of the GNU Affero General Public License # along with CGIlite. If not, see . +[ -n "$include_cgilite" ] && return 0 +# guard set after webserver part + # ksh and zsh workaround # set -o posix # ksh, not portable setopt -o OCTAL_ZEROES 2>&- -BR="$(printf '\n')" -CR="$(printf '\r')" +# Integrated webserver request timeout +cgilite_timeout=2 + +# General environment variables +# $_EXEC - directory containing application itself +# $_DATA - direcotry where application data may be stored +# $_BASE - optional prefix for http path, e.g. "/myapp" +# +# Programmers should take care to use those variables throughout the +# application. +# Variables may be set via CLI argument, in environment, or left as default. + +for cgilite_arg in "$@"; do case $cgilite_arg in + --exec=*) _EXEC="${cgilite_arg#*=}";; + --data=*) _DATA="${cgilite_arg#*=}";; + --base=*) _BASE="${cgilite_arg#*=}";; +esac; done +unset cgilite_arg + +_EXEC="${_EXEC:-${0%/*}}" +_DATA="${_DATA:-.}" +_EXEC="${_EXEC%/}" _DATA="${_DATA%/}" _BASE="${_BASE%/}" + +export _EXEC _DATA _BASE + +# Carriage Return and Line Break characters for convenience +CR=" " +BR=' +' + +PATH(){ + local str seg out + # normalize path + # read from stdin if no arguments are provided + + [ $# -eq 0 ] && str="$(cat)" || str="$*" + while [ "$str" ]; do + seg=${str%%/*}; str="${str#*/}" + case $seg in + ..) out="${out%/}"; out="${out%/*}/";; + .|'') out="${out%/}/";; + *) out="${out%/}/${seg}";; + esac; + [ "$seg" = "$str" ] && break + done + [ "${str}" -a "${out}" ] && printf %s "$out" || printf %s/ "${out%/}" +} + +HEX_DECODE(){ + local pfx="$1" in="$2" out + # Print out Data encoded as Hex + # + # Arguments: + # pfx - required, prefix for a hex tupel, e.g. "\x", "%" "\", may be empty + # in - required, string to be decoded + # + # anything that does not constitute a tupel of valid Hex numerals + # will be copied to the output literally + + while [ "$in" ]; do + case $in in + "$pfx"[0-9a-fA-F][0-9a-fA-F]*) in="${in#${pfx}}";; + \\*) in="${in#?}"; out="${out}\\\\"; continue;; + %*) in="${in#?}"; out="${out}%%"; continue;; + *) att="${in%%"${pfx}"*}"; att="${att%%%*}"; att="${att%%\\*}" + out="${out}${att}"; in="${in#"${att}"}"; continue;; + esac; + + # Hex escapes for printf (e.g. \x41) are not portable + # The portable way for Hex output is transforming Hex to Octal + # (e.g. \x41 = \101) + case $in in + [0123]?*) out="${out}\\0";; + [4567]?*) out="${out}\\1";; + [89aAbB]?*) out="${out}\\2";; + [c-fC-F]?*) out="${out}\\3";; + esac + case $in in + [048cC][0-7]*) out="${out}0";; + [048cC][89a-fA-F]*) out="${out}1";; + [159dD][0-7]*) out="${out}2";; + [159dD][89a-fA-F]*) out="${out}3";; + [26aAeE][0-7]*) out="${out}4";; + [26aAeE][89a-fA-F]*) out="${out}5";; + [37bBfF][0-7]*) out="${out}6";; + [37bBfF][89a-fA-F]*) out="${out}7";; + esac + case $in in + ?