lighttpd1.4/src/mod_ssi.c

#include "first.h"

#include "base.h"
#include "fdevent.h"
#include "log.h"
#include "buffer.h"
#include "http_header.h"
#include "stat_cache.h"

#include "plugin.h"

#include "response.h"

#include "mod_ssi.h"

#include "sys-socket.h"

#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>

#include <ctype.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>
#include <fcntl.h>
#include <time.h>
#include <unistd.h>

#ifdef HAVE_PWD_H
# include <pwd.h>
#endif

#ifdef HAVE_SYS_FILIO_H
# include <sys/filio.h>
#endif

#include "etag.h"

static handler_ctx * handler_ctx_init(plugin_data *p, log_error_st *errh) {
	handler_ctx *hctx = calloc(1, sizeof(*hctx));
	force_assert(hctx);
	hctx->errh = errh;
	hctx->timefmt = p->timefmt;
	hctx->stat_fn = p->stat_fn;
	hctx->ssi_vars = p->ssi_vars;
	hctx->ssi_cgi_env = p->ssi_cgi_env;
	memcpy(&hctx->conf, &p->conf, sizeof(plugin_config));
	return hctx;
}

static void handler_ctx_free(handler_ctx *hctx) {
	free(hctx);
}

/* The newest modified time of included files for include statement */
static volatile time_t include_file_last_mtime = 0;

INIT_FUNC(mod_ssi_init) {
	plugin_data *p;

	p = calloc(1, sizeof(*p));
	force_assert(p);

	p->timefmt = buffer_init();
	p->stat_fn = buffer_init();

	p->ssi_vars = array_init(8);
	p->ssi_cgi_env = array_init(32);

	return p;
}

FREE_FUNC(mod_ssi_free) {
	plugin_data *p = p_d;
	array_free(p->ssi_vars);
	array_free(p->ssi_cgi_env);
	buffer_free(p->timefmt);
	buffer_free(p->stat_fn);
}

static void mod_ssi_merge_config_cpv(plugin_config * const pconf, const config_plugin_value_t * const cpv) {
    switch (cpv->k_id) { /* index into static config_plugin_keys_t cpk[] */
      case 0: /* ssi.extension */
        pconf->ssi_extension = cpv->v.a;
        break;
      case 1: /* ssi.content-type */
        pconf->content_type = cpv->v.b;
        break;
      case 2: /* ssi.conditional-requests */
        pconf->conditional_requests = cpv->v.u;
        break;
      case 3: /* ssi.exec */
        pconf->ssi_exec = cpv->v.u;
        break;
      case 4: /* ssi.recursion-max */
        pconf->ssi_recursion_max = cpv->v.shrt;
        break;
      default:/* should not happen */
        return;
    }
}

static void mod_ssi_merge_config(plugin_config * const pconf, const config_plugin_value_t *cpv) {
    do {
        mod_ssi_merge_config_cpv(pconf, cpv);
    } while ((++cpv)->k_id != -1);
}

static void mod_ssi_patch_config(connection * const con, plugin_data * const p) {
    memcpy(&p->conf, &p->defaults, sizeof(plugin_config));
    for (int i = 1, used = p->nconfig; i < used; ++i) {
        if (config_check_cond(con, (uint32_t)p->cvlist[i].k_id))
            mod_ssi_merge_config(&p->conf, p->cvlist + p->cvlist[i].v.u2[0]);
    }
}

SETDEFAULTS_FUNC(mod_ssi_set_defaults) {
    static const config_plugin_keys_t cpk[] = {
      { CONST_STR_LEN("ssi.extension"),
        T_CONFIG_ARRAY,
        T_CONFIG_SCOPE_CONNECTION }
     ,{ CONST_STR_LEN("ssi.content-type"),
        T_CONFIG_STRING,
        T_CONFIG_SCOPE_CONNECTION }
     ,{ CONST_STR_LEN("ssi.conditional-requests"),
        T_CONFIG_BOOL,
        T_CONFIG_SCOPE_CONNECTION }
     ,{ CONST_STR_LEN("ssi.exec"),
        T_CONFIG_BOOL,
        T_CONFIG_SCOPE_CONNECTION }
     ,{ CONST_STR_LEN("ssi.recursion-max"),
        T_CONFIG_SHORT,
        T_CONFIG_SCOPE_CONNECTION }
     ,{ NULL, 0,
        T_CONFIG_UNSET,
        T_CONFIG_SCOPE_UNSET }
    };

    plugin_data * const p = p_d;
    if (!config_plugin_values_init(srv, p, cpk, "mod_ssi"))
        return HANDLER_ERROR;

