2
# Copyright (C) 2007-2008 The University of Melbourne
4
# This program is free software; you can redistribute it and/or modify
5
# it under the terms of the GNU General Public License as published by
6
# the Free Software Foundation; either version 2 of the License, or
7
# (at your option) any later version.
9
# This program is distributed in the hope that it will be useful,
10
# but WITHOUT ANY WARRANTY; without even the implied warranty of
11
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12
# GNU General Public License for more details.
14
# You should have received a copy of the GNU General Public License
15
# along with this program; if not, write to the Free Software
16
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
22
# Runs a student script in a safe execution environment.
24
from common import studpath
26
from common.util import IVLEError, IVLEJailError
35
# TODO: Make progressive output work
36
# Question: Will having a large buffer size stop progressive output from
37
# working on smaller output
39
CGI_BLOCK_SIZE = 65535
44
"""Get the unix uid corresponding to the given login name.
45
If it is not in the dictionary of uids, then consult the
46
database and retrieve an update of the user table."""
52
res = conn.get_all('login', ['login', 'unixid'])
54
return (flds['login'], flds['unixid'])
55
uids = dict(map(repack,res))
59
def interpret_file(req, owner, jail_dir, filename, interpreter, gentle=True):
60
"""Serves a file by interpreting it using one of IVLE's builtin
61
interpreters. All interpreters are intended to run in the user's jail. The
62
jail location is provided as an argument to the interpreter but it is up
63
to the individual interpreters to create the jail.
65
req: An IVLE request object.
66
owner: Username of the user who owns the file being served.
67
jail_dir: Absolute path to the user's jail.
68
filename: Absolute filename within the user's jail.
69
interpreter: A function object to call.
71
# We can't test here whether or not the target file actually exists,
72
# because the apache user may not have permission. Instead we have to
73
# rely on the interpreter generating an error.
74
if filename.startswith(os.sep):
75
filename_abs = filename
76
filename_rel = filename[1:]
78
filename_abs = os.path.join(os.sep, filename)
79
filename_rel = filename
81
# Get the UID of the owner of the file
82
# (Note: files are executed by their owners, not the logged in user.
83
# This ensures users are responsible for their own programs and also
84
# allows them to be executed by the public).
87
# Split up req.path again, this time with respect to the jail
88
(working_dir, _) = os.path.split(filename_abs)
89
# jail_dir is the absolute jail directory.
90
# path is the filename relative to the user's jail.
91
# working_dir is the directory containing the file relative to the user's
93
# (Note that paths "relative" to the jail actually begin with a '/' as
94
# they are absolute in the jailspace)
96
return interpreter(uid, jail_dir, working_dir, filename_abs, req,
100
"""Stores flags regarding the state of reading CGI output.
101
If this is to be gentle, detection of invalid headers will result in an
103
def __init__(self, begentle=True):
104
self.gentle = begentle
105
self.started_cgi_body = False
106
self.got_cgi_headers = False
107
self.wrote_html_warning = False
109
self.headers = {} # Header names : values
111
def execute_cgi(interpreter, trampoline, uid, jail_dir, working_dir,
112
script_path, req, gentle):
114
trampoline: Full path on the local system to the CGI wrapper program
116
uid: User ID of the owner of the file.
117
jail_dir: Absolute path of owner's jail directory.
118
working_dir: Directory containing the script file relative to owner's
120
script_path: CGI script relative to the owner's jail.
121
req: IVLE request object.
123
The called CGI wrapper application shall be called using popen and receive
124
the HTTP body on stdin. It shall receive the CGI environment variables to
128
# Support no-op trampoline runs.
129
if interpreter is None:
130
interpreter = '/bin/true'
136
# Get the student program's directory and execute it from that context.
137
(tramp_dir, _) = os.path.split(trampoline)
139
# TODO: Don't create a file if the body length is known to be 0
140
# Write the HTTP body to a temporary file so it can be passed as a *real*
143
body = req.read() if not noop else None
147
f.seek(0) # Rewind, for reading
149
# Set up the environment
150
# This automatically asks mod_python to load up the CGI variables into the
151
# environment (which is a good first approximation)
152
old_env = os.environ.copy()
153
for k in os.environ.keys():
155
for (k,v) in req.get_cgi_environ().items():
159
# usage: tramp uid jail_dir working_dir script_path
160
pid = subprocess.Popen(
161
[trampoline, str(uid), jail_dir, working_dir, interpreter,
163
stdin=f, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
166
# Restore the environment
167
for k in os.environ.keys():
169
for (k,v) in old_env.items():
172
# We don't want any output! Bail out after the process terminates.
177
# process_cgi_line: Reads a single line of CGI output and processes it.
178
# Prints to req, and also does fancy HTML warnings if Content-Type
180
cgiflags = CGIFlags(gentle)
182
# Read from the process's stdout into req
183
data = pid.stdout.read(CGI_BLOCK_SIZE)
185
process_cgi_output(req, data, cgiflags)
186
data = pid.stdout.read(CGI_BLOCK_SIZE)
188
# If we haven't processed headers yet, now is a good time
189
if not cgiflags.started_cgi_body:
190
process_cgi_output(req, '\n', cgiflags)
192
# If we wrote an HTML warning header, write the footer
193
if cgiflags.wrote_html_warning:
199
def process_cgi_output(req, data, cgiflags):
200
"""Processes a chunk of CGI output. data is a string of arbitrary length;
201
some arbitrary chunk of output written by the CGI script."""
