luci/modules/luci-base/ucode/http.uc

// Copyright 2022 Jo-Philipp Wich <jo@mein.io>
// Licensed to the public under the Apache License 2.0.

import {
	urlencode as _urlencode,
	urldecode as _urldecode,
	urlencoded_parser, multipart_parser, header_attribute,
	ENCODE_IF_NEEDED, ENCODE_FULL, DECODE_IF_NEEDED, DECODE_PLUS
} from 'lucihttp';

import {
	error as fserror,
	stdin, stdout, mkstemp
} from 'fs';

// luci.http module scope
export let HTTP_MAX_CONTENT = 1024*100;		// 100 kB maximum content size

// Decode a mime encoded http message body with multipart/form-data
// Content-Type. Stores all extracted data associated with its parameter name
// in the params table within the given message object. Multiple parameter
// values are stored as tables, ordinary ones as strings.
// If an optional file callback function is given then it is fed with the
// file contents chunk by chunk and only the extracted file name is stored
// within the params table. The callback function will be called subsequently
// with three arguments:
//  o Table containing decoded (name, file) and raw (headers) mime header data
//  o String value containing a chunk of the file data
//  o Boolean which indicates whether the current chunk is the last one (eof)
export function mimedecode_message_body(src, msg, file_cb) {
	let len = 0, maxlen = +msg.env.CONTENT_LENGTH;
	let err, header, field, parser;

	parser = multipart_parser(msg.env.CONTENT_TYPE, function(what, buffer, length) {
		if (what == parser.PART_INIT) {
			field = {};
		}
		else if (what == parser.HEADER_NAME) {
			header = lc(buffer);
		}
		else if (what == parser.HEADER_VALUE && header) {
			if (lc(header) == 'content-disposition' &&
			    header_attribute(buffer, null) == 'form-data') {
				field.name = header_attribute(buffer, 'name');
				field.file = header_attribute(buffer, 'filename');
				field[1] = field.file;
			}

			field.headers = field.headers || {};
			field.headers[header] = buffer;
		}
		else if (what == parser.PART_BEGIN) {
			return !field.file;
		}
		else if (what == parser.PART_DATA && field.name && length > 0) {
			if (field.file) {
				if (file_cb) {
					file_cb(field, buffer, false);

					msg.params[field.name] = msg.params[field.name] || field;
				}
				else {
					if (!field.fd)
						field.fd = mkstemp(field.name);

					if (field.fd) {
						field.fd.write(buffer);
						msg.params[field.name] = msg.params[field.name] || field;
					}
				}
			}
			else {
				field.value = buffer;
			}
		}
		else if (what == parser.PART_END && field.name) {
			if (field.file && msg.params[field.name]) {
				if (file_cb)
					file_cb(field, '', true);
				else if (field.fd)
					field.fd.seek(0);
			}
			else {
				let val = msg.params[field.name];

				if (type(val) == 'array')
					push(val, field.value || '');
				else if (val != null)
					msg.params[field.name] = [ val, field.value || '' ];
				else
					msg.params[field.name] = field.value || '';
			}

			field = null;
		}
		else if (what == parser.ERROR) {
			err = buffer;
		}

		return true;
	}, HTTP_MAX_CONTENT);

	while (true) {
		let chunk = src();

		len += length(chunk);

		if (maxlen && len > maxlen + 2)
			die('Message body size exceeds Content-Length');

		if (!parser.parse(chunk))
			die(err);

		if (chunk == null)
			break;
	}
};

// Decode an urlencoded http message body with application/x-www-urlencoded
// Content-Type. Stores all extracted data associated with its parameter name
// in the params table within the given message object. Multiple parameter
// values are stored as tables, ordinary ones as strings.
export function urldecode_message_body(src, msg) {
	let len = 0, maxlen = +msg.env.CONTENT_LENGTH;
	let err, name, value, parser;

	parser = urlencoded_parser(function (what, buffer, length) {
		if (what == parser.TUPLE) {
			name = null;
			value = null;
		}
		else if (what == parser.NAME) {
			name = _urldecode(buffer, DECODE_PLUS);
		}
		else if (what == parser.VALUE && name) {
			let val = msg.params[name];

			if (type(val) == 'array')
				push(val, _urldecode(buffer, DECODE_PLUS) || '');
			else if (val != null)
				msg.params[name] = [ val, _urldecode(buffer, DECODE_PLUS) || '' ];
			else
				msg.params[name] = _urldecode(buffer, DECODE_PLUS) || '';
		}
		else if (what == parser.ERROR) {
			err = buffer;
		}

		return true;
	}, HTTP_MAX_CONTENT);

	while (true) {
		let chunk = src();

		len += length(chunk);

		if (maxlen && len > maxlen + 2)
			die('Message body size exceeds Content-Length');

		if (!parser.parse(chunk))
			die(err);

		if (chunk == null)
			break;
	}
};

