simplefiles

multipart.c (18279B)

---

 #include <ctype.h>
 #include <errno.h>
 #include <stdio.h>
 #include <stdlib.h>
 #include <string.h>
 #include <strings.h>
 #include <sys/stat.h>
 #include <unistd.h>
 
 #include "config.h"
 #include "multipart.h"
 
 #define BOUNDARY_MAX 128
 #define MULTIPART_BOUNDARY_MAX 70
 #define MIME_TYPE "multipart/form-data"
 
 static int
 parse_content_disposition(char *value, char *filename, size_t size)
 {
 	char *p;
 	char *start;
 	char *end;
 	size_t len;
 	int seen_filename;
 	int seen_name;
 
 	if (value == NULL || filename == NULL || size == 0)
 		return MULTIPART_ERROR;
 
 	p = value;
 	seen_filename = 0;
 	seen_name = 0;
 
 	while (*p == ' ' || *p == '\t')
 		p++;
 
 	if (strncasecmp(p, "form-data", 9) != 0)
 		return MULTIPART_MALFORMED;
 
 	p += 9;
 
 	if (*p != ';' && *p != '\0')
 		return MULTIPART_MALFORMED;
 
 	while (*p != '\0') {
 		/*
 		 * Parameter separator.
 		 */
 		if (*p != ';')
 			return MULTIPART_MALFORMED;
 
 		p++;
 
 		while (*p == ' ' || *p == '\t')
 			p++;
 
 		/*
 		 * Parameter name.
 		 */
 		start = p;
 
 		while (*p != '\0' &&
 		    *p != '=' &&
 		    *p != ';' &&
 		    *p != ' ' &&
 		    *p != '\t')
 			p++;
 
 		if (p == start)
 			return MULTIPART_MALFORMED;
 
 		end = p;
 
 		while (*p == ' ' || *p == '\t')
 			p++;
 
 		if (*p != '=')
 			return MULTIPART_MALFORMED;
 
 		p++;
 
 		while (*p == ' ' || *p == '\t')
 			p++;
 
 		if ((size_t) (end - start) == 4 &&
 		    strncasecmp(start, "name", 4) == 0) {
 			if (seen_name)
 				return MULTIPART_MALFORMED;
 
 			seen_name = 1;
 
 			if (*p != '"')
 				return MULTIPART_MALFORMED;
 
 			p++;
 			start = p;
 
 			while (*p != '\0' && *p != '"')
 				p++;
 
 			if (*p != '"' || p == start)
 				return MULTIPART_MALFORMED;
 
 			len = (size_t) (p - start);
 
 			if (len != 4 || strncasecmp(start, "file", 4) != 0)
 				return MULTIPART_MALFORMED;
 
 			p++;
 
 			while (*p == ' ' || *p == '\t')
 				p++;
 
 			if (*p != '\0' && *p != ';')
 				return MULTIPART_MALFORMED;
 
 		} else if ((size_t) (end - start) == 8 &&
 		    strncasecmp(start, "filename", 8) == 0) {
 			if (seen_filename)
 				return MULTIPART_MALFORMED;
 
 			seen_filename = 1;
 
 			if (*p != '"')
 				return MULTIPART_MALFORMED;
 
 			p++;
 			start = p;
 
 			while (*p != '\0' && *p != '"')
 				p++;
 
 			if (*p != '"' || p == start)
 				return MULTIPART_MALFORMED;
 
 			len = (size_t) (p - start);
 
 			if (len >= size)
 				return MULTIPART_MALFORMED;
 
 			memcpy(filename, start, len);
 			filename[len] = '\0';
 
 			p++;
 
 			/*
 			 * After a quoted filename, only whitespace,
 			 * another parameter, or end-of-line is allowed.
 			 */
 			while (*p == ' ' || *p == '\t')
 				p++;
 
 			if (*p != '\0' && *p != ';')
 				return MULTIPART_MALFORMED;
 		} else {
 			/*
 			 * Ignore unrelated parameters, but require a
 			 * syntactically valid value.
 			 */
 			if (*p == '"') {
 				p++;
 
 				while (*p != '\0' && *p != '"')
 					p++;
 
 				if (*p != '"')
 					return MULTIPART_MALFORMED;
 
 				p++;
 			} else {
 				start = p;
 
