Busybox httpd sends output of stderr to the Website

2017-03-21 Thread Dirk Lohse
Hi,

when i run some cgi's with BusyBox internal httpd and there is some code that 
writes to stdout I get the result on the HTTP site - which is desired - because 
I produce HTTP-code within this cgi scripts. The output of stderr instead 
should not destroy my HTML-code and could be redirected to /dev/null.

In BusyBox v1.19.4 all was fine. But on BusyBox version v1.20.2 httpd redirects 
output from stdout + stderr to the HTML-code.

I've written a small test script to check this behavior on both versions:

test.cgi:
#!/bin/sh

echo "Content-Type: text/plain"
echo "Expires: 0"
echo

echo "Hello World!"
echo "You should not see this text in your Browser" >&2

when I call this script on the older version, I only see "Hello World!", on the 
new version instead I see also the last line.

I've many code and libraries where everywhere an error message or warning could 
happen on stdout. So changing all the code is nearly impossible, and some 
warnings like "can't open file..." are necessary for debugging.

My question: How can I tell the httpd to NOT redirect stdout to the website?

Thanks,
Dirk


___
busybox mailing list
busybox@busybox.net
http://lists.busybox.net/mailman/listinfo/busybox


Re: Busybox httpd sends output of stderr to the Website

2017-03-21 Thread Guillermo Rodriguez Garcia
Looking at the source code of httpd.c from busybox 1.20.2 I see this
(send_cgi_and_exit, line 1408)

/* User seeing stderr output can be a security problem.
* If CGI really wants that, it can always do dup itself. */
/* dup2(1, 2); */

So it looks like it should be doing the right thing already (i.e. not
sending the child's stderr to its output)

Where is your busybox 1.20.2 coming from? Perhaps there have been 3rd
party patches applied to it?

Guillermo

2017-03-21 17:37 GMT+01:00 Dirk Lohse :
> Hi,
>
> when i run some cgi's with BusyBox internal httpd and there is some code that 
> writes to stdout I get the result on the HTTP site - which is desired - 
> because I produce HTTP-code within this cgi scripts. The output of stderr 
> instead should not destroy my HTML-code and could be redirected to /dev/null.
>
> In BusyBox v1.19.4 all was fine. But on BusyBox version v1.20.2 httpd 
> redirects output from stdout + stderr to the HTML-code.
>
> I've written a small test script to check this behavior on both versions:
>
> test.cgi:
> #!/bin/sh
>
> echo "Content-Type: text/plain"
> echo "Expires: 0"
> echo
>
> echo "Hello World!"
> echo "You should not see this text in your Browser" >&2
>
> when I call this script on the older version, I only see "Hello World!", on 
> the new version instead I see also the last line.
>
> I've many code and libraries where everywhere an error message or warning 
> could happen on stdout. So changing all the code is nearly impossible, and 
> some warnings like "can't open file..." are necessary for debugging.
>
> My question: How can I tell the httpd to NOT redirect stdout to the website?
>
> Thanks,
> Dirk
>
>
> ___
> busybox mailing list
> busybox@busybox.net
> http://lists.busybox.net/mailman/listinfo/busybox



-- 
Guillermo Rodriguez Garcia
guille.rodrig...@gmail.com
___
busybox mailing list
busybox@busybox.net
http://lists.busybox.net/mailman/listinfo/busybox


Re: Busybox httpd sends output of stderr to the Website

2017-03-21 Thread Bob Dunlop

> My question: How can I tell the httpd to NOT redirect stdout to the website?

Or you could tell your CGI programs not to generate data on stderr.

In your example for instance.

  #!/bin/sh

  # Redirect stderr, not required in production
  exec 2>/dev/null

  echo "Content-Type: text/plain"
  echo "Expires: 0"
  echo

  echo "Hello World!"
  echo "You should not see this text in your Browser" >&2

HTH
-- 
Bob Dunlop
___
busybox mailing list
busybox@busybox.net
http://lists.busybox.net/mailman/listinfo/busybox


Re: [PATCH] add paste implementation

2017-03-21 Thread Maxime Coste
Hello,

Any update on this ?

Here is the latest version of the patch, still waiting on a clear decision 
regarding loop variable definition location.