// This function will examine the Content-Type within the given message object
// to select the appropriate content decoder.
// Currently the application/x-www-urlencoded and application/form-data
// mime types are supported. If the encountered content encoding can't be
// handled then the whole message body will be stored unaltered as 'content'
// property within the given message object.
export function parse_message_body(src, msg, filecb) {
	if (msg.env.CONTENT_LENGTH || msg.env.REQUEST_METHOD == 'POST') {
		let ctype = header_attribute(msg.env.CONTENT_TYPE, null);

		// Is it multipart/mime ?
		if (ctype == 'multipart/form-data')
			return mimedecode_message_body(src, msg, filecb);

		// Is it application/x-www-form-urlencoded ?
		else if (ctype == 'application/x-www-form-urlencoded')
			return urldecode_message_body(src, msg);

		// Unhandled encoding
		// If a file callback is given then feed it chunk by chunk, else
		// store whole buffer in message.content
		let sink;

		// If we have a file callback then feed it
		if (type(filecb) == 'function') {
			let meta = {
				name: 'raw',
				encoding: msg.env.CONTENT_TYPE
			};

			sink = (chunk) => {
				if (chunk != null)
					return filecb(meta, chunk, false);
				else
					return filecb(meta, null, true);
			};
		}

		// ... else append to .content
		else {
			let chunks = [], len = 0;

			sink = (chunk) => {
				len += length(chunk);

				if (len > HTTP_MAX_CONTENT)
					die('POST data exceeds maximum allowed length');

				if (chunk != null) {
					push(chunks, chunk);
				}
				else {
					msg.content = join('', chunks);
					msg.content_length = len;
				}
			};
		}

		// Pump data...
		while (true) {
			let chunk = src();

			sink(chunk);

			if (chunk == null)
				break;
		}

		return true;
	}

	return false;
};

export function build_querystring(q) {
	let s = [];

	for (let k, v in q) {
		push(s,
			length(s) ? '&' : '?',
			_urlencode(k, ENCODE_IF_NEEDED | ENCODE_FULL) || k,
			'=',
			_urlencode(v, ENCODE_IF_NEEDED | ENCODE_FULL) || v
		);
	}

	return join('', s);
};

export function urlencode(value) {
	if (value == null)
		return null;

	value = '' + value;

	return _urlencode(value, ENCODE_IF_NEEDED | ENCODE_FULL) || value;
};

export function urldecode(value, decode_plus) {
	if (value == null)
		return null;

	value = '' + value;

	return _urldecode(value, DECODE_IF_NEEDED | (decode_plus ? DECODE_PLUS : 0)) || value;
};

// Extract and split urlencoded data pairs, separated bei either "&" or ";"
// from given url or string. Returns a table with urldecoded values.
// Simple parameters are stored as string values associated with the parameter
// name within the table. Parameters with multiple values are stored as array
// containing the corresponding values.
export function urldecode_params(url, tbl) {
	let parser, name, value;
	let params = tbl || {};

	parser = urlencoded_parser(function(what, buffer, length) {
		if (what == parser.TUPLE) {
			name = null;
			value = null;
		}
		else if (what == parser.NAME) {
			name = _urldecode(buffer);
		}
		else if (what == parser.VALUE && name) {
			params[name] = _urldecode(buffer) || '';
		}

		return true;
	});

	if (parser) {
		let m = match(('' + (url || '')), /[^?]*$/);

		parser.parse(m ? m[0] : '');
		parser.parse(null);
	}

	return params;
};

// Encode each key-value-pair in given table to x-www-urlencoded format,
// separated by '&'. Tables are encoded as parameters with multiple values by
// repeating the parameter name with each value.
export function urlencode_params(tbl) {
	let enc = [];

	for (let k, v in tbl) {
		if (type(v) == 'array') {
			for (let v2 in v) {
				if (length(enc))
					push(enc, '&');

				push(enc,
					_urlencode(k),
					'=',
					_urlencode('' + v2));
			}
		}
		else {
			if (length(enc))
				push(enc, '&');

			push(enc,
				_urlencode(k),
				'=',
				_urlencode('' + v));
		}
	}

	return join(enc, '');
};