 				while (*p != '\0' &&
 				    *p != ';' &&
 				    *p != ' ' &&
 				    *p != '\t')
 					p++;
 
 				if (p == start)
 					return MULTIPART_MALFORMED;
 			}
 
 			while (*p == ' ' || *p == '\t')
 				p++;
 
 			if (*p != '\0' && *p != ';')
 				return MULTIPART_MALFORMED;
 		}
 	}
 
 	if (!seen_name)
 		return MULTIPART_MALFORMED;
 
 	if (!seen_filename)
 		return MULTIPART_MISSING_FILENAME;
 
 	return MULTIPART_OK;
 }
 
 static int
 next_part_is_file(int fd, off_t offset,
     const struct multipart_request *req)
 {
 	char headers[8192];
 	char filename[NAME_MAX + 1];
 	char *line;
 	char *next;
 	char *disposition;
 	size_t used;
 	ssize_t n;
 	int disposition_found;
 
 	if (req == NULL)
 		return MULTIPART_ERROR;
 
 	if (lseek(fd, offset, SEEK_SET) == (off_t)-1)
 		return MULTIPART_ERROR;
 
 	used = 0;
 
 	while (used < sizeof(headers) - 1) {
 		n = read(fd, headers + used, 1);
 
 		if (n == 0)
 			return MULTIPART_MALFORMED;
 
 		if (n < 0)
 			return MULTIPART_ERROR;
 
 		used++;
 
 		if (used >= 4 &&
 		    headers[used - 4] == '\r' &&
 		    headers[used - 3] == '\n' &&
 		    headers[used - 2] == '\r' &&
 		    headers[used - 1] == '\n')
 			break;
 	}
 
 	if (used >= sizeof(headers) - 1)
 		return MULTIPART_MALFORMED;
 
 	headers[used] = '\0';
 
 	line = headers;
 	disposition_found = 0;
 
 	while (*line != '\0') {
 		next = strstr(line, "\r\n");
 
 		if (next == NULL)
 			return MULTIPART_MALFORMED;
 
 		/*
 		 * Empty line here would mean the header terminator was
 		 * encountered. Since we already read CRLFCRLF, this is
 		 * the end of the header section.
 		 */
 		if (next == line)
 			break;
 
 		*next = '\0';
 
 		if (strncasecmp(line, "Content-Disposition:", 20) == 0) {
 			if (disposition_found)
 				return MULTIPART_MALFORMED;
 
 			disposition_found = 1;
 
 			disposition = line + 20;
 
 			while (*disposition == ' ' ||
 			    *disposition == '\t')
 				disposition++;
 
 			n = parse_content_disposition(
 			    disposition,
 			    filename,
 			    sizeof(filename));
 
 			if (n != MULTIPART_OK)
 				return (int)n;
 		}
 
 		line = next + 2;
 	}
 
 	if (!disposition_found)
 		return MULTIPART_MISSING_FILENAME;
 
 	return MULTIPART_OK;
 }
 
 static int
 write_all(int fd, const void *buf, size_t len)
 {
 	const unsigned char *p = buf;
 	size_t remaining = len;
 
 	while (remaining > 0) {
 		ssize_t n;
 
 		n = write(fd, p, remaining);
 
 		if (n <= 0)
 			return -1;
 
 		p += n;
 		remaining -= (size_t) n;
 	}
 
 	return 0;
 }
 
 static int
 is_boundary_char(unsigned char c)
 {
 	if (isalnum(c))
 		return 1;
 
 	switch (c) {
 	case '\'':
 	case '(':
 	case ')':
 	case '+':
 	case '_':
 	case ',':
 	case '-':
 	case '.':
 	case '/':
 	case ':':
 	case '=':
 	case '?':
 		return 1;
 	default:
 		return 0;
 	}
 }
 /*
  * Parse the Content-Type boundary.
  *
  * This intentionally preserves the existing parser behavior for now.
  * Boundary parsing can be hardened in a later step.
  */
 static int
 parse_boundary(struct multipart_request * req, const char *ctype)
 {
 	const char *p;
 	const char *start;
 	size_t len;
 	int seen_boundary;
 
 	/*
 	 * Content-Type must begin with multipart/form-data.
 	 * The media type comparison is case-insensitive.
 	 */
 	if (strncasecmp(ctype, "multipart/form-data", 19) != 0)
 		return MULTIPART_INVALID_CONTENT_TYPE;
 
 	p = ctype + 19;
 	seen_boundary = 0;
 