[08]*) out="${out}0";; + ?[19]*) out="${out}1";; + ?[2aA]*) out="${out}2";; + ?[3bB]*) out="${out}3";; + ?[4cC]*) out="${out}4";; + ?[5dD]*) out="${out}5";; + ?[6eE]*) out="${out}6";; + ?[7fF]*) out="${out}7";; + esac + in="${in#?}" + in="${in#?}" + done + printf -- "$out" +} + +if [ -z "$REQUEST_METHOD" ]; then + # no webserver variables means we are running via inetd / ncat + # so use builtin web server + + # Use env from inetd as webserver variables + REMOTE_ADDR="${TCPREMOTEIP}" + SERVER_NAME="${TCPLOCALIP}" + SERVER_PORT="${TCPLOCALPORT}" + + # Wait 2 seconds for request or kill connection through watchdog. + # Once Request is received the watchdog will be suspended (killed). + # At the end of the loop the watchdog will be restarted to enable + # timeout for the subsequent request. + + (sleep $cgilite_timeout && kill $$) & cgilite_watchdog=$! + while read REQUEST_METHOD REQUEST_URI SERVER_PROTOCOL; do + unset PATH_INFO QUERY_STRING cgilite_headers CONTENT_LENGTH CONTENT_TYPE -if [ "$1" = '--inetd' -a -z "$REQUEST_METHOD" ]; then - REMOTE_ADDR="$TCPREMOTEIP" - SERVER_NAME="$TCPLOCALIP" - SERVER_PORT="$TCPLOCALPORT" + [ "${SERVER_PROTOCOL#HTTP/1.[01]${CR}}" ] && break + kill $cgilite_watchdog - read REQUEST_METHOD REQUEST_URI SERVER_PROTOCOL - PATH_INFO="${REQUEST_URI%\?*}" - QUERY_STRING="${REQUEST_URI#*\?}" - HTTP_HEADERS="$(sed -u '/^\r\?$/q')" + SERVER_PROTOCOL="${SERVER_PROTOCOL%${CR}}" + PATH_INFO="$(HEX_DECODE % "${REQUEST_URI%\?*}" |PATH)" + [ "${REQUEST_URI}" = "${REQUEST_URI#*\?}" ] \ + && QUERY_STRING='' \ + || QUERY_STRING="${REQUEST_URI#*\?}" + while read -r hl; do + hl="${hl%${CR}}"; [ "$hl" ] || break + case $hl in + 'Content-Length: '*) CONTENT_LENGTH="${hl#*: }";; + 'Content-Type: '*) CONTENT_TYPE="${hl#*: }";; + esac + cgilite_headers="${cgilite_headers}${hl}${BR}" + done - HTTP_CONTENT_LENGTH="$(printf %s "$HTTP_HEADERS" |grep -oiE '^Content-Length: [0-9]+')" - HTTP_CONTENT_LENGTH="${HTTP_CONTENT_LENGTH%%: *}" - HTTP_COOKIE="$(printf %s "$HTTP_HEADERS" |grep -oiE '^Cookie: [^\r]+')" - HTTP_COOKIE="${HTTP_COOKIE%%: *}" + export REMOTE_ADDR SERVER_NAME SERVER_PORT REQUEST_METHOD REQUEST_URI SERVER_PROTOCOL \ + PATH_INFO QUERY_STRING CONTENT_TYPE CONTENT_LENGTH cgilite_headers - export REMOTE_ADDR SERVER_NAME SERVER_PORT REQUEST_METHOD REQUEST_URI SERVER_PROTOCOL \ - PATH_INFO QUERY_STRING HTTP_CONTENT_LENGTH HTTP_COOKIE + # Try to serve multiple requests, provided that script serves a + # Content-Length header. + # Without Content-Length header, connection will terminate after + # script. - . "$0" |sed '1{s;^Status: ;HTTP/1.0 ;; t; iHTTP/1.0 200 OK\r - }' - exit $? + cgilite_status='200 OK'; cgilite_response=''; cgilite_cl="Connection: close${CR}${BR}"; + . "$0" | while read -r l; do case $l in + Status:*) + cgilite_status="${l#Status: }";; + Content-Length:*) + cgilite_cl="" + cgilite_response="${cgilite_response:+${cgilite_response}${BR}}${l}";; + Connection:*) + cgilite_cl="${l}${BR}";; + $CR) printf '%s %s\r\n%s%s\r\n' \ + 'HTTP/1.1' "${cgilite_status%${CR}}" \ + "${cgilite_response}${cgilite_response:+${BR}}" "${cgilite_cl}" + cat || kill $$ + [ "${cgilite_cl#Connection}" = "${cgilite_cl}" ]; exit;; + *) cgilite_response="${cgilite_response:+${cgilite_response}${BR}}${l}";; + esac; done || exit 0; + (sleep $cgilite_timeout && kill $$) & cgilite_watchdog=$! + done + kill $cgilite_watchdog + exit 0 fi -if [ "$REQUEST_METHOD" = POST -a "${HTTP_CONTENT_LENGTH:=${CONTENT_LENGTH:=0}}" -gt 0 ]; then - cgilite_post="$(head -c "$HTTP_CONTENT_LENGTH")" +include_cgilite="$0" + +if [ "${REQUEST_METHOD}" = POST -a "${CONTENT_LENGTH:-0}" -gt 0 -a \ + "${CONTENT_TYPE}" = "application/x-www-form-urlencoded" ]; then + cgilite_post="$(head -c "$CONTENT_LENGTH")" fi +PATH_INFO="$(PATH "/${PATH_INFO#${_BASE}}")" + +debug(){ [ $# -gt 0 ] && printf '%s\n' "$@" >&2 || tee -a /dev/stderr; } +[ "${DEBUG+x}" ] && env >&2 + +# general helper functions, see GET, POST, and REF below + cgilite_count(){ - case $1 in - GET) printf %s "&${QUERY_STRING}";; - POST) printf %s "&${cgilite_post}";; - REF) printf %s "&${HTTP_REFERER#*\?}";; - esac \ - | grep -Eo '&'"$2"'=[^&]*' \ + printf %s "&$1" \ + | grep -oE '&'"$2"'=[^&]*' \ | wc -l } cgilite_value(){ - printf "$( - case $1 in - GET) printf %s "&${QUERY_STRING}";; - POST) printf %s "&${cgilite_post}";; - REF) printf %s "&${HTTP_REFERER#*\?}";; - esac \ - | grep -Eo '&'"$2"'=[^&]*' \ - | sed -rn "${3:-1}"'{s;^[^=]+=;;; s;\+; ;g; s;\\;\\\\;g; - # Hexadecimal { %00 - %FF } will be transformed to octal { \000 - \377 } for posix printf - s;%[0123].;&\\0;g; s;%[4567].;&\\1;g; s;%[89AB].;&\\2;g; s;%[CDEF].;&\\3;g; - s;%[048C][0-7]\\.;&0;g; s;%[048C][89A-F]\\.;&1;g; s;%[159D][0-7]\\.;&2;g; s;%[159D][89A-F]\\.;&3;g; - s;%[26AE][0-7]\\.;&4;g; s;%[26AE][89A-F]\\.;&5;g; s;%[37BF][0-7]\\.;&6;g; s;%[37BF][89A-F]\\.;&7;g; - s;%.[08](\\..);\10;g; s;%.[19](\\..);\11;g; s;%.[2A](\\..);\12;g; s;%.[3B](\\..);\13;g; - s;%.[4C](\\..);\14;g; s;%.[5D](\\..);\15;g; s;%.[6E](\\..);\16;g; s;%.[7F](\\..);\17;g; - p}' - )" + local str="&$1" name="$2" cnt="${3:-1}" + while [ $cnt -gt 0 ]; do + [ "${str}" = "${str#*&${name}=}" ] && return 1 + str="${str#*&${name}=}" + cnt=$((cnt - 1)) + done + HEX_DECODE % "$(printf %s "${str%%&*}" |tr + \ )" } -GET(){ cgilite_value GET $@; } -GET_COUNT(){ cgilite_count GET $1; } +cgilite_keys(){ + local str="&$1" + while [ "${str#*&}" != "${str}" ]; do + str="${str#*&}" + printf '%s\n' "${str%%=*}" + done \ + | sort -u +} -POST(){ cgilite_value POST $@; } -POST_COUNT(){ cgilite_count POST $1; } +# Read arguments from GET, POST, or the query string of the referrer (REF). +# Example: +# GET varname n +# +# where n is number for the Nth occurence of a variable and defaults to 1 +# +# *_COUNT varname +# -> returns number of ocurences +# *_KEYS +# -> returns list of available varnames -REF(){ cgilite_value REF $@; } -REF_COUNT(){ cgilite_count REF $1; } +GET(){ cgilite_value "${QUERY_STRING}" "$@"; } +GET_COUNT(){ cgilite_count "${QUERY_STRING}" $1; } +GET_KEYS(){ cgilite_keys "${QUERY_STRING}"; } + +POST(){ cgilite_value "${cgilite_post}" "$@"; } +POST_COUNT(){ cgilite_count "${cgilite_post}" $1; } +POST_KEYS(){ cgilite_keys "${cgilite_post}"; } + +REF(){ cgilite_value "${HTTP_REFERER#*\?}" "$@"; } +REF_COUNT(){ cgilite_count "${HTTP_REFERER#*\?}" $1; } +REF_KEYS(){ cgilite_keys "${HTTP_REFERER#*\?}"; } + +HEADER(){ + # Read value of header line. Use this instead of + # referencing HTTP_* environment variables. + if [ -n "${cgilite_headers+x}" ]; then + local str="${BR}${cgilite_headers}" + [ "${str}" = "${str#*${BR}${1}: }" ] && return 1 + str="${str#*${BR}${1}: }" + printf %s "${str%%${BR}*}" + else + local var="HTTP_$(printf %s "$1" |tr a-z- A-Z-)" + eval "[ \"\$$var\" ] && printf %s \"\$$var\" || return 1" + # eval "printf %s \"\$HTTP_$(printf %s "${1}" |tr a-z A-Z |tr -c A-Z _)\"" + fi +} COOKIE(){ - printf "$( - printf %s " ${HTTP_COOKIE}" \ - | grep -Eo '[; ]'"$1"'=[^;]*' \ - | sed -rn "${2:-1}"'{s;^[^=]+=;;; s;\+; ;g; s;\\;\\\\;g; - # Hexadecimal { %00 - %FF } will be transformed to octal { \000 - \377 } for posix printf - s;%[0123].;&\\0;g; s;%[4567].;&\\1;g; s;%[89AB].;&\\2;g; s;%[CDEF].;&\\3;g; - s;%[048C][0-7]\\.;&0;g; s;%[048C][89A-F]\\.;&1;g; s;%[159D][0-7]\\.;&2;g; s;%[159D][89A-F]\\.;&3;g; - s;%[26AE][0-7]\\.;&4;g; s;%[26AE][89A-F]\\.;&5;g; s;%[37BF][0-7]\\.;&6;g; s;%[37BF][89A-F]\\.;&7;g; - s;%.[08](\\..);\10;g; s;%.[19](\\..);\11;g; s;%.[2A](\\..);\12;g; s;%.[3B](\\..);\13;g; - s;%.[4C](\\..);\14;g; s;%.[5D](\\..);\15;g; s;%.[6E](\\..);\16;g; s;%.[7F](\\..);\17;g; - p}' + # Read value of cookie + HEX_DECODE % "$( + HEADER Cookie \ + | grep -oE '(^|; ?)'"$1"'=[^;]*' \ + | sed -En "${2:-1}"'{s;^[^=]+=;;; s;\+; ;g; p;}' )" } HTML(){ - # HTML Entity Coding - # Prints UTF-8 string as decimal Unicode Code Points - # Useful for escaping user input for use in HTML text and attributes - printf %s "$*" \ - | hexdump -ve '/1 "%03o\n"' \ - | while read n; do - case $n in - # bitbanging octal UTF-8 chains into singular 7 digit octal numbers - [01]??) printf '0000%s' $n;; # 7 bit ASCII character, nothing to do - 2??) printf '%s' ${n#2};; # tail fragment, append 6 bit - 3[0123]?) printf '000%s' ${n#3};; # 2 octet (11 bit) chain start - 34?) printf '00%s' ${n#34};; # 3 octet (16 bit) chain start - 35?) printf '01%s' ${n#35};; # 3 octet chain start, high - 36?) printf '%s' ${n#36};; # 4 octet (21 bit) chain start - esac - done \ - | sed -r 's;.