// Default IO routines suitable for CGI invocation
let avail_len = +getenv('CONTENT_LENGTH');

const default_source = () => {
	let rlen = min(avail_len, 4096);

	if (rlen == 0) {
		stdin.close();

		return null;
	}

	let chunk = stdin.read(rlen);

	if (chunk == null)
		die(`Input read error: ${fserror()}`);

	avail_len -= length(chunk);

	return chunk;
};

const default_sink = (...chunks) => {
	for (let chunk in chunks)
		stdout.write(chunk);

	stdout.flush();
};

const Class = {
	formvalue: function(name, noparse) {
		if (!noparse && !this.parsed_input)
			this._parse_input();

		if (name != null)
			return this.message.params[name];
		else
			return this.message.params;
	},

	formvaluetable: function(prefix) {
		let vals = {};

		prefix = (prefix || '') + '.';

		if (!this.parsed_input)
			this._parse_input();

		for (let k, v in this.message.params)
			if (index(k, prefix) == 0)
				 vals[substr(k, length(prefix))] = '' + v;

		return vals;
	},

	content: function() {
		if (!this.parsed_input)
			this._parse_input();

		return this.message.content;
	},

	getcookie: function(name) {
		return header_attribute(`cookie; ${this.getenv('HTTP_COOKIE') ?? ''}`, name);
	},

	getenv: function(name) {
		if (name != null)
			return this.message.env[name];
		else
			return this.message.env;
	},

	setfilehandler: function(callback) {
		if (type(callback) == 'resource' && type(callback.call) == 'function')
			this.filehandler = (...args) => callback.call(...args);
		else if (type(callback) == 'function')
			this.filehandler = callback;
		else
			die('Invalid callback argument for setfilehandler()');

		if (!this.parsed_input)
			return;

		// If input has already been parsed then uploads are stored as unlinked
		// temporary files pointed to by open file handles in the parameter
		// value table. Loop all params, and invoke the file callback for any
		// param with an open file handle.
		for (let name, value in this.message.params) {
			while (value?.fd) {
				let data = value.fd.read(1024);
				let eof = (length(data) == 0);

				this.filehandler(value, data, eof);

				if (eof) {
					value.fd.close();
					value.fd = null;
				}
			}
		}
	},

	_parse_input: function() {
		parse_message_body(
			this.input,
			this.message,
			this.filehandler
		);

		this.parsed_input = true;
	},

	close: function() {
		this.write_headers();
		this.closed = true;
	},

	header: function(key, value) {
		this.headers ??= {};
		this.headers[lc(key)] = value;
	},

	prepare_content: function(mime) {
		if (!this.headers?.['content-type']) {
			if (mime == 'application/xhtml+xml') {
				if (index(this.getenv('HTTP_ACCEPT'), mime) == -1) {
					mime = 'text/html; charset=UTF-8';
					this.header('Vary', 'Accept');
				}
			}

			this.header('Content-Type', mime);
		}
	},

	status: function(code, message) {
		this.status_code = code ?? 200;
		this.status_message = message ?? 'OK';
	},

	write_headers: function() {
		if (this.eoh)
			return;

		if (!this.status_code)
			this.status();

		if (!this.headers?.['content-type'])
			this.header('Content-Type', 'text/html; charset=UTF-8');

		if (!this.headers?.['cache-control']) {
			this.header('Cache-Control', 'no-cache');
			this.header('Expires', '0');
		}

		if (!this.headers?.['x-frame-options'])
			this.header('X-Frame-Options', 'SAMEORIGIN');

		if (!this.headers?.['x-xss-protection'])
			this.header('X-XSS-Protection', '1; mode=block');

		if (!this.headers?.['x-content-type-options'])
			this.header('X-Content-Type-Options', 'nosniff');

		this.output('Status: ');
		this.output(this.status_code);
		this.output(' ');
		this.output(this.status_message);
		this.output('\r\n');

		for (let k, v in this.headers) {
			this.output(k);
			this.output(': ');
			this.output(v);
			this.output('\r\n');
		}

		this.output('\r\n');

		this.eoh = true;
	},

	// If the content chunk is nil this function will automatically invoke close.
	write: function(content) {
		if (content != null && !this.closed) {
			this.write_headers();
			this.output(content);

			return true;
		}
		else {
			this.close();
		}
	},

	redirect: function(url) {
		this.status(302, 'Found');
		this.header('Location', url ?? '/');
		this.close();
	},

	write_json: function(value) {
		this.write(sprintf('%.J', value));
	},

	urlencode,
	urlencode_params,

	urldecode,
	urldecode_params,

	build_querystring
};

export default function(env, sourcein, sinkout) {
	return proto({
		input: sourcein ?? default_source,
		output: sinkout ?? default_sink,

		// File handler nil by default to let .content() work
		file: null,

		// HTTP-Message table
		message: {
			env,
			headers: {},
			params: urldecode_params(env?.QUERY_STRING ?? '')
		},

		parsed_input: false
	}, Class);
};