Logo Search packages:      
Sourcecode: nagios2 version File versions  Download package

getcgi.c

/******************************************
 *
 * GETCGI.C -  Nagios CGI Input Routines
 *
 * Last Modified: 05-15-2006
 *
 *****************************************/

#include "../include/config.h"
#include "../include/getcgi.h"
#include <stdio.h>
#include <stdlib.h>


#undef PARANOID_CGI_INPUT


/* Remove potentially harmful characters from CGI input that we don't need or want */
void sanitize_cgi_input(char **cgivars){
      char *strptr;
      int x,y,i;
      int keep;

      /* don't strip for now... */
      return;

      for(strptr=cgivars[i=0];strptr!=NULL;strptr=cgivars[++i]){

            for(x=0,y=0;strptr[x]!='\x0';x++){

                  keep=1;

                  /* remove potentially nasty characters */
                  if(strptr[x]==';' || strptr[x]=='|' || strptr[x]=='&' || strptr[x]=='<' || strptr[x]=='>')
                        keep=0;
#ifdef PARANOID_CGI_INPUT
                  else if(strptr[x]=='/' || strptr[x]=='\\')
                        keep=0;
#endif
                  if(keep==1)
                        strptr[y++]=strptr[x];
                    }

            strptr[y]='\x0';
              }

      return;
        }


/* convert encoded hex string (2 characters representing an 8-bit number) to its ASCII char equivalent */
unsigned char hex_to_char(char *input){
      unsigned char outchar='\x0';
      unsigned int outint;
      char tempbuf[3];

      /* NULL or empty string */
      if(input==NULL)
            return '\x0';
      if(input[0]=='\x0')
            return '\x0';

      tempbuf[0]=input[0];
      tempbuf[1]=input[1];
      tempbuf[2]='\x0';

      sscanf(tempbuf,"%X",&outint);

      /* only convert "normal" ASCII characters - we don't want the rest.  Normally you would 
         convert all characters (i.e. for allowing users to post binary files), but since we
         aren't doing this, stay on the cautious side of things and reject outsiders... */
#ifdef PARANOID_CGI_INPUT
      if(outint<32 || outint>126)
            outint=0;
#endif

      outchar=(unsigned char)outint;

      return outchar;
        }



/* unescape hex characters in CGI input */
void unescape_cgi_input(char *input){
      int x,y;
      int len;

      if(input==NULL)
            return;

      len=strlen(input);
      for(x=0,y=0;x<len;x++,y++){

            if(input[x]=='\x0')
                  break;
            else if(input[x]=='%'){
                  input[y]=hex_to_char(&input[x+1]);
                  x+=2;
                    }
            else
                  input[y]=input[x];
              }
      input[y]='\x0';

      return;
        }



/* read the CGI input and place all name/val pairs into list. returns list containing name1, value1, name2, value2, ... , NULL */
/* this is a hacked version of a routine I found a long time ago somewhere - can't remember where anymore */
char **getcgivars(void){
      register int i;
      char *request_method;
      char *content_type;
      char *content_length_string;
      int content_length;
      char *cgiinput;
      char **cgivars;
      char **pairlist;
      int paircount;
      char *nvpair;
      char *eqpos;

      /* initialize char variable(s) */
      cgiinput="";

      /* depending on the request method, read all CGI input into cgiinput */

      request_method=getenv("REQUEST_METHOD");
      if(request_method==NULL)
            request_method="";

      if(!strcmp(request_method,"GET") || !strcmp(request_method,"HEAD")){

            /* check for NULL query string environment variable - 04/28/00 (Ludo Bosmans) */
            if(getenv("QUERY_STRING")==NULL){
                  cgiinput=(char *)malloc(1);
                  if(cgiinput==NULL){
                        printf("getcgivars(): Could not allocate memory for CGI input.\n");
                        exit(1);
                          }
                  cgiinput[0]='\x0';
                    }
            else
                  cgiinput=strdup(getenv("QUERY_STRING"));
              }

      else if(!strcmp(request_method,"POST") || !strcmp(request_method,"PUT")){

            /* if CONTENT_TYPE variable is not specified, RFC-2068 says we should assume it is "application/octet-string" */
            /* mobile (WAP) stations generate CONTENT_TYPE with charset, we we should only check first 33 chars */

            content_type=getenv("CONTENT_TYPE");
            if(content_type==NULL)
                  content_type="";

            if(strlen(content_type) && strncasecmp(content_type,"application/x-www-form-urlencoded",33)){
                  printf("getcgivars(): Unsupported Content-Type.\n");
                  exit(1);
                    }

            content_length_string=getenv("CONTENT_LENGTH");
            if(content_length_string==NULL)
                  content_length_string="0";

            if(!(content_length=atoi(content_length_string))){
                  printf("getcgivars(): No Content-Length was sent with the POST request.\n") ;
                  exit(1);
                    }