202
if cgiflags.started_cgi_body:
203
if cgiflags.wrote_html_warning:
204
# HTML escape text if wrote_html_warning
205
req.write(cgi.escape(data))
209
# Break data into lines of CGI header data.
210
linebuf = cgiflags.linebuf + data
211
# First see if we can split all header data
212
# We need to get the double CRLF- or LF-terminated headers, whichever
213
# is smaller, as either sequence may appear somewhere in the body.
214
usplit = linebuf.split('\n\n', 1)
215
wsplit = linebuf.split('\r\n\r\n', 1)
216
split = len(usplit[0]) > len(wsplit[0]) and wsplit or usplit
218
# Haven't seen all headers yet. Buffer and come back later.
219
cgiflags.linebuf = linebuf
224
cgiflags.linebuf = ""
225
cgiflags.started_cgi_body = True
226
# Process all the header lines
227
split = headers.split('\r\n', 1)
229
split = headers.split('\n', 1)
231
process_cgi_header_line(req, split[0], cgiflags)
232
if len(split) == 1: break
234
if cgiflags.wrote_html_warning:
235
# We're done with headers. Treat the rest as data.
236
data = headers + '\n' + data
238
split = headers.split('\r\n', 1)
240
split = headers.split('\n', 1)
242
# Is this an internal IVLE error condition?
243
hs = cgiflags.headers
244
if 'X-IVLE-Error-Type' in hs:
245
t = hs['X-IVLE-Error-Type']
246
if t == IVLEError.__name__:
247
raise IVLEError(int(hs['X-IVLE-Error-Code']),
248
hs['X-IVLE-Error-Message'])
251
raise IVLEJailError(hs['X-IVLE-Error-Type'],
252
hs['X-IVLE-Error-Message'],
253
hs['X-IVLE-Error-Info'])
255
raise IVLEError(500, 'bad error headers written by CGI')
257
# Check to make sure the required headers were written
258
if cgiflags.wrote_html_warning or not cgiflags.gentle:
259
# We already reported an error, that's enough
261
elif "Content-Type" in cgiflags.headers:
263
elif "Location" in cgiflags.headers:
264
if ("Status" in cgiflags.headers and req.status >= 300
265
and req.status < 400):
268
message = """You did not write a valid status code for
269
the given location. To make a redirect, you may wish to try:</p>
270
<pre style="margin-left: 1em">Status: 302 Found
271
Location: <redirect address></pre>"""
272
write_html_warning(req, message)
273
cgiflags.wrote_html_warning = True
275
message = """You did not print a Content-Type header.
276
CGI requires that you print a "Content-Type". You may wish to try:</p>
277
<pre style="margin-left: 1em">Content-Type: text/html</pre>"""
278
write_html_warning(req, message)
279
cgiflags.wrote_html_warning = True
281
# Call myself to flush out the extra bit of data we read
282
process_cgi_output(req, data, cgiflags)
284
def process_cgi_header_line(req, line, cgiflags):
285
"""Process a line of CGI header data. line is a string representing a
286
complete line of text, stripped and without the newline.
289
name, value = line.split(':', 1)
291
# No colon. The user did not write valid headers.
292
# If we are being gentle, we want to help the user understand what
293
# went wrong. Otherwise, just admit we screwed up.
295
if not cgiflags.gentle:
296
message = """An unexpected server error has occured."""
298
elif len(cgiflags.headers) == 0:
299
# First line was not a header line. We can assume this is not
301
message = """You did not print a CGI header.
302
CGI requires that you print a "Content-Type". You may wish to try:</p>
303
<pre style="margin-left: 1em">Content-Type: text/html</pre>"""
305
# They printed some header at least, but there was an invalid
307
message = """You printed an invalid CGI header. You need to leave
308
a blank line after the headers, before writing the page contents."""
309
write_html_warning(req, message, warning=warning)
310
cgiflags.wrote_html_warning = True
311
# Handle the rest of this line as normal data
312
process_cgi_output(req, line + '\n', cgiflags)
316
value = value.strip()
317
if name == "Content-Type":
318
req.content_type = value
319
elif name == "Location":
321
elif name == "Status":
322
# Must be an integer, followed by a space, and then the status line
323
# which we ignore (seems like Apache has no way to send a custom
326
req.status = int(value.split(' ', 1)[0])
328
if not cgiflags.gentle:
329
# This isn't user code, so it should be good.
330
# Get us out of here!
332
message = """The "Status" CGI header was invalid. You need to
333
print a number followed by a message, such as "302 Found"."""
334
write_html_warning(req, message)
335
cgiflags.wrote_html_warning = True
336
# Handle the rest of this line as normal data
337
process_cgi_output(req, line + '\n', cgiflags)
339
# Generic HTTP header
340
# FIXME: Security risk letting users write arbitrary headers?
341
req.headers_out.add(name, value)
342
cgiflags.headers[name] = