summaryrefslogtreecommitdiff
path: root/libexec/httpd/cgi-bozo.c
AgeCommit message (Collapse)Author
2021-04-08bozohttpd: fix argument type for functions from <ctype.h>rillig
Found by the recently added check to lint (message 342). ok mrg@
2021-02-27belated call version 20210211 after previous memory leak fix.mrg
2021-02-11changes in bozohttpd 20210210:mrg
o fix various NULL derefs from malformed headers. mostly from <emily@ingalls.rocks>.
2020-10-15various updates from <henrik@gulbra.net> / freebsd. the list from Henrik:mrg
bozohttpd.8: o Added -d flag to the man page o Moved -E flag in man page to keep alphabetic order o Grammar fix for description of -E flag in man page o Moved a word in the man description for the -f flag o Made -f imply -b as a backwards-compatible shortcut o Updated man description of -n to mention Lua scripts o Moved -z below -Z to keep the uppercase options first bozohttpd.c: o Removed obsolete comment about ~user missing cgi-bin support o Removed "/* ARGSUSED */" lines; was that a macro or a reminder? o Added USE_ARG macro call for sig, which was otherwise not used o Added USE_ARG macro call for msg (only used if debug is enabled) bozohttpd.h: o Fixed typo in the include guard (BOZOHTTOPD_H_ -> BOZOHTTPD_H_) o Renamed have_all to have_core; it didn't mean "all" options content-bozo.c: o Added USE_ARG macro call for signo, which was otherwise not used o Made -f imply -b as a backwards-compatible shortcut main.c: o Simplified -b text to be symmetric with that for the -f option o Updated -C text to make "suffix" explicit; it's better than "arg" o Changed to only show the -E description if have_user is true o Always show the -e option, which incorrectly used the -E logic o Renamed have_all to have_core; it didn't mean "all" options o Added three missing tabs for the description of the -G option o Updated -L text to make "prefix" explicit; it's better than "arg" o Updated -M text to make "suffix" explicit; it's slightly better o Added a previously missing description for the -n option o Documented the otherwise obscure valid types for the -T option o Shortened "username" to "user" to match the actual help text o Moved handling of -c below that for -C to standardize the order o Broke the enabling test for -C into two lines for consistency o Inverted the enabling test for -E; this is what was meant, right? o Removed the enabling test for -e, which should always be enabled ssl-bozo.c: o Added USE_ARG for httpd, which is not used if SSL has been excluded
2020-08-20send close_notify for the ssl connection before closing the TCP connectionspz
Thanks to Dr. Thomas Orgis for reporting the issue.
2019-12-06remove some XXX comments. one isn't relevant, and the other twomrg
have been incorrect for a long while now.
2019-03-29Account for cgihandler being set when counting the number of CGI environmentmartin
headers we are about to set. Avoids an assertion failure (and overruninng the array) later.
2019-01-17- call this 20190116mrg
- adjust the directory indexing again: - don't include "index.html" in html headers - additional escaping of names - re-add top/bottom borders - adds an aquamarine table header - Zebra-stripes table rows using CSS instead of code all from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>
2019-01-17- fix CGI '+' param and error handling.mrg
- remove unused parameter to daemon_poll_err(). both from "Rajeev V. Pillai" <rajeev_v_pillai@yahoo.com>
2018-11-24appease lintchristos
2018-11-23minor style fixes. simplify bozo_match_content_map().mrg
2018-11-22add an assert() check on array bounds.mrg
2018-11-22many clean ups:mrg
- keep a list of special files and their human names - remove (void) casts on bozo_http_error() - fix a few more misuses of bozo_http_error() - rename check_mapping() to check_remap() and perform some CSE - switch away from ``%s'' to '%s' - remove a bunch of #ifdef using new have_feature defines
2018-11-20from CHANGES:mrg
o reduce default timeouts, and add expand timeouts to handle the initial line, each header, and the total time spent o add -T option to expose new timeout settings o minor RFC fixes related to timeout handling responses old timeouts: 60 seconds for initial request like, 60 seconds per header line, and no whole timeout (though the recent total header size changes do introduce one that would be about 11 hours.) new timeouts: 30 seconds for initial request like, 10 seconds per header line, and a total request time of 600 seconds. the new global timeout is implemented using CLOCK_MONOTONIC, with a fallback to CLOCK_REALTIME if monotonic time is unavailable. reject multiple Host: headers. besides being protocol standard, this closes one additional memory leak found by JP. add a simple test to check this. clean up option and usage handling some.
2018-11-18use __func__ in debug().mrg
2017-11-28PR bin/52194: bozohttpd fails to exec scripts via the -C mechanismmartin
sometimes with EFAULT due to not NULL terminated environment.
2017-10-05s/u_int/unsigned/.mrg
from Jan Danielsson. increases/fixes portability.
2017-01-31call this bozohttpd 20170201.mrg
2017-01-31- fix a bug in cgi processing. from Dennis Lindroos.mrg
- add a testcase for this, and expand test-simple to handle additional args to bozohttpd for eg, cgi-bin setting. - fix objdir bugs in the testsuite.
2016-04-24CID 1358679: Fix memory leak.christos
XXX: pullup 7
2016-04-15use %zu instead of %lu for size_t.mrg
2016-04-15updates and bozohttpd 20160415:mrg
o add search-word support for CGI o fix a security issue in CGI suffix handler support which would allow remote code execution, from shm@netbsd.org o -C option supports now CGI scripts only
2015-12-31redo the fix for rev 1.26 - instead of getting a new string wrong,mrg
just delay the free until the parent has finished using them. also, free query as well. fixes PR#50374.
