blob: 7f481b7b3cf575973948a9e213caf0018db5aa88 [file] [log] [blame]
Guido van Rossume7e578f1995-08-04 04:00:20 +00001"""CGI-savvy HTTP Server.
2
3This module builds on SimpleHTTPServer by implementing GET and POST
4requests to cgi-bin scripts.
5
Guido van Rossume7d6b0a2000-09-19 04:01:01 +00006If the os.fork() function is not present (e.g. on Windows),
7os.popen2() is used as a fallback, with slightly altered semantics; if
8that function is not present either (e.g. on Macintosh), only Python
9scripts are supported, and they are executed by the current process.
10
11In all cases, the implementation is intentionally naive -- all
12requests are executed sychronously.
13
14SECURITY WARNING: DON'T USE THIS CODE UNLESS YOU ARE INSIDE A FIREWALL
15-- it may execute arbitrary Python code or external programs.
Fred Drake40e84db1999-10-16 02:07:50 +000016
Guido van Rossume7e578f1995-08-04 04:00:20 +000017"""
18
19
Guido van Rossume7d6b0a2000-09-19 04:01:01 +000020__version__ = "0.4"
Guido van Rossume7e578f1995-08-04 04:00:20 +000021
Skip Montanaroe99d5ea2001-01-20 19:54:20 +000022__all__ = ["CGIHTTPRequestHandler"]
Guido van Rossume7e578f1995-08-04 04:00:20 +000023
24import os
Guido van Rossume7d6b0a2000-09-19 04:01:01 +000025import sys
Guido van Rossume7e578f1995-08-04 04:00:20 +000026import urllib
27import BaseHTTPServer
28import SimpleHTTPServer
Steve Holden8a978f72003-01-08 18:53:18 +000029import select
Guido van Rossume7e578f1995-08-04 04:00:20 +000030
31
32class CGIHTTPRequestHandler(SimpleHTTPServer.SimpleHTTPRequestHandler):
33
34 """Complete HTTP server with GET, HEAD and POST commands.
35
36 GET and HEAD also support running CGI scripts.
37
38 The POST command is *only* implemented for CGI scripts.
39
40 """
41
Guido van Rossume7d6b0a2000-09-19 04:01:01 +000042 # Determine platform specifics
43 have_fork = hasattr(os, 'fork')
44 have_popen2 = hasattr(os, 'popen2')
Guido van Rossum8cb65402002-02-01 16:27:59 +000045 have_popen3 = hasattr(os, 'popen3')
Guido van Rossume7d6b0a2000-09-19 04:01:01 +000046
Guido van Rossum6aefd912000-09-01 03:27:34 +000047 # Make rfile unbuffered -- we need to read one line and then pass
48 # the rest to a subprocess, so we can't use buffered input.
49 rbufsize = 0
50
Guido van Rossume7e578f1995-08-04 04:00:20 +000051 def do_POST(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +000052 """Serve a POST request.
Guido van Rossume7e578f1995-08-04 04:00:20 +000053
Guido van Rossum45e2fbc1998-03-26 21:13:24 +000054 This is only implemented for CGI scripts.
Guido van Rossume7e578f1995-08-04 04:00:20 +000055
Guido van Rossum45e2fbc1998-03-26 21:13:24 +000056 """
Guido van Rossume7e578f1995-08-04 04:00:20 +000057
Guido van Rossum45e2fbc1998-03-26 21:13:24 +000058 if self.is_cgi():
59 self.run_cgi()
60 else:
61 self.send_error(501, "Can only POST to CGI scripts")
Guido van Rossume7e578f1995-08-04 04:00:20 +000062
63 def send_head(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +000064 """Version of send_head that support CGI scripts"""
65 if self.is_cgi():
66 return self.run_cgi()
67 else:
68 return SimpleHTTPServer.SimpleHTTPRequestHandler.send_head(self)
Guido van Rossume7e578f1995-08-04 04:00:20 +000069
70 def is_cgi(self):
Guido van Rossume7d6b0a2000-09-19 04:01:01 +000071 """Test whether self.path corresponds to a CGI script.