    /* process and validate config directives
     * (init i to 0 if global context; to 1 to skip empty global context) */
    for (int i = !p->cvlist[0].v.u2[1]; i < p->nconfig; ++i) {
        const config_plugin_value_t *cpv = p->cvlist + p->cvlist[i].v.u2[0];
        for (; -1 != cpv->k_id; ++cpv) {
            switch (cpv->k_id) {
              case 0: /* ssi.extension */
                if (!array_is_vlist(cpv->v.a)) {
                    log_error(srv->errh, __FILE__, __LINE__,
                      "unexpected value for %s; "
                      "expected list of \"ext\"", cpk[cpv->k_id].k);
                    return HANDLER_ERROR;
                }
                break;
              case 1: /* ssi.content-type */
              case 2: /* ssi.conditional-requests */
              case 3: /* ssi.exec */
              case 4: /* ssi.recursion-max */
                break;
              default:/* should not happen */
                break;
            }
        }
    }

    p->defaults.ssi_exec = 1;

    /* initialize p->defaults from global config context */
    if (p->nconfig > 0 && p->cvlist->v.u2[1]) {
        const config_plugin_value_t *cpv = p->cvlist + p->cvlist->v.u2[0];
        if (-1 != cpv->k_id)
            mod_ssi_merge_config(&p->defaults, cpv);
    }

    return HANDLER_GO_ON;
}


static int ssi_env_add(void *venv, const char *key, size_t klen, const char *val, size_t vlen) {
	array_set_key_value((array *)venv, key, klen, val, vlen);
	return 0;
}

static int build_ssi_cgi_vars(connection *con, handler_ctx *p) {
	http_cgi_opts opts = { 0, 0, NULL, NULL };
	/* temporarily remove Authorization from request headers
	 * so that Authorization does not end up in SSI environment */
	buffer *vb_auth = http_header_request_get(con, HTTP_HEADER_AUTHORIZATION, CONST_STR_LEN("Authorization"));
	buffer b_auth;
	if (vb_auth) {
		memcpy(&b_auth, vb_auth, sizeof(buffer));
		memset(vb_auth, 0, sizeof(buffer));
	}

	array_reset_data_strings(p->ssi_cgi_env);

	if (0 != http_cgi_headers(con, &opts, ssi_env_add, p->ssi_cgi_env)) {
		con->http_status = 400;
		return -1;
	}

	if (vb_auth) {
		memcpy(vb_auth, &b_auth, sizeof(buffer));
	}

	return 0;
}

static int mod_ssi_process_file(connection *con, handler_ctx *p, struct stat *st);

static int process_ssi_stmt(connection *con, handler_ctx *p, const char **l, size_t n, struct stat *st) {