 	/*
 	 * Parse MIME parameters.
 	 *
 	 * We accept optional whitespace around ';', parameter names,
 	 * and '='.  The boundary value may be quoted.
 	 */
 	for (;;) {
 		while (*p == ' ' || *p == '\t')
 			p++;
 
 		if (*p == '\0') {
 			if (!seen_boundary)
 				return MULTIPART_MISSING_BOUNDARY;
 			return MULTIPART_OK;
 		}
 		if (*p != ';')
 			return MULTIPART_INVALID_CONTENT_TYPE;
 
 		p++;
 
 		while (*p == ' ' || *p == '\t')
 			p++;
 
 		/* Parameter name. */
 		start = p;
 
 		while (*p != '\0' &&
 		    *p != '=' &&
 		    *p != ';' &&
 		    *p != ' ' &&
 		    *p != '\t')
 			p++;
 
 		len = (size_t) (p - start);
 
 		while (*p == ' ' || *p == '\t')
 			p++;
 
 		if (*p != '=')
 			return MULTIPART_INVALID_CONTENT_TYPE;
 
 		p++;
 
 		while (*p == ' ' || *p == '\t')
 			p++;
 
 		/*
 		 * We only care about the boundary parameter.
 		 * Other parameters are syntactically allowed.
 		 */
 		if (len == 8 &&
 		    strncasecmp(start, "boundary", 8) == 0) {
 			if (seen_boundary)
 				return MULTIPART_INVALID_BOUNDARY;
 
 			seen_boundary = 1;
 
 			/*
 			 * Quoted boundary.
 			 */
 			if (*p == '"') {
 				p++;
 				start = p;
 
 				while (*p != '\0' && *p != '"') {
 					if (!is_boundary_char(
 						(unsigned char) *p))
 						return MULTIPART_INVALID_BOUNDARY;
 					p++;
 				}
 
 				if (*p != '"')
 					return MULTIPART_INVALID_BOUNDARY;
 
 				len = (size_t) (p - start);
 
 				if (len == 0 || len >= MULTIPART_BOUNDARY_MAX)
 					return MULTIPART_INVALID_BOUNDARY;
 
 				memcpy(req->boundary, start, len);
 				req->boundary[len] = '\0';
 
 				p++;
 
 				while (*p == ' ' || *p == '\t')
 					p++;
 
 				if (*p != '\0' && *p != ';')
 					return MULTIPART_INVALID_CONTENT_TYPE;
 			} else {
 				/*
 				 * Unquoted boundary.
 				 */
 				start = p;
 
 				while (*p != '\0' && *p != ';' &&
 				    *p != ' ' && *p != '\t') {
 					if (!is_boundary_char(
 						(unsigned char) *p))
 						return MULTIPART_INVALID_BOUNDARY;
 					p++;
 				}
 
 				len = (size_t) (p - start);
 
 				if (len == 0 || len >= MULTIPART_BOUNDARY_MAX)
 					return MULTIPART_INVALID_BOUNDARY;
 
 				memcpy(req->boundary, start, len);
 				req->boundary[len] = '\0';
 
 				while (*p == ' ' || *p == '\t')
 					p++;
 
 				if (*p != '\0' && *p != ';')
 					return MULTIPART_INVALID_CONTENT_TYPE;
 			}
 		} else {
 			/*
 			 * Skip the value of an unrelated parameter.
 			 * Handle quoted values so semicolons inside quotes
 			 * aren't mistaken for parameter separators.
 			 */
 			if (*p == '"') {
 				p++;
 
 				while (*p != '\0' && *p != '"')
 					p++;
 
 				if (*p != '"')
 					return MULTIPART_INVALID_CONTENT_TYPE;
 
 				p++;
 			} else {
 				while (*p != '\0' && *p != ';')
 					p++;
 			}
 		}
 	}
 }
 
 int
 multipart_parse_request(struct multipart_request * req)
 {
 	const char *ctype;
 	const char *clen;
 	char *ep;
 	unsigned long long len;
 	off_t max_upload;
 	int ret;
 	const char *p;
 
 	if (req == NULL)
 		return MULTIPART_ERROR;
 