Guido van Rossume7e578f1995-08-04 04:00:20 +000072
Guido van Rossume7d6b0a2000-09-19 04:01:01 +000073 Return a tuple (dir, rest) if self.path requires running a
Guido van Rossum45e2fbc1998-03-26 21:13:24 +000074 CGI script, None if not. Note that rest begins with a
75 slash if it is not empty.
Guido van Rossume7e578f1995-08-04 04:00:20 +000076
Guido van Rossum45e2fbc1998-03-26 21:13:24 +000077 The default implementation tests whether the path
78 begins with one of the strings in the list
79 self.cgi_directories (and the next character is a '/'
80 or the end of the string).
Guido van Rossume7e578f1995-08-04 04:00:20 +000081
Guido van Rossum45e2fbc1998-03-26 21:13:24 +000082 """
Guido van Rossume7e578f1995-08-04 04:00:20 +000083
Guido van Rossum45e2fbc1998-03-26 21:13:24 +000084 path = self.path
Guido van Rossume7e578f1995-08-04 04:00:20 +000085
Guido van Rossum45e2fbc1998-03-26 21:13:24 +000086 for x in self.cgi_directories:
87 i = len(x)
88 if path[:i] == x and (not path[i:] or path[i] == '/'):
89 self.cgi_info = path[:i], path[i+1:]
Tim Petersbc0e9102002-04-04 22:55:58 +000090 return True
91 return False
Guido van Rossume7e578f1995-08-04 04:00:20 +000092
93 cgi_directories = ['/cgi-bin', '/htbin']
94
Guido van Rossume7d6b0a2000-09-19 04:01:01 +000095 def is_executable(self, path):
96 """Test whether argument path is an executable file."""
97 return executable(path)
98
99 def is_python(self, path):
100 """Test whether argument path is a Python script."""
101 head, tail = os.path.splitext(path)
102 return tail.lower() in (".py", ".pyw")
103
Guido van Rossume7e578f1995-08-04 04:00:20 +0000104 def run_cgi(self):
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000105 """Execute a CGI script."""
106 dir, rest = self.cgi_info
Eric S. Raymond6b71e742001-02-09 08:56:30 +0000107 i = rest.rfind('?')
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000108 if i >= 0:
109 rest, query = rest[:i], rest[i+1:]
110 else:
111 query = ''
Eric S. Raymond6b71e742001-02-09 08:56:30 +0000112 i = rest.find('/')
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000113 if i >= 0:
114 script, rest = rest[:i], rest[i:]
115 else:
116 script, rest = rest, ''
117 scriptname = dir + '/' + script
118 scriptfile = self.translate_path(scriptname)
119 if not os.path.exists(scriptfile):
120 self.send_error(404, "No such CGI script (%s)" % `scriptname`)
121 return
122 if not os.path.isfile(scriptfile):
123 self.send_error(403, "CGI script is not a plain file (%s)" %
124 `scriptname`)
125 return
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000126 ispy = self.is_python(scriptname)
127 if not ispy:
Guido van Rossum8cb65402002-02-01 16:27:59 +0000128 if not (self.have_fork or self.have_popen2 or self.have_popen3):
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000129 self.send_error(403, "CGI script is not a Python script (%s)" %
130 `scriptname`)
131 return
132 if not self.is_executable(scriptfile):
133 self.send_error(403, "CGI script is not executable (%s)" %
134 `scriptname`)
135 return
136
137 # Reference: http://hoohoo.ncsa.uiuc.edu/cgi/env.html
138 # XXX Much of the following could be prepared ahead of time!
