Merge a5fcd38896 into d7c297ae5f

Fix part of issue #106 (option -d)

INSTALL.md

@@ -22,7 +22,7 @@ Important configure arguments include:
 
 - `--listener`. This is the only required argument. You must
   choose a listener that passes network requests to
-  gophernicus, as gophernicus dosen't do this by itself. The
+  gophernicus, as gophernicus doesn't do this by itself. The
   options are:
   - systemd, a common init system on many Linux distributions
     that can do this without an external program.
@@ -32,7 +32,7 @@ Important configure arguments include:
     config files.
   - mac, to be used on Mac OSX machines.
   - haiku, to be used on Haiku machines.
-  - autodetect, which looks at what you have avaliable
+  - autodetect, which looks at what you have available
     (unrecommended, please manually specify where possible).
 - `--hostname`. This is by default attempted to be autodetected
   by the configure script, using the command `hostname`. It is
@@ -123,5 +123,5 @@ distribution? Thanks! Please see issue #50 to help. Some tips:
 - You probably want to support as many listeners as possible.
   We allow this through the use of a comma seperated list to
   `--listener`.
-- The default gopher root is `/var/gopher`; many disributions
+- The default gopher root is `/var/gopher`; many distributions
   prefer `/srv`.

Makefile.in

@@ -142,7 +142,7 @@ install-man:
 
 install-root:
 	$(INSTALL) -d -m 755 $(DESTDIR)$(ROOT)
-	$(INSTALL) -m 644 $(MAP).sample $(DESTDIR)$(ROOT)/gophermap
+	[ ! -f $(DESTDIR)$(ROOT)/gophermap ] && $(INSTALL) -m 644 $(MAP).sample $(DESTDIR)$(ROOT)/gophermap
 
 install-inetd-update: install-root
 	update-inetd --add "$$(sed -e "s:@BINARY_PATH@:$(SBINDIR)/$(BINARY):g" -e "s/@OPTIONS@/$(INETOPT)/g" init/inetlin.in)"

README.md

@@ -178,7 +178,7 @@ directories and you're (kind of) up and running.
 
 There is a serious issue with virtual hosting.
 
-As stated previously, RFC1436 dosen't support virtual hosting. Clients won't
+As stated previously, RFC1436 doesn't support virtual hosting. Clients won't
 like it.
 
 How the virtual hosting works, is that it loops through the vhosts looking for

configure

@@ -16,7 +16,7 @@ usage() {
     printf "  --haikusrv=/boot/common/settings/network/services Path to services directory in Haiku\\n"
     printf "  --systemd=/lib/systemd/system			Path to systemd directory when using systemd listener\\n"
     printf "  --os=autodetected        Your target OS, one of linux, mac, haiku, netbsd, openbsd or freebsd\\n"
-    printf "  --listener=somelistener   Program to recieve and pass network requests; one or more of systemd, inetd, xinetd, comma-seperated, or autodetect, mac or haiku (parameter required, mac/haiku required on respective OSes)\\n"
+    printf "  --listener=somelistener   Program to receive and pass network requests; one or more of systemd, inetd, xinetd, comma-seperated, or autodetect, mac or haiku (parameter required, mac/haiku required on respective OSes)\\n"
     printf "  --hostname=autodetected  Desired hostname for gophernicus to identify as\\n"
 }
 
@@ -113,9 +113,9 @@ else
     # Check it has required features (*cough* macos)
     mkdir testconf
     touch testfile
-    ${INSTALL} -t testconf testfile 2>&1 >/dev/null || INSTALL=build-aux/install-sh
+    ${INSTALL} -t testconf testfile >/dev/null 2>&1 || INSTALL=build-aux/install-sh
     rm testconf/testfile
-    ${INSTALL} -T testfile testconf/testfile 2>&1 >/dev/null || INSTALL=build-aux/install-sh
+    ${INSTALL} -T testfile testconf/testfile >/dev/null 2>&1 || INSTALL=build-aux/install-sh
     rm -r testconf testfile
     printf "%s" "${INSTALL}"
 fi
@@ -236,7 +236,7 @@ if [ "${HOSTNAME}" = "autodetect" ]; then
 fi
 printf "%s\\n" "${HOSTNAME}"
 
-# Use libwrap when it is avaliable
+# Use libwrap when it is available
 printf "checking for libwrap... "
 cat > conftest.c <<EOF
 #include <tcpd.h>
@@ -251,7 +251,7 @@ else
 fi
 printf "\\n"
 