 	memset(req, 0, sizeof(*req));
 
 	ctype = getenv("CONTENT_TYPE");
 
 	if (ctype == NULL)
 		return MULTIPART_MISSING_CONTENT_TYPE;
 
 	ret = parse_boundary(req, ctype);
 
 	if (ret != MULTIPART_OK)
 		return ret;
 
 	clen = getenv("CONTENT_LENGTH");
 
 	if (clen == NULL)
 		return MULTIPART_MISSING_LENGTH;
 
 	for (p = clen; *p != '\0'; p++) {
 		if (*p < '0' || *p > '9')
 			return MULTIPART_INVALID_LENGTH;
 	}
 
 	errno = 0;
 
 	len = strtoull(clen, &ep, 10);
 
 	if (errno != 0 ||
 	    ep == clen ||
 	    *ep != '\0')
 		return MULTIPART_INVALID_LENGTH;
 
 	if (errno == ERANGE || ep == clen || *ep != '\0')
 		return MULTIPART_INVALID_LENGTH;
 
 	max_upload = config_max_upload();
 
 	if (len == 0 ||
 	    len > (unsigned long long) max_upload)
 		return MULTIPART_TOO_LARGE;
 
 	req->length = (off_t) len;
 
 	return MULTIPART_OK;
 }
 
 int
 multipart_spool_request(int fd, off_t length)
 {
 	unsigned char buffer[8192];
 	off_t remaining = length;
 
 	while (remaining > 0) {
 		size_t want;
 		ssize_t n;
 
 		want = remaining > (off_t) sizeof(buffer)
 		    ? sizeof(buffer)
 		    : (size_t) remaining;
 
 		n = read(STDIN_FILENO, buffer, want);
 
 		if (n <= 0)
 			return MULTIPART_ERROR;
 
 		/*
 		 * Keep the write loop local to the multipart/spooling
 		 * implementation for now.
 		 */
 		{
 			const unsigned char *p = buffer;
 			size_t left = (size_t) n;
 
 			while (left > 0) {
 				ssize_t written;
 
 				written = write(fd, p, left);
 
 				if (written <= 0)
 					return MULTIPART_ERROR;
 
 				p += written;
 				left -= (size_t) written;
 			}
 		}
 
 		remaining -= n;
 	}
 
 	if (lseek(fd, 0, SEEK_SET) == (off_t) - 1)
 		return MULTIPART_ERROR;
 
 	return MULTIPART_OK;
 }
 
 static int
 extract_filename(int fd, const struct multipart_request * req,
     char *filename, size_t size)
 {
 	char headers[8192];
 	size_t used = 0;
 	size_t header_end = 0;
 	char *line;
 	char *next;
 	char *disposition;
 	ssize_t n;
 
 	if (req == NULL || filename == NULL || size == 0)
 		return MULTIPART_ERROR;
 
 	if (lseek(fd, 0, SEEK_SET) == (off_t) - 1)
 		return MULTIPART_ERROR;
 
 	/*
 	 * Read only the first multipart part's headers.
 	 *
 	 * The header terminator is part of the multipart structure, so
 	 * anything after it belongs to the payload and must not be used
 	 * when identifying the filename.
 	 */
 	while (used < sizeof(headers) - 1) {
 		n = read(fd, headers + used, 1);
 
 		if (n == 0)
 			return MULTIPART_MALFORMED;
 
 		if (n < 0)
 			return MULTIPART_ERROR;
 
 		used++;
 
 		if (used >= 4 &&
 		    headers[used - 4] == '\r' &&
 		    headers[used - 3] == '\n' &&
 		    headers[used - 2] == '\r' &&
 		    headers[used - 1] == '\n') {
 			header_end = used - 4;
 			break;
 		}
 	}
 
 	if (header_end == 0)
 		return MULTIPART_MALFORMED;
 
 	headers[header_end + 2] = '\0';
 
 	/*
 	 * The first line must be the opening multipart boundary.
 	 */
 	{
 		size_t boundary_len = strlen(req->boundary);
 		size_t opening_len;
 
 		opening_len = boundary_len + 4;	/* "--" + boundary + "\r\n" */
 
 		if (header_end < opening_len ||
 		    headers[0] != '-' ||
 		    headers[1] != '-' ||
 		    memcmp(headers + 2,
 			req->boundary, boundary_len) != 0 ||
 		    headers[2 + boundary_len] != '\r' ||
 		    headers[3 + boundary_len] != '\n')
 			return MULTIPART_MALFORMED;
 	}
 