139 env = {}
140 env['SERVER_SOFTWARE'] = self.version_string()
141 env['SERVER_NAME'] = self.server.server_name
142 env['GATEWAY_INTERFACE'] = 'CGI/1.1'
143 env['SERVER_PROTOCOL'] = self.protocol_version
144 env['SERVER_PORT'] = str(self.server.server_port)
145 env['REQUEST_METHOD'] = self.command
146 uqrest = urllib.unquote(rest)
147 env['PATH_INFO'] = uqrest
148 env['PATH_TRANSLATED'] = self.translate_path(uqrest)
149 env['SCRIPT_NAME'] = scriptname
150 if query:
151 env['QUERY_STRING'] = query
152 host = self.address_string()
153 if host != self.client_address[0]:
154 env['REMOTE_HOST'] = host
155 env['REMOTE_ADDR'] = self.client_address[0]
156 # XXX AUTH_TYPE
157 # XXX REMOTE_USER
158 # XXX REMOTE_IDENT
159 if self.headers.typeheader is None:
160 env['CONTENT_TYPE'] = self.headers.type
161 else:
162 env['CONTENT_TYPE'] = self.headers.typeheader
163 length = self.headers.getheader('content-length')
164 if length:
165 env['CONTENT_LENGTH'] = length
166 accept = []
167 for line in self.headers.getallmatchingheaders('accept'):
Eric S. Raymond7e642e82001-02-09 12:10:26 +0000168 if line[:1] in "\t\n\r ":
Eric S. Raymond6b71e742001-02-09 08:56:30 +0000169 accept.append(line.strip())
Guido van Rossum01fc65d1998-05-13 20:13:24 +0000170 else:
Eric S. Raymond6b71e742001-02-09 08:56:30 +0000171 accept = accept + line[7:].split(',')
172 env['HTTP_ACCEPT'] = ','.join(accept)
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000173 ua = self.headers.getheader('user-agent')
174 if ua:
175 env['HTTP_USER_AGENT'] = ua
176 co = filter(None, self.headers.getheaders('cookie'))
177 if co:
Eric S. Raymond6b71e742001-02-09 08:56:30 +0000178 env['HTTP_COOKIE'] = ', '.join(co)
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000179 # XXX Other HTTP_* headers
180 if not self.have_fork:
181 # Since we're setting the env in the parent, provide empty
182 # values to override previously set values
183 for k in ('QUERY_STRING', 'REMOTE_HOST', 'CONTENT_LENGTH',
184 'HTTP_USER_AGENT', 'HTTP_COOKIE'):
185 env.setdefault(k, "")
Guido van Rossume3ec2962002-08-20 20:07:10 +0000186 os.environ.update(env)
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000187
188 self.send_response(200, "Script output follows")
189
Eric S. Raymond6b71e742001-02-09 08:56:30 +0000190 decoded_query = query.replace('+', ' ')
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000191
192 if self.have_fork:
193 # Unix -- fork as we should
194 args = [script]
195 if '=' not in decoded_query:
196 args.append(decoded_query)
197 nobody = nobody_uid()
198 self.wfile.flush() # Always flush before forking
199 pid = os.fork()
200 if pid != 0:
201 # Parent
202 pid, sts = os.waitpid(pid, 0)
Steve Holden8a978f72003-01-08 18:53:18 +0000203 # throw away additional data [see bug #427345]
204 while select.select([self.rfile], [], [], 0)[0]:
Raymond Hettingere2f18372003-06-29 05:06:56 +0000205 if not self.rfile.read(1):
206 break
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000207 if sts:
208 self.log_error("CGI script exit status %#x", sts)
209 return
210 # Child
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000211 try:
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000212 try:
213 os.setuid(nobody)
214 except os.error:
215 pass
216 os.dup2(self.rfile.fileno(), 0)
217 os.dup2(self.wfile.fileno(), 1)
Raymond Hettinger92f200b2003-07-14 06:56:32 +0000218 os.execve(scriptfile, args, os.environ)
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000219 except:
220 self.server.handle_error(self.request, self.client_address)
221 os._exit(127)
222
Guido van Rossum8cb65402002-02-01 16:27:59 +0000223 elif self.have_popen2 or self.have_popen3:
224 # Windows -- use popen2 or popen3 to create a subprocess
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000225 import shutil
Guido van Rossum8cb65402002-02-01 16:27:59 +0000226 if self.have_popen3:
227 popenx = os.popen3
228 else:
229 popenx = os.popen2
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000230 cmdline = scriptfile
231 if self.is_python(scriptfile):
232 interp = sys.executable
233 if interp.lower().endswith("w.exe"):
Guido van Rossum0afde132001-10-26 03:38:46 +0000234 # On Windows, use python.exe, not pythonw.exe
235 interp = interp[:-5] + interp[-4:]
Guido van Rossum16fd3382001-08-07 19:55:10 +0000236 cmdline = "%s -u %s" % (interp, cmdline)
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000237 if '=' not in query and '"' not in query:
238 cmdline = '%s "%s"' % (cmdline, query)
Guido van Rossumbcbdc952001-10-17 06:45:56 +0000239 self.log_message("command: %s", cmdline)
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000240 try:
241 nbytes = int(length)
Guido van Rossumb3903152002-10-17 16:21:35 +0000242 except (TypeError, ValueError):
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000243 nbytes = 0
Guido van Rossum8cb65402002-02-01 16:27:59 +0000244 files = popenx(cmdline, 'b')
245 fi = files[0]
246 fo = files[1]
247 if self.have_popen3:
248 fe = files[2]
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000249 if self.command.lower() == "post" and nbytes > 0:
250 data = self.rfile.read(nbytes)
251 fi.write(data)
Steve Holden8a978f72003-01-08 18:53:18 +0000252 # throw away additional data [see bug #427345]
253 while select.select([self.rfile._sock], [], [], 0)[0]:
Raymond Hettingere2f18372003-06-29 05:06:56 +0000254 if not self.rfile._sock.recv(1):
255 break
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000256 fi.close()
257 shutil.copyfileobj(fo, self.wfile)
Guido van Rossum8cb65402002-02-01 16:27:59 +0000258 if self.have_popen3:
259 errors = fe.read()
260 fe.close()
261 if errors:
262 self.log_error('%s', errors)
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000263 sts = fo.close()
264 if sts:
265 self.log_error("CGI script exit status %#x", sts)
266 else:
Guido van Rossumbcbdc952001-10-17 06:45:56 +0000267 self.log_message("CGI script exited OK")
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000268
269 else:
270 # Other O.S. -- execute script in this process
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000271 save_argv = sys.argv
272 save_stdin = sys.stdin
273 save_stdout = sys.stdout
274 save_stderr = sys.stderr
275 try:
276 try:
277 sys.argv = [scriptfile]
278 if '=' not in decoded_query:
279 sys.argv.append(decoded_query)
280 sys.stdout = self.wfile
281 sys.stdin = self.rfile
282 execfile(scriptfile, {"__name__": "__main__"})
283 finally:
284 sys.argv = save_argv
285 sys.stdin = save_stdin
286 sys.stdout = save_stdout
287 sys.stderr = save_stderr
288 except SystemExit, sts:
289 self.log_error("CGI script exit status %s", str(sts))
290 else:
Guido van Rossumbcbdc952001-10-17 06:45:56 +0000291 self.log_message("CGI script exited OK")
Guido van Rossume7e578f1995-08-04 04:00:20 +0000292
293
294nobody = None
295
296def nobody_uid():
297 """Internal routine to get nobody's uid"""
298 global nobody
299 if nobody:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000300 return nobody
Guido van Rossume7d6b0a2000-09-19 04:01:01 +0000301 try:
302 import pwd
303 except ImportError:
304 return -1
Guido van Rossume7e578f1995-08-04 04:00:20 +0000305 try:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000306 nobody = pwd.getpwnam('nobody')[2]
Guido van Rossum630b8111999-04-28 12:21:47 +0000307 except KeyError:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000308 nobody = 1 + max(map(lambda x: x[2], pwd.getpwall()))
Guido van Rossume7e578f1995-08-04 04:00:20 +0000309 return nobody
310
311
312def executable(path):
313 """Test for executable file."""
314 try:
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000315 st = os.stat(path)
Guido van Rossume7e578f1995-08-04 04:00:20 +0000316 except os.error:
Guido van Rossum8ca162f2002-04-07 06:36:23 +0000317 return False
Raymond Hettinger32200ae2002-06-01 19:51:15 +0000318 return st.st_mode & 0111 != 0
Guido van Rossume7e578f1995-08-04 04:00:20 +0000319
320
321def test(HandlerClass = CGIHTTPRequestHandler,
Guido van Rossum45e2fbc1998-03-26 21:13:24 +0000322 ServerClass = BaseHTTPServer.HTTPServer):
Guido van Rossume7e578f1995-08-04 04:00:20 +0000323 SimpleHTTPServer.test(HandlerClass, ServerClass)
324
325
326if __name__ == '__main__':
327 test()