{7};&\n;g;' \ - | while read n; do - printf '&#%d;' $((0$n)) - done + # Escape HTML cahracters + # Also escape [, ], and \n for use in html-sh + local str out + [ $# -eq 0 ] && str="$(cat)" || str="$*" + while [ "$str" ]; do case $str in + \&*) out="${out}&"; str="${str#?}";; + \<*) out="${out}<"; str="${str#?}";; + \>*) out="${out}>"; str="${str#?}";; + \"*) out="${out}""; str="${str#?}";; + \'*) out="${out}'"; str="${str#?}";; + \[*) out="${out}["; str="${str#?}";; + \]*) out="${out}]"; str="${str#?}";; + "${CR}"*) out="${out} "; str="${str#?}";; + "${BR}"*) out="${out} "; str="${str#?}";; + *) out="${out}${str%%[]&<>\"\'[]*}"; str="${str#"${str%%[]&<>\"\'[]*}"}";; + esac; done + printf %s "$out" } URL(){ - # Code every character in URL escape hex format - # except alphanumeric ascii - - printf %s "$*" \ - | hexdump -v -e '/1 ",%02X"' \ - | tr , % + # Escape pathes, so they can be used in link tags and HTTP Headers + local str out + [ $# -eq 0 ] && str="$(cat)" || str="$*" + while [ "$str" ]; do case $str in + \&*) out="${out}%26"; str="${str#?}";; + \"*) out="${out}%22"; str="${str#?}";; + \'*) out="${out}%27"; str="${str#?}";; + \?*) out="${out}%3F"; str="${str#?}";; + \#*) out="${out}%23"; str="${str#?}";; + \[*) out="${out}%5B"; str="${str#?}";; + \]*) out="${out}%5D"; str="${str#?}";; + \ *) out="${out}%20"; str="${str#?}";; + " "*) out="${out}%09"; str="${str#?}";; + "${CR}"*) out="${out}%0D"; str="${str#?}";; + "${BR}"*) out="${out}%0A"; str="${str#?}";; + %*) out="${out}%25"; str="${str#?}";; + *) out="${out}${str%%[]&\"\'\?# ${CR}${BR}%[]*}"; str="${str#"${str%%[]&\"\'\?# ${CR}${BR}%[]*}"}";; + esac; done + printf %s "$out" } SET_COOKIE(){ + # Param: session | +seconds | [date] + # Param: name=value + # Param: Path= | Domain= | Secure + local expire cookie case "$1" in ''|0|session) expire='';; [+-][0-9]*) expire="$(date -R -d @$(($(date +%s) + $1)))";; - *) expire="$(date -R -d "$1")";; + *) expire="$(date -R -d "$1")";; esac cookie="$2" - - printf 'Set-Cookie: %s' "$cookie" - [ -n "$expire" ] && printf '; Expires=%s' "$expire" + + printf 'Set-Cookie: %s; HttpOnly; SameSite=Lax' "$cookie" + [ -n "$expire" ] && printf '; Expires=%s' "${expire%+????}${expire:+GMT}" [ $# -ge 3 ] && shift 2 && printf '; %s' "$@" printf '\r\n' } REDIRECT(){ - printf 'Status: 303 See Other\r\nLocation: %s\r\n\r\n' "$*" + # Trigger redirct and terminate script + printf '%s: %s\r\n' \ + Status "303 See Other" \ + Content-Length 0 \ + Location "$*" + printf '\r\n' exit 0 } -