 	/*
 	 * Examine each header line. Header names are case-insensitive.
 	 */
 	line = strchr(headers, '\n');
 	if (line == NULL)
 		return MULTIPART_MALFORMED;
 
 	line++;
 
 	while (*line != '\0') {
 		next = strstr(line, "\r\n");
 
 		if (next == NULL)
 			break;
 
 		*next = '\0';
 
 		if (strncasecmp(line, "Content-Disposition:", 20) == 0) {
 			disposition = line + 20;
 			while (*disposition == ' ' || *disposition == '\t')
 				disposition++;
 
 			return parse_content_disposition(disposition, filename, size);
 
 		}
 		line = next + 2;
 	}
 
 	return MULTIPART_MISSING_FILENAME;
 }
 
 static int
 find_payload(int fd,
     const struct multipart_request * req,
     off_t * payload_offset,
     off_t * payload_length)
 {
 	unsigned char buffer[8192];
 	char delimiter[BOUNDARY_MAX + 3];
 	size_t delimiter_len;
 	size_t match;
 	off_t payload_start;
 	off_t pos;
 	off_t remaining;
 
 	if (req == NULL ||
 	    payload_offset == NULL ||
 	    payload_length == NULL)
 		return MULTIPART_ERROR;
 
 	{
 		struct stat st;
 
 		if (req->length < 0)
 			return MULTIPART_MALFORMED;
 
 		if (fstat(fd, &st) == -1)
 			return MULTIPART_ERROR;
 
 		if (st.st_size < req->length)
 			return MULTIPART_MALFORMED;
 	}
 
 	if (snprintf(delimiter, sizeof(delimiter),
 		"\r\n--%s", req->boundary) >=
 	    (int) sizeof(delimiter))
 		return MULTIPART_ERROR;
 
 	delimiter_len = strlen(delimiter);
 
 	/*
 	 * The payload starts after the first CRLFCRLF
 	 * terminating the part headers.
 	 */
 	if (lseek(fd, 0, SEEK_SET) == (off_t) - 1)
 		return MULTIPART_ERROR;
 
 	pos = 0;
 	remaining = req->length;
 
 	{
 		const char header_end[] = "\r\n\r\n";
 		size_t header_match = 0;
 
 		while (remaining > 0) {
 			size_t want;
 			ssize_t n;
 			size_t i;
 
 			want = remaining > (off_t) sizeof(buffer)
 			    ? sizeof(buffer)
 			    : (size_t) remaining;
 
 			n = read(fd, buffer, want);
 			if (n < 0)
 				return MULTIPART_ERROR;
 			if (n == 0)
 				return MULTIPART_MALFORMED;
 
 			for (i = 0; i < (size_t) n; i++) {
 				if (buffer[i] ==
 				    (unsigned char) header_end[header_match]) {
 					header_match++;
 
 					if (header_match ==
 					    sizeof(header_end) - 1) {
 						payload_start =
 						    pos + (off_t) i + 1;
 						goto header_found;
 					}
 				} else {
 					header_match = 0;
 				}
 			}
 
 			pos += n;
 			remaining -= n;
 		}
 	}
 
 	/*
 	 * No CRLFCRLF means the part headers were never
 	 * properly terminated.
 	 */
 	return MULTIPART_MALFORMED;
 
 header_found:
 	if (payload_start > req->length)
 		return MULTIPART_MALFORMED;
 
 	if (lseek(fd, payload_start, SEEK_SET) == (off_t) - 1)
 		return MULTIPART_ERROR;
 
 	pos = payload_start;
 	remaining = req->length - payload_start;
 	match = 0;
 
 	while (remaining > 0) {
 		size_t want;
 		ssize_t n;
 		size_t i;
 
 		want = remaining > (off_t) sizeof(buffer)
 		    ? sizeof(buffer)
 		    : (size_t) remaining;
 
 		n = read(fd, buffer, want);
 		if (n < 0)
 			return MULTIPART_ERROR;
 		if (n == 0)
 			return MULTIPART_MALFORMED;
 
 		for (i = 0; i < (size_t) n; i++) {
 			unsigned char c;
 
 			c = buffer[i];
 
 			if (c == (unsigned char) delimiter[match]) {
 				match++;
 
 				if (match == delimiter_len) {
 					off_t delimiter_end;
 					unsigned char suffix[2];
 					ssize_t suffix_len;
 
 					delimiter_end =
 					    pos + (off_t) i + 1;
 
