Commit Graph

50 Commits

Author SHA1 Message Date
Glenn Strauss 81ce160d83 silence warnings from clang ccc-analyzer 2016-10-09 19:19:37 -04:00
Glenn Strauss 5863d05ec1 [security] encode quoting chars in HTML and XML
(affects mod_dirlisting, mod_ssi, mod_status)
2016-07-30 04:11:21 -04:00
Glenn Strauss 375022a1d1 fix buffer.c comments to match encoded_chars_*
fix buffer.c comments to match encoded_chars_* changes made in 3943de28
2016-07-30 04:02:21 -04:00
Glenn Strauss ebf3af8b12 [core] fix buffer_copy_string_hex() assert (fixes #2742)
fix buffer_copy_string_hex() passing incorrect length to li_tohex()

(thx Isibaar)

x-ref:
  "Assert wrongly triggered in buffer_copy_string_hex()"
  https://redmine.lighttpd.net/issues/2742
2016-07-30 02:48:20 -04:00
Glenn Strauss acad2c903a fix some warnings reported by cppcheck
fix some warnings reported by cppcheck and
change mod_skeleton.c to use buffer_string_length()
2016-07-17 16:13:31 -04:00
Glenn Strauss 72b133f595 fix errors detected by Coverity Scan
buffer.c:itostr() undefined behavior taking modulus of negative number

additional minor code changes made to quiet other coverity warnings
(false positives)
2016-06-23 03:57:19 -04:00
Glenn Strauss 47f3dbebe4 use li_[iu]tostrn() instead of li_[iu]tostr()
From: Glenn Strauss <gstrauss@gluelogic.com>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@3136 152afb58-edef-0310-8abb-c4023f1b3aa9
2016-04-01 17:38:26 +00:00
Glenn Strauss e5006d88eb pass buf size to li_tohex()
also change passing of fixed-sized arrays: need to pass pointer to array
as otherwise size does not get enforced

From: Glenn Strauss <gstrauss@gluelogic.com>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@3135 152afb58-edef-0310-8abb-c4023f1b3aa9
2016-04-01 16:54:46 +00:00
Stefan Bühler 0a61fdecac [buffer] refactor buffer_path_simplify (fixes #2560)
There actually was one bug: if the input consisted only of spaces,
it would read one byte too much.

`pre` was splitted into `pre2` and (already existing) `pre1` - the two
characters which were read before the current one in `c`.

Restructuring the loop eliminated some code before the loop, which was
similar to the one at the end of the loop.

From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@3120 152afb58-edef-0310-8abb-c4023f1b3aa9
2016-03-25 16:58:16 +00:00
Glenn Strauss 8abd06a7ff consistent inclusion of config.h at top of files (fixes #2073)
From: Glenn Strauss <gstrauss@gluelogic.com>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@3113 152afb58-edef-0310-8abb-c4023f1b3aa9
2016-03-19 15:14:35 +00:00
Stefan Bühler 2abdf0143b [buffer] use explicit integer promotion to make the code more readable
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@3084 152afb58-edef-0310-8abb-c4023f1b3aa9
2016-02-23 16:28:48 +00:00
Stefan Bühler 3943de280e [core] add '~' to safe characters in ENCODING_REL_URI/ENCODING_REL_URI_PART encoding
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@3051 152afb58-edef-0310-8abb-c4023f1b3aa9
2015-11-07 15:00:15 +00:00
Stefan Bühler 427120b41a escape all strings for logging (fixes #2646 log file injection, reported by Jaanus Kääp)
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2989 152afb58-edef-0310-8abb-c4023f1b3aa9
2015-05-28 15:47:14 +00:00
Stefan Bühler 66ad587f2f [buffer] constify some parameters
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2981 152afb58-edef-0310-8abb-c4023f1b3aa9
2015-02-08 19:10:49 +00:00
Stefan Bühler 91a9a6b391 rename buffer_append_long_hex to buffer_append_uint_hex
* takes uintmax_t now
* use in http_chunk_append_len

From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2980 152afb58-edef-0310-8abb-c4023f1b3aa9
2015-02-08 19:10:46 +00:00
Stefan Bühler ad3e93ea96 Use buffer API to read and modify "used" member
- a lot of code tried to handle manually adding terminating zeroes and
  keeping track of the correct "used" count.
  Replaced all "external" usages with simple wrapper functions:
  * buffer_string_is_empty (used <= 1), buffer_is_empty (used == 0);
    prefer buffer_string_is_empty
  * buffer_string_set_length
  * buffer_string_length
  * CONST_BUF_LEN() macro
- removed "static" buffer hacks (buffers pointing to constant/stack
  memory instead of malloc()ed data)
- buffer_append_strftime(): refactor buffer+strftime uses
- li_tohex(): no need for a buffer for binary-to-hex conversion:
  the output data length is easy to predict
- remove "-Winline" from extra warnings: the "inline" keyword just
  supresses the warning about unused but defined (static) functions;
  don't care whether it actually gets inlined or not.

From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2979 152afb58-edef-0310-8abb-c4023f1b3aa9
2015-02-08 19:10:44 +00:00
Stefan Bühler 4365bdbebe Remove buffer_prepare_copy() and buffer_prepare_append()
* removed almost all usages of buffer as "memory" (without terminating
  zero)
* refactored cgi variable name encoding

From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2977 152afb58-edef-0310-8abb-c4023f1b3aa9
2015-02-08 19:10:39 +00:00
Stefan Bühler 1be163b44a Remove chunkqueue_get_{append,prepend}* API
Although those were "easy" to use, they violated the abstraction:
  content of the chunkqueue should only be modified via the API.
  Replace with chunkqueue_get_memory() and chunkqueue_use_memory() for
  functions that read data from network (reusing large buffers),
  chunkqueue_steal_with_tempfiles() to store request bodies on disk
  temporarily.
  Modules that were generating content and need a buffer maintain the
  buffer manually (have to be careful to free the buffer on errors, as
  it isn't part of the chunkqueue yet).

From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2976 152afb58-edef-0310-8abb-c4023f1b3aa9
2015-02-08 19:10:36 +00:00
Stefan Bühler 6afad87d2e fix buffer, chunk and http_chunk API
* remove unused structs and functions
    (buffer_array, read_buffer)
  * change return type from int to void for many functions,
    as the return value (indicating error/success) was never checked,
    and the function would only fail on programming errors and not on
    invalid input; changed functions to use force_assert instead of
    returning an error.
  * all "len" parameters now are the real size of the memory to be read.
    the length of strings is given always without the terminating 0.
  * the "buffer" struct still counts the terminating 0 in ->used,
    provide buffer_string_length() to get the length of a string in a
    buffer.
    unset config "strings" have used == 0, which is used in some places
    to distinguish unset values from "" (empty string) values.
  * most buffer usages should now use it as string container.
  * optimise some buffer copying by "moving" data to other buffers
  * use (u)intmax_t for generic int-to-string functions
  * remove unused enum values: UNUSED_CHUNK, ENCODING_UNSET
  * converted BUFFER_APPEND_SLASH to inline function (no macro feature
    needed)
  * refactor: create chunkqueue_steal: moving (partial) chunks into another
    queue
  * http_chunk: added separate function to terminate chunked body instead of
    magic handling in http_chunk_append_mem().
    http_chunk_append_* now handle empty chunks, and never terminate the
    chunked body.

From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2975 152afb58-edef-0310-8abb-c4023f1b3aa9
2015-02-08 12:37:10 +00:00
Stefan Bühler 3521be8b85 print backtrace in assert logging with libunwind
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2974 152afb58-edef-0310-8abb-c4023f1b3aa9
2015-02-07 13:32:56 +00:00
Stefan Bühler 07dd0bd0a5 add force_assert() to enforce assertions as simple assert()s are disabled by -DNDEBUG (fixes #2546)
From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2948 152afb58-edef-0310-8abb-c4023f1b3aa9
2014-02-16 13:08:20 +00:00
Stefan Bühler bf10267807 [buffer] fix length check in buffer_is_equal_right_len
buffer_is_equal_right_len didn't check the length of the second
  buffer. as all calls in lighttpd used the length of the second buffer
  as length parameter those calls were not broken.