-# Check and use SHM if avaliable
+# Check and use SHM if available
 printf "checking for ipcrm (SHM management)... "
 if ! IPCRM="$(command -v ipcrm)"; then
     printf "not found"

gophernicus.8

@@ -196,9 +196,7 @@ Disable execution of gophermaps and scripts.
 Disable HTTP response to HTTP GET and POST requests.
 .It Fl d
 Print debug output in
-.Xr syslog 3
+.Xr syslog 3 .
-and
-.Pa /server-status .
 When
 .Fl ns
 (disable

src/file.c

@@ -107,10 +107,13 @@ void send_text_file(state *st)
  */
 void url_redirect(state *st)
 {
-	char dest[BUFSIZE];
+	char unsafe[BUFSIZE];
 
 	/* Basic security checking */
-	sstrlcpy(dest, st->req_selector + 4);
+	sstrlcpy(unsafe, st->req_selector + 4);
+
+	char dest[BUFSIZE];
+	html_encode(unsafe, dest, BUFSIZE);
 
 	if (sstrncmp(dest, "http://") != MATCH &&
 		sstrncmp(dest, "https://") != MATCH &&
@@ -374,7 +377,7 @@ static void run_cgi(state *st, char *script, char *arg)
 	}
 
 	/* Didn't work - die */
-	die(st, ERR_ACCESS, NULL);
+	die(st, ERR_ACCESS, "");
 }
 
 

src/gophernicus.c

@@ -107,6 +107,27 @@ void footer(state *st)
 	}
 }
 
+void html_encode(const char *unsafe, char *dest, int bufsize)
+{
+	char literals[] = "!#$&'()*+,/:;=?@[]-_.~";
+	int i = 0, j = 0;
+	while (unsafe[i] != '\0') {
+		if (j >= bufsize - 5) {
+			break;
+		}
+		if (strchr(literals, unsafe[i]) ||
+			(unsafe[i] >= 'a' && unsafe[i] <= 'z') ||
+			(unsafe[i] >= 'A' && unsafe[i] <= 'Z') ||
+			(unsafe[i] >= '0' && unsafe[i] <= '9')) {
+			dest[j] = unsafe[i];
+			i += 1;
+			j += 1;
+		} else {
+			j += snprintf(&dest[j], BUFSIZE - j, "%%%02x", unsafe[i]);
+			i += 1;
+		}
+	}
+}
 
 /*
  * Print error message & exit
@@ -134,13 +155,17 @@ void die(state *st, const char *message, const char *description)
 
 	/* Handle HTML errors */
 	else if (st->req_filetype == TYPE_HTML) {
+		char safe_message[BUFSIZE];
+		html_encode(message, safe_message, BUFSIZE);
+		char safe_description[BUFSIZE];
+		html_encode(description, safe_description, BUFSIZE);
 		printf("<!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 3.2 Final//EN\">\n"
 			"<HTML>\n<HEAD>\n"
 			"  <META HTTP-EQUIV=\"Content-Type\" CONTENT=\"text/html;charset=iso-8859-1\">\n"
 			"  <TITLE>" ERROR_PREFIX "%1$s %2$s</TITLE>\n"
 			"</HEAD>\n<BODY>\n"
 			"<STRONG>" ERROR_PREFIX "%1$s %2$s</STRONG>\n"
-			"<PRE>", message, description);
+			"<PRE>", safe_message, safe_description);
 		footer(st);
 		printf("</PRE>\n</BODY>\n</HTML>\n");
 	}

src/gophernicus.h

@@ -446,6 +446,7 @@ void info(state *st, char *str, char type);
 void footer(state *st);
 void die(state *st, const char *message, const char *description);
 void log_combined(state *st, int status);
+void html_encode(const char *unsafe, char *dest, int bufsize);
 
 /* file.c */
 void send_binary_file(state *st);

src/log.c

@@ -27,9 +27,7 @@ void log_init(int enable, int debug)
 
 	_enable = enable;
 
-	openlog(PROGNAME,
+	openlog(PROGNAME, LOG_PID, LOG_DAEMON);
-	        LOG_PID | (debug ? LOG_PERROR : 0),
-	        LOG_DAEMON);
 
 	setlogmask(_LOG_UPTO(debug ? LOG_DEBUG : LOG_INFO));
 }