	/**
	 * <!--#element attribute=value attribute=value ... -->
	 *
	 * config       DONE
	 *   errmsg     -- missing
	 *   sizefmt    DONE
	 *   timefmt    DONE
	 * echo         DONE
	 *   var        DONE
	 *   encoding   -- missing
	 * exec         DONE
	 *   cgi        -- never
	 *   cmd        DONE
	 * fsize        DONE
	 *   file       DONE
	 *   virtual    DONE
	 * flastmod     DONE
	 *   file       DONE
	 *   virtual    DONE
	 * include      DONE
	 *   file       DONE
	 *   virtual    DONE
	 * printenv     DONE
	 * set          DONE
	 *   var        DONE
	 *   value      DONE
	 *
	 * if           DONE
	 * elif         DONE
	 * else         DONE
	 * endif        DONE
	 *
	 *
	 * expressions
	 * AND, OR      DONE
	 * comp         DONE
	 * ${...}       -- missing
	 * $...         DONE
	 * '...'        DONE
	 * ( ... )      DONE
	 *
	 *
	 *
	 * ** all DONE **
	 * DATE_GMT
	 *   The current date in Greenwich Mean Time.
	 * DATE_LOCAL
	 *   The current date in the local time zone.
	 * DOCUMENT_NAME
	 *   The filename (excluding directories) of the document requested by the user.
	 * DOCUMENT_URI
	 *   The (%-decoded) URL path of the document requested by the user. Note that in the case of nested include files, this is not then URL for the current document.
	 * LAST_MODIFIED
	 *   The last modification date of the document requested by the user.
	 * USER_NAME
	 *   Contains the owner of the file which included it.
	 *
	 */

	size_t i, ssicmd = 0;
	char buf[255];
	buffer *tb = NULL;

	static const struct {
		const char *var;
		enum { SSI_UNSET, SSI_ECHO, SSI_FSIZE, SSI_INCLUDE, SSI_FLASTMOD,
				SSI_CONFIG, SSI_PRINTENV, SSI_SET, SSI_IF, SSI_ELIF,
				SSI_ELSE, SSI_ENDIF, SSI_EXEC, SSI_COMMENT } type;
	} ssicmds[] = {
		{ "echo",     SSI_ECHO },
		{ "include",  SSI_INCLUDE },
		{ "flastmod", SSI_FLASTMOD },
		{ "fsize",    SSI_FSIZE },
		{ "config",   SSI_CONFIG },
		{ "printenv", SSI_PRINTENV },
		{ "set",      SSI_SET },
		{ "if",       SSI_IF },
		{ "elif",     SSI_ELIF },
		{ "endif",    SSI_ENDIF },
		{ "else",     SSI_ELSE },
		{ "exec",     SSI_EXEC },
		{ "comment",  SSI_COMMENT },

		{ NULL, SSI_UNSET }
	};

	for (i = 0; ssicmds[i].var; i++) {
		if (0 == strcmp(l[1], ssicmds[i].var)) {
			ssicmd = ssicmds[i].type;
			break;
		}
	}

	switch(ssicmd) {
	case SSI_ECHO: {
		/* echo */
		int var = 0;
		/* int enc = 0; */
		const char *var_val = NULL;

		static const struct {
			const char *var;
			enum {
				SSI_ECHO_UNSET,
				SSI_ECHO_DATE_GMT,
				SSI_ECHO_DATE_LOCAL,
				SSI_ECHO_DOCUMENT_NAME,
				SSI_ECHO_DOCUMENT_URI,
				SSI_ECHO_LAST_MODIFIED,
				SSI_ECHO_USER_NAME,
				SSI_ECHO_SCRIPT_URI,
				SSI_ECHO_SCRIPT_URL,
			} type;
		} echovars[] = {
			{ "DATE_GMT",      SSI_ECHO_DATE_GMT },
			{ "DATE_LOCAL",    SSI_ECHO_DATE_LOCAL },
			{ "DOCUMENT_NAME", SSI_ECHO_DOCUMENT_NAME },
			{ "DOCUMENT_URI",  SSI_ECHO_DOCUMENT_URI },
			{ "LAST_MODIFIED", SSI_ECHO_LAST_MODIFIED },
			{ "USER_NAME",     SSI_ECHO_USER_NAME },
			{ "SCRIPT_URI",    SSI_ECHO_SCRIPT_URI },
			{ "SCRIPT_URL",    SSI_ECHO_SCRIPT_URL },

			{ NULL, SSI_ECHO_UNSET }
		};

/*
		static const struct {
			const char *var;
			enum { SSI_ENC_UNSET, SSI_ENC_URL, SSI_ENC_NONE, SSI_ENC_ENTITY } type;
		} encvars[] = {
			{ "url",          SSI_ENC_URL },
			{ "none",         SSI_ENC_NONE },
			{ "entity",       SSI_ENC_ENTITY },