            /* suspicious content length */
            if((content_length<0) || (content_length>=INT_MAX-1)){
                  printf("getcgivars(): Suspicious Content-Length was sent with the POST request.\n");
                  exit(1);
                  }

            if(!(cgiinput=(char *)malloc(content_length+1))){
                  printf("getcgivars(): Could not allocate memory for CGI input.\n");
                  exit(1);
                    }
            if(!fread(cgiinput,content_length,1,stdin)){
                  printf("getcgivars(): Could not read input from STDIN.\n");
                  exit(1);
                    }
            cgiinput[content_length]='\0';
              }
      else{

            printf("getcgivars(): Unsupported REQUEST_METHOD -> '%s'\n",request_method);
            printf("\n");
            printf("I'm guessing you're trying to execute the CGI from a command line.\n");
            printf("In order to do that, you need to set the REQUEST_METHOD environment\n");
            printf("variable to either \"GET\", \"HEAD\", or \"POST\".  When using the\n");
            printf("GET and HEAD methods, arguments can be passed to the CGI\n");
            printf("by setting the \"QUERY_STRING\" environment variable.  If you're\n");
            printf("using the POST method, data is read from standard input.  Also of\n");
            printf("note: if you've enabled authentication in the CGIs, you must set the\n");
            printf("\"REMOTE_USER\" environment variable to be the name of the user you're\n");
            printf("\"authenticated\" as.\n");
            printf("\n");

            exit(1);
              }

      /* change all plus signs back to spaces */
      for(i=0;cgiinput[i];i++){
            if(cgiinput[i]=='+')
                  cgiinput[i]=' ';
              }

      /* first, split on ampersands (&) to extract the name-value pairs into pairlist */
      /* allocate memory for 256 name-value pairs at a time, increasing by same
         amount as necessary... */
      pairlist=(char **)malloc(256*sizeof(char **));
      if(pairlist==NULL){
            printf("getcgivars(): Could not allocate memory for name-value pairlist.\n");
            exit(1);
              }
      paircount=0;
      nvpair=strtok(cgiinput,"&");
      while(nvpair){
            pairlist[paircount++]=strdup(nvpair);
            if(!(paircount%256)){
                  pairlist=(char **)realloc(pairlist,(paircount+256)*sizeof(char **));
                  if(pairlist==NULL){
                        printf("getcgivars(): Could not re-allocate memory for name-value pairlist.\n");
                        exit(1);
                          }
                    }
            nvpair=strtok(NULL,"&");
              }

      /* terminate the list */
      pairlist[paircount]='\x0';    

      /* extract the names and values from the pairlist */
      cgivars=(char **)malloc((paircount*2+1)*sizeof(char **));
      if(cgivars==NULL){
            printf("getcgivars(): Could not allocate memory for name-value list.\n");
            exit(1);
              }
      for(i=0;i<paircount;i++){

            /* get the variable name preceding the equal (=) sign */
            if((eqpos=strchr(pairlist[i],'='))!=NULL){
                  *eqpos='\0';
                  unescape_cgi_input(cgivars[i*2+1]=strdup(eqpos+1));
                    } 
            else
                  unescape_cgi_input(cgivars[i*2+1]=strdup(""));

            /* get the variable value (or name/value of there was no real "pair" in the first place) */
            unescape_cgi_input(cgivars[i*2]=strdup(pairlist[i]));
              }

      /* terminate the name-value list */
      cgivars[paircount*2]='\x0';
    
      /* free allocated memory */
      free(cgiinput);
      for(i=0;pairlist[i]!=NULL;i++)
            free(pairlist[i]);
      free(pairlist);

      /* sanitize the name-value strings */
      sanitize_cgi_input(cgivars);

      /* return the list of name-value strings */
      return cgivars;
        }



/* free() memory allocated to storing the CGI variables */
void free_cgivars(char **cgivars){
      register int x;

      for(x=0;cgivars[x]!='\x0';x++)
            free(cgivars[x]);

      return;
        }

Generated by  Doxygen 1.6.0   Back to index