 					/*
 					 * The boundary delimiter must be
 					 * followed by exactly one of:
 					 *
 					 *   "--"   final boundary
 					 *   "\r\n" next part
 					 */
 					suffix_len = pread(fd,
 					    suffix, sizeof(suffix),
 					    delimiter_end);
 
 					if (suffix_len == -1)
 						return MULTIPART_ERROR;
 
 					/*
 					 * We found the beginning of a
 					 * boundary, but the request ends
 					 * before its required suffix.
 					 */
 					if (suffix_len != 2)
 						return MULTIPART_MALFORMED;
 
 					if (suffix[0] == '-' &&
 					    suffix[1] == '-') {
 						/*
 						 * payload ends immediately before
 						 * the CRLF that introduced this
 						 * delimiter.
 						 */
 						*payload_offset =
 						    payload_start;
 
 						*payload_length =
 						    delimiter_end -
 						    delimiter_len -
 						    payload_start;
 
 						if (*payload_length < 0)
 							return MULTIPART_MALFORMED;
 
 						return MULTIPART_OK;
 					}
 					if (suffix[0] == '\r' &&
 					    suffix[1] == '\n') {
 						int ret;
 
 						ret = next_part_is_file(fd, delimiter_end + 2, req);
 
 						if (ret == MULTIPART_OK)
 							return MULTIPART_MULTIPLE_FILES;
 
 						if (ret == MULTIPART_MISSING_FILENAME)
 							return MULTIPART_MALFORMED;
 
 						return ret;
 					}
 					/*
 					 * This only looked like a boundary.
 					 * It is ordinary payload data.
 					 */
 					match = 0;
 					continue;
 				}
 			} else {
 				/*
 				 * If this byte can begin a new delimiter,
 				 * retain it as the first match.
 				 */
 				if (c == (unsigned char) delimiter[0])
 					match = 1;
 				else
 					match = 0;
 			}
 		}
 
 		pos += n;
 		remaining -= n;
 	}
 
 	/*
 	 * Reaching the end of CONTENT_LENGTH without a valid
 	 * closing boundary means the multipart body is malformed.
 	 */
 	return MULTIPART_MALFORMED;
 }
 
 int
 multipart_extract_part(int fd,
     const struct multipart_request * req,
     struct multipart_part * part)
 {
 	int ret;
 
 	if (req == NULL || part == NULL)
 		return MULTIPART_ERROR;
 
 	memset(part, 0, sizeof(*part));
 
 	ret = extract_filename(fd,
 	    req,
 	    part->filename,
 	    sizeof(part->filename));
 
 	if (ret != MULTIPART_OK)
 		return ret;
 
 	ret = find_payload(fd,
 	    req,
 	    &part->offset,
 	    &part->length);
 
 	if (ret != MULTIPART_OK)
 		return ret;
 
 	return MULTIPART_OK;
 }
 
 int
 multipart_copy_part(int spool_fd,
     const struct multipart_part * part,
     int output_fd)
 {
 	unsigned char buffer[8192];
 	off_t remaining;
 
 	if (part == NULL)
 		return MULTIPART_ERROR;
 
 	if (part->offset < 0 || part->length < 0)
     		return MULTIPART_ERROR;
 
 	if (lseek(spool_fd, part->offset, SEEK_SET) == (off_t) - 1)
 		return MULTIPART_ERROR;
 
 	remaining = part->length;
 
 	while (remaining > 0) {
 		size_t want;
 		ssize_t n;
 
 		want = remaining > (off_t) sizeof(buffer)
 		    ? sizeof(buffer)
 		    : (size_t) remaining;
 
 		n = read(spool_fd, buffer, want);
 
 		if (n <= 0)
 			return MULTIPART_ERROR;
 
 		if (write_all(output_fd, buffer, (size_t) n) == -1)
 			return MULTIPART_ERROR;
 
 		remaining -= n;
 	}
 
 	return MULTIPART_OK;
 }