			{ NULL, SSI_ENC_UNSET }
		};
*/

		for (i = 2; i < n; i += 2) {
			if (0 == strcmp(l[i], "var")) {
				int j;

				var_val = l[i+1];

				for (j = 0; echovars[j].var; j++) {
					if (0 == strcmp(l[i+1], echovars[j].var)) {
						var = echovars[j].type;
						break;
					}
				}
			} else if (0 == strcmp(l[i], "encoding")) {
/*
				int j;

				for (j = 0; encvars[j].var; j++) {
					if (0 == strcmp(l[i+1], encvars[j].var)) {
						enc = encvars[j].type;
						break;
					}
				}
*/
			} else {
				log_error(con->conf.errh, __FILE__, __LINE__,
				  "ssi: unknown attribute for %s %s", l[1], l[i]);
			}
		}

		if (p->if_is_false) break;

		if (!var_val) {
			log_error(con->conf.errh, __FILE__, __LINE__,
			  "ssi: %s var is missing", l[1]);
			break;
		}

		switch(var) {
		case SSI_ECHO_USER_NAME: {
			tb = con->srv->tmp_buf;
#ifdef HAVE_PWD_H
			struct passwd *pw;
			if (NULL == (pw = getpwuid(st->st_uid))) {
				buffer_copy_int(tb, st->st_uid);
			} else {
				buffer_copy_string(tb, pw->pw_name);
			}
#else
			buffer_copy_int(tb, st->st_uid);
#endif
			chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(tb));
			break;
		}
		case SSI_ECHO_LAST_MODIFIED: {
			time_t t = st->st_mtime;

			if (0 == strftime(buf, sizeof(buf), p->timefmt->ptr, localtime(&t))) {
				chunkqueue_append_mem(con->write_queue, CONST_STR_LEN("(none)"));
			} else {
				chunkqueue_append_mem(con->write_queue, buf, strlen(buf));
			}
			break;
		}
		case SSI_ECHO_DATE_LOCAL: {
			time_t t = time(NULL);

			if (0 == strftime(buf, sizeof(buf), p->timefmt->ptr, localtime(&t))) {
				chunkqueue_append_mem(con->write_queue, CONST_STR_LEN("(none)"));
			} else {
				chunkqueue_append_mem(con->write_queue, buf, strlen(buf));
			}
			break;
		}
		case SSI_ECHO_DATE_GMT: {
			time_t t = time(NULL);

			if (0 == strftime(buf, sizeof(buf), p->timefmt->ptr, gmtime(&t))) {
				chunkqueue_append_mem(con->write_queue, CONST_STR_LEN("(none)"));
			} else {
				chunkqueue_append_mem(con->write_queue, buf, strlen(buf));
			}
			break;
		}
		case SSI_ECHO_DOCUMENT_NAME: {
			char *sl;

			if (NULL == (sl = strrchr(con->physical.path->ptr, '/'))) {
				chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(con->physical.path));
			} else {
				chunkqueue_append_mem(con->write_queue, sl + 1, strlen(sl + 1));
			}
			break;
		}
		case SSI_ECHO_DOCUMENT_URI: {
			chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(con->uri.path));
			break;
		}
		case SSI_ECHO_SCRIPT_URI: {
			if (!buffer_string_is_empty(con->uri.scheme) && !buffer_string_is_empty(con->uri.authority)) {
				chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(con->uri.scheme));
				chunkqueue_append_mem(con->write_queue, CONST_STR_LEN("://"));
				chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(con->uri.authority));
				chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(con->request.uri));
				if (!buffer_string_is_empty(con->uri.query)) {
					chunkqueue_append_mem(con->write_queue, CONST_STR_LEN("?"));
					chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(con->uri.query));
				}
			}
			break;
		}
		case SSI_ECHO_SCRIPT_URL: {
			chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(con->request.uri));
			if (!buffer_string_is_empty(con->uri.query)) {
				chunkqueue_append_mem(con->write_queue, CONST_STR_LEN("?"));
				chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(con->uri.query));
			}
			break;
		}
		default: {
			const data_string *ds;
			/* check if it is a cgi-var or a ssi-var */