From: Stefan Bühler <stbuehler@web.de>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2946 152afb58-edef-0310-8abb-c4023f1b3aa9
2014-02-14 21:06:16 +00:00
Stefan Bühler 05858f6cf2 [ssl] Fix $HTTP["scheme"] conditional, could be "http" for ssl connections if the ssl $SERVER["socket"] conditional was nested (fixes #2501)
con->conf.is_ssl got removed and replaced by:
 * con->conf.ssl_enabled for the config var "ssl.engine" - it is only
   used to determine which server-sockets should use ssl. (usually not
   needed as it is mandatory and enough to set ssl.pemfile anyway)
 * con->srv_socket->is_ssl to detect the actual ssl status of the
   bound socket, which is the same as the ssl status of the connection
 * con->uri.scheme for the actual $HTTP["scheme"] value, also used for
   the CGI "HTTPS=ON" variable. This defaults to "https" if the
   connection uses ssl, but can be changed for example by mod_extforward
   if X-Forwarded-Proto: is set to either "http" or "https" (other values
   are ignored right now)

Also removed the broken srv_socket->is_proxy_ssl as it was a connection
value in a server_socket struct...

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2887 152afb58-edef-0310-8abb-c4023f1b3aa9
2013-07-31 20:23:21 +00:00
Stefan Bühler a0e93c678b fix undefined stuff found with clang
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2873 152afb58-edef-0310-8abb-c4023f1b3aa9
2013-05-15 10:31:09 +00:00
Cyril Brulebois f4ba2d4f24 Mark some data as static.
Those identifiers aren't used except in the files they're declared in,
so mark them static.

Signed-off-by: Cyril Brulebois <kibi@debian.org>

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2842 152afb58-edef-0310-8abb-c4023f1b3aa9
2012-08-31 14:11:39 +00:00
Stefan Bühler e697869e34 buffer_caseless_compare: always convert letters to lowercase to get transitive results, fixing array lookups (fixes #2405)
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2828 152afb58-edef-0310-8abb-c4023f1b3aa9
2012-04-08 08:02:44 +00:00
Stefan Bühler 22e8b456a9 Fix header inclusion order, always include "config.h" before any system header
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2624 152afb58-edef-0310-8abb-c4023f1b3aa9
2009-10-11 14:31:42 +00:00
Stefan Bühler 4642508de3 Some small buffer.c fixes (closes #1837)
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2380 152afb58-edef-0310-8abb-c4023f1b3aa9
2009-02-03 20:59:03 +00:00
Stefan Bühler d62f894344 Fix url encoding to encode more characters (#266)
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2272 152afb58-edef-0310-8abb-c4023f1b3aa9
2008-08-01 17:54:04 +00:00
Stefan Bühler f7dd7203e2 Fix buffer_reset to make an empty string
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@2270 152afb58-edef-0310-8abb-c4023f1b3aa9
2008-08-01 11:24:06 +00:00
Jan Kneschke 53634de06f protect buffer_is_empty() from NULL buffers
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@1969 152afb58-edef-0310-8abb-c4023f1b3aa9
2007-08-27 21:49:08 +00:00
Jan Kneschke 51826fc05c renamed ltostr() to LI_ltostr() to fix compile on HP/UX (fixes #465)
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@1951 152afb58-edef-0310-8abb-c4023f1b3aa9
2007-08-18 12:25:52 +00:00
Jan Kneschke 5f518191bd fixed wrong result of buffer_caseless_compare("a", "ab") (fixes #1287)
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@1927 152afb58-edef-0310-8abb-c4023f1b3aa9
2007-08-17 21:47:24 +00:00
Jan Kneschke a0436cea45 encode newlines in HTTP headers (fixes #1106)
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@1723 152afb58-edef-0310-8abb-c4023f1b3aa9
2007-04-09 18:12:43 +00:00
Marcus Rückert 8cd1471cb3 - white space cleanup part 2 this time 1.4 ;)
i hope it helps with merging stuff back to 1.5