2015-12-29- convert most asprintf() calls to bozoasprintf().mrg
- don't call getpwuid(0) if we don't need to, or fail it it fails, and remove the 'username' member of bozohttpd_t since it is not used outside of bozo_setup().
2015-12-28rename bozo_err/bozo_warn/bozo_asprintf to bozoerr/etc.mrg
new rule is that function that mirror libc-style functions get no underscore.
2015-12-27several clean ups:mrg
- bozostrdup() gains a request parameter, and uses it to determine what sort of error handling is required - bozo_strdup() dies - size_arrays() reduced slightly, pushing error handling into the caller - convert to size_t for some array indices - bozo_set_pref() and bozo_init_prefs() gain httpd parameters - apply a bunch of manual CSE to vastly reduce the number of times the string "request->hr_httpd" appears. - CGI parse_header() takes a request not httpd now XXX: lua glue updated to call bozo_init_prefs() with htttpd parameter, but i'm only guessing here.
2015-10-28* add CGI support for ~user translation (-E switch)shm
* add redirects to ~user translation * fix bugs around ~user translation * add schema detection for absolute redirects * fixed few memory leaks * bunch of minor tweaks * removed -r support * smarter redirects OK mrg@
2015-05-02fix content type handling to not hard code (wrong) values for length,mrg
but just call strlen() as needed. call this 20150501. reported by Jan Danielsson for ".svg".
2015-04-19Fix deref "command" after "free(file)", from KIYOHARA Takashichristos
2014-06-24PR/48810 use cgi handler for index filesshm
OK mrg@ martin@
2014-01-02- update CHANGES with recent changesmrg
- update version to 20140102 - update copyrights - use getcwd() over getwd() - fix lean build (don't include lua)
2013-10-12no need to check free() arguments against NULLmbalmer
2013-07-11copyright maint.mrg
2013-06-27Redo previous (fixing a memory leak introduced), and while there reworkmartin
virtual server support - in daemonized mode mixed virtual and "main" server usage would alter the virtual hostname depending on order of requests. To fix, move the effective virtual hostname into the request structure and leave the httpd server description static.
2011-11-18merge bozohttpd 20111118mrg
2010-12-14When invoking a content handler specified via -C, set the REDIRECT_STATUStls
CGI variable to "200". This approximates the Apache behavior which is required by phpcgi in PHP 5.3 (and by some compilations of older PHP versions). I have a revolutionary idea. Perhaps instead of imposing bizarre requirements on other programs in the name of "security", the PHP developers should make their own code compile with oh, I don't know, maybe -Wuninitialized. That might have an effect on the security of systems using PHP rather than on the "security" of such systems... ...excuse me, got to go now, I think my airquotes just wore out.
2010-09-20merge bozohttpd 20100920mrg
2010-06-17merge bozohttpd 20100617.mrg
2010-05-10merge bozohttpd 20100510.mrg
2010-05-10merge bozohttpd 20100509.mrg
2009-05-23merge bozohttpd 20090522mrg
2009-04-18merge bozohttpd 20090418. remove a couple of minor do-nothing localmrg
changes that don't need to cause conflicts.
2009-04-18merge bozohttpd 20090417mrg
2009-03-11use SIMPLEQ_FOREACH_SAFE(), to avoid a use-after-free.mrg
picked up by coverity.
2009-02-19More CGI handling fixes from Sergey Katsev at Coyote Point.tls
1) Fix an issue where because of the reordering of transform_request and process_cgi, the cgi-script name was being cut off by one character (transform_request for some reason cuts off the leading '/' for the file name as part of its processing). As an 'easy' fix, simply re-add the '/' to the front of the filename, which means that we don't have to mess with the logic that sometimes adds +1 and sometimes doesn't. 2) Work around ridiculous bug in PHP reported by lukem in 2004, but stubbornly never fixed by the PHP maintainers: Change the SCRIPT_NAME and SCRIPT_FILENAME variables to contain the file name only, not the query if one exists. Having the query in SCRIPT_FILENAME causes php-cgi to not work, as per the bug information here: http://bugs.php.net/bug.php?id=28227 3) Fix a memory leak because URL wasn't being freed.
2009-02-04From Sergey Katsev at Coyote Point: fix bugs in request transformation andtls
CGI handling, including bin/40355 . There are two main changes here: 1) call process_cgi() after transform_request(), not before. Now it is possible to have a default cgi handler catch a request for a path that was produced by transformation, e.g. by index generation -- so now the index can be "generated" by a CGI if that is what the user desires. 2) More clearly distinguish "file" from "query" portions of the request URL, so we do not feed ?-suffixed "arguments" to plain files, fail to match filename extensions due to ?-suffixes, etc. After this change, there are only two cases which use the "query" portion of the request (the portion after the ?): a) A redirect issued by HTTPD will redirect to the new file, but with the same query string. b) process_cgi() will, of course continue to use the query string.
2008-11-06pull across the fix from my master bozohttpd cvs tree for PR 38466.mrg
2008-03-03merge bozohttpd 20080303mrg
2007-11-04- remove const from h_header, this pointer is occasionally free'drtr
- remove unused write_str var + move header parsing to new function separation of parsing vs processing + alter some variable names to avoid confusion between header value and header name (caused breakage with previous rev)
2007-11-04+ don't free strdup()'d ptr that was manipulated.rtr
(i.e. free(): warning: modified (chunk-) pointer)) + don't leak memory for ptr actually returned from strdup() + don't strdup() if we don't have to + don't break without free() if we did strdup() + as well as freeing h_value also free the header.