			if (NULL != (ds = (const data_string *)array_get_element_klen(p->ssi_cgi_env, var_val, strlen(var_val))) ||
			    NULL != (ds = (const data_string *)array_get_element_klen(p->ssi_vars, var_val, strlen(var_val)))) {
				chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(&ds->value));
			} else {
				chunkqueue_append_mem(con->write_queue, CONST_STR_LEN("(none)"));
			}

			break;
		}
		}
		break;
	}
	case SSI_INCLUDE:
	case SSI_FLASTMOD:
	case SSI_FSIZE: {
		const char * file_path = NULL, *virt_path = NULL;
		struct stat stb;
		char *sl;

		for (i = 2; i < n; i += 2) {
			if (0 == strcmp(l[i], "file")) {
				file_path = l[i+1];
			} else if (0 == strcmp(l[i], "virtual")) {
				virt_path = l[i+1];
			} else {
				log_error(con->conf.errh, __FILE__, __LINE__,
				  "ssi: unknown attribute for %s %s", l[1], l[i]);
			}
		}

		if (!file_path && !virt_path) {
			log_error(con->conf.errh, __FILE__, __LINE__,
			  "ssi: %s file or virtual is missing", l[1]);
			break;
		}

		if (file_path && virt_path) {
			log_error(con->conf.errh, __FILE__, __LINE__,
			  "ssi: %s only one of file and virtual is allowed here", l[1]);
			break;
		}


		if (p->if_is_false) break;

		tb = con->srv->tmp_buf;

		if (file_path) {
			/* current doc-root */
			if (NULL == (sl = strrchr(con->physical.path->ptr, '/'))) {
				buffer_copy_string_len(p->stat_fn, CONST_STR_LEN("/"));
			} else {
				buffer_copy_string_len(p->stat_fn, con->physical.path->ptr, sl - con->physical.path->ptr + 1);
			}

			buffer_copy_string(tb, file_path);
			buffer_urldecode_path(tb);
			if (!buffer_is_valid_UTF8(tb)) {
				log_error(con->conf.errh, __FILE__, __LINE__,
				  "SSI invalid UTF-8 after url-decode: %s", tb->ptr);
				break;
			}
			buffer_path_simplify(tb, tb);
			buffer_append_string_buffer(p->stat_fn, tb);
		} else {
			/* virtual */
			size_t remain;

			if (virt_path[0] == '/') {
				buffer_copy_string(tb, virt_path);
			} else {
				/* there is always a / */
				sl = strrchr(con->uri.path->ptr, '/');

				buffer_copy_string_len(tb, con->uri.path->ptr, sl - con->uri.path->ptr + 1);
				buffer_append_string(tb, virt_path);
			}

			buffer_urldecode_path(tb);
			if (!buffer_is_valid_UTF8(tb)) {
				log_error(con->conf.errh, __FILE__, __LINE__,
				  "SSI invalid UTF-8 after url-decode: %s", tb->ptr);
				break;
			}
			buffer_path_simplify(tb, tb);

			/* we have an uri */

			/* Destination physical path (similar to code in mod_webdav.c)
			 * src con->physical.path might have been remapped with mod_alias, mod_userdir.
			 *   (but neither modifies con->physical.rel_path)
			 * Find matching prefix to support relative paths to current physical path.
			 * Aliasing of paths underneath current con->physical.basedir might not work.
			 * Likewise, mod_rewrite URL rewriting might thwart this comparison.
			 * Use mod_redirect instead of mod_alias to remap paths *under* this basedir.
			 * Use mod_redirect instead of mod_rewrite on *any* parts of path to basedir.
			 * (Related, use mod_auth to protect this basedir, but avoid attempting to
			 *  use mod_auth on paths underneath this basedir, as target path is not
			 *  validated with mod_auth)
			 */