git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.x@1371 152afb58-edef-0310-8abb-c4023f1b3aa9
2006-10-04 13:26:23 +00:00
Jan Kneschke 71e66c88ec fix cygwin-only path traversal
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.4.11-ssl-fixes@1275 152afb58-edef-0310-8abb-c4023f1b3aa9
2006-09-01 10:07:09 +00:00
Jan Kneschke a1e6331f04 fixed encoding of UTF8 data (Jani Taskinen <sniper@iki.fi>)
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-merge-1.4.x@942 152afb58-edef-0310-8abb-c4023f1b3aa9
2006-01-12 22:01:26 +00:00
Jan Kneschke 6770984a0c fixed encoding of the buffers and trust the length of the string
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-merge-1.4.x@826 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-11-10 00:31:06 +00:00
Jan Kneschke 976f32182e simplified buffer-encoding functions into one function
- all of them do some kind of string-to-hex conversion
  (html, rel-uri, hex)
- add a rel-uri encoding next to the old rel-uri-part one
- fixes #266


git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-merge-1.4.x@822 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-11-07 13:15:51 +00:00
Jan Kneschke ac7db634f6 detect empty URIs in requests as bad request, status 400
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-merge-1.4.x@773 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-10-02 21:50:51 +00:00
Jan Kneschke c2f868c02a removed optimization as it didn't handled alignement issues
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-merge-1.4.x@638 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-08-29 11:11:35 +00:00
Jan Kneschke 017e014b02 trust s_len in encode-html (merged [406])
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-merge-1.4.x@548 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-08-15 17:17:32 +00:00
Jan Kneschke f8687d3f6b added functions for upper/lowercase a buffer and added 'len' the html-encoding
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-merge-1.4.x@534 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-08-15 09:47:48 +00:00
Jan Kneschke 6e78c2c8df user defined variable, compute on parsing: string+string, int+int, array+array, var+=expression.
"include" sub configuration file. (merged ([308], [309], [306], [305])


git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-merge-1.4.x@520 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-08-08 14:40:47 +00:00
Jan Kneschke 09903fa706 one character was not compared for the string-length was below sizeof(size_t)
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.3.x@437 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-07-11 10:58:27 +00:00
Jan Kneschke 6481f003f2 added a reset function to buffer_array
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.3.x@425 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-07-07 09:18:05 +00:00
Jan Kneschke acfe706d73 Looks like the '+' -> ' ' transformation is only applied in the ?query part and not the rel-path.
git-svn-id: svn://svn.lighttpd.net/lighttpd/branches/lighttpd-1.3.x@366 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-06-04 15:42:31 +00:00
Jan Kneschke bde657648d compile fixes for MIPSpro on IRIX
git-svn-id: svn://svn.lighttpd.net/lighttpd/trunk@68 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-03-01 23:01:12 +00:00
Jan Kneschke 75fae49e37 * If sizeof(long) == sizeof(off_t), buffer_{append,copy}_off_t()
are only macros to buffer_{append,copy}_long()
* ltostr() returns the string length instead of always 0
* Don't check return value of buffer_prepare_append(buffer *b), since
  it only returns -1 if b == NULL, which we do a few lines above anyway.
* Improved buffer_path_simplify(). No "dot_stack" required anymore.
  Operation can also be performed inplace.
* Check errno also against EACCES at pidfile-unlink for not logging
  a "Permission denied".


git-svn-id: svn://svn.lighttpd.net/lighttpd/trunk@54 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-02-28 10:38:16 +00:00
Jan Kneschke bcdc6a3bbc moved everything below trunk/ and added branches/ and tags/
git-svn-id: svn://svn.lighttpd.net/lighttpd/trunk@30 152afb58-edef-0310-8abb-c4023f1b3aa9
2005-02-20 14:27:00 +00:00