---
 AUTHORS|   3 +
 coreutils/paste.c  | 162 +
 docs/posix_conformance.txt |   8 +-
 testsuite/paste/paste  |  20 
 testsuite/paste/paste-back-cuted-lines |   9 ++
 testsuite/paste/paste-multi-stdin  |  16 
 testsuite/paste/paste-pairs|  16 
 testsuite/paste/paste-separate |  19 
 8 files changed, 252 insertions(+), 1 deletion(-)
 create mode 100644 coreutils/paste.c
 create mode 100644 testsuite/paste/paste
 create mode 100644 testsuite/paste/paste-back-cuted-lines
 create mode 100644 testsuite/paste/paste-multi-stdin
 create mode 100644 testsuite/paste/paste-pairs
 create mode 100644 testsuite/paste/paste-separate

diff --git a/AUTHORS b/AUTHORS
index fa58697f7..5c9a634c9 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -178,3 +178,6 @@ Mike Frysinger 
 
 Jie Zhang 
 fixed two bugs in msh and hush (exitcode of killed processes)
+
+Maxime Coste 
+paste implementation
diff --git a/coreutils/paste.c b/coreutils/paste.c
new file mode 100644
index 0..734414aea
--- /dev/null
+++ b/coreutils/paste.c
@@ -0,0 +1,162 @@
+/* vi: set sw=4 ts=4: */
+/*
+ * paste.c - implementation of the posix paste command
+ *
+ * Written by Maxime Coste 
+ *
+ * Licensed under GPLv2 or later, see file LICENSE in this source tree.
+ */
+//config:config PASTE
+//config:  bool "paste"
+//config:  default y
+//config:  help
+//config:paste is used to paste lines of different files together
+//config:and write the result to stdout
+
+//applet:IF_PASTE(APPLET_NOEXEC(paste, paste, BB_DIR_USR_BIN, BB_SUID_DROP, 
paste))
+
+//kbuild:lib-$(CONFIG_PASTE) += paste.o
+
+//usage:#define paste_trivial_usage
+//usage:   "[OPTIONS] [FILE]..."
+//usage:#define paste_full_usage "\n\n"
+//usage:   "Paste lines from each input files together using a tabulation 
character\n"
+//usage: "\n   -d LIST use delimiters from LIST instead of tabulations"
+//usage: "\n   -s  paste lines of each input files separately"
+//usage:
+//usage:#define paste_example_usage
+//usage:   "# write out directory in four columns\n"
+//usage:   "$ ls | paste - - - -\n"
+//usage:   "# combine pairs of lines from a file into single lines\n"
+//usage:   "$ paste -s -d '\\t\\n' file\n"
+
+#include "libbb.h"
+
+static char get_next_delimiter(char* delimiters, char** current)
+{
+   char escaped;
+   char res = **current;
+   if (res == '\\') {
+   escaped = *(++(*current));
+   switch (escaped) {
+   case 'n': res = '\n'; break;
+   case 't': res = '\t'; break;
+   case '\\': res = '\\'; break;
+   case '0': res = 0; break;
+   default: bb_error_msg_and_die("invalid escaped 
delimiter %c", escaped);
+   }
+   }
+   if (*(++(*current)) == 0)
+   *current = delimiters;
+   return res;
+}
+
+static void paste_files(FILE** files, int file_count, char* delimiters)
+{
+   char **lines;
+   char *current_delimiter;
+   char delim;
+   int active_files = file_count;
+   int i;
+
+   lines = xmalloc(sizeof(*lines) * file_count);
+
+   while (active_files > 0) {
+   current_delimiter = delimiters;
+   for (i = 0; i < file_count; ++i) {
+   if (files[i] == NULL)
+   continue;
+
+   lines[i] = xmalloc_fgetline(files[i]);
+   if (lines[i] == NULL) {
+   fclose_if_not_stdin(files[i]);
+   files[i] = NULL;
+   --active_files;
+   }
+   }
+
+   if (active_files == 0)
+   break;
+
+   for (i = 0; i < file_count; ++i) {
+   if (lines[i] != NULL) {
+   fputs(lines[i], stdout);
+   free(lines[i]);
+   }
+
+   if (i == file_count-1)
+   fputs("\n", stdout);
+   else if ((delim = get_next_delimiter(delimiters, 
¤t_delimiter)) != 0)
+   fputc(delim, stdout);
+   }
+   }
+
+   free(lines);
+}
+
+static void paste_files_separate(FILE** files, int file_count, char* 
delimiters)
+{
+   char *line, *next_line;
+   char *current_delimiter;
+   int end;
+   int i;
+
+   for (i = 0; i < file_count; ++i) {
+   line = NULL;
+   current_delimiter = delimiters;
+   while ((next_line = xmalloc_fgets(files[i])) != NULL