			/* find matching URI prefix
			 * check if remaining con->physical.rel_path matches suffix
			 *   of con->physical.basedir so that we can use it to
			 *   remap Destination physical path */
			{
				const char *sep, *sep2;
				sep = con->uri.path->ptr;
				sep2 = tb->ptr;
				for (i = 0; sep[i] && sep[i] == sep2[i]; ++i) ;
				while (i != 0 && sep[--i] != '/') ; /* find matching directory path */
			}
			if (con->conf.force_lowercase_filenames) {
				buffer_to_lower(tb);
			}
			remain = buffer_string_length(con->uri.path) - i;
			if (!con->conf.force_lowercase_filenames
			    ? buffer_is_equal_right_len(con->physical.path, con->physical.rel_path, remain)
			    :(buffer_string_length(con->physical.path) >= remain
			      && buffer_eq_icase_ssn(con->physical.path->ptr+buffer_string_length(con->physical.path)-remain, con->physical.rel_path->ptr+i, remain))) {
				buffer_copy_string_len(p->stat_fn, con->physical.path->ptr, buffer_string_length(con->physical.path)-remain);
				buffer_append_string_len(p->stat_fn, tb->ptr+i, buffer_string_length(tb)-i);
			} else {
				/* unable to perform physical path remap here;
				 * assume doc_root/rel_path and no remapping */
				buffer_copy_buffer(p->stat_fn, con->physical.doc_root);
				buffer_append_string_buffer(p->stat_fn, tb);
			}
		}

		if (!con->conf.follow_symlink
		    && 0 != stat_cache_path_contains_symlink(p->stat_fn, con->conf.errh)) {
			break;
		}

		int fd = stat_cache_open_rdonly_fstat(p->stat_fn, &stb, con->conf.follow_symlink);
		if (fd >= 0) {
			time_t t = stb.st_mtime;

			switch (ssicmd) {
			case SSI_FSIZE:
				if (p->sizefmt) {
					int j = 0;
					const char *abr[] = { " B", " kB", " MB", " GB", " TB", NULL };

					off_t s = stb.st_size;

					for (j = 0; s > 1024 && abr[j+1]; s /= 1024, j++);

					buffer_copy_int(tb, s);
					buffer_append_string(tb, abr[j]);
				} else {
					buffer_copy_int(tb, stb.st_size);
				}
				chunkqueue_append_mem(con->write_queue, CONST_BUF_LEN(tb));
				break;
			case SSI_FLASTMOD:
				if (0 == strftime(buf, sizeof(buf), p->timefmt->ptr, localtime(&t))) {
					chunkqueue_append_mem(con->write_queue, CONST_STR_LEN("(none)"));
				} else {
					chunkqueue_append_mem(con->write_queue, buf, strlen(buf));
				}
				break;
			case SSI_INCLUDE:
				/* Keep the newest mtime of included files */
				if (stb.st_mtime > include_file_last_mtime)
					include_file_last_mtime = stb.st_mtime;

				if (file_path || 0 == p->conf.ssi_recursion_max) {
					/* don't process if #include file="..." is used */
					chunkqueue_append_file_fd(con->write_queue, p->stat_fn, fd, 0, stb.st_size);
					fd = -1;
				} else {
					buffer *upsave, *ppsave, *prpsave;

					/* only allow predefined recursion depth */
					if (p->ssi_recursion_depth >= p->conf.ssi_recursion_max) {
						chunkqueue_append_mem(con->write_queue, CONST_STR_LEN("(error: include directives recurse deeper than pre-defined ssi.recursion-max)"));
						break;
					}

					/* prevents simple infinite loop */
					if (buffer_is_equal(con->physical.path, p->stat_fn)) {
						chunkqueue_append_mem(con->write_queue, CONST_STR_LEN("(error: include directives create an infinite loop)"));
						break;
					}

					/* save and restore con->physical.path, con->physical.rel_path, and con->uri.path around include
					 *
					 * tb contains url-decoded, path-simplified, and lowercased (if con->conf.force_lowercase) uri path of target.
					 * con->uri.path and con->physical.rel_path are set to the same since we only operate on filenames here,
					 * not full re-run of all modules for subrequest */
					upsave = con->uri.path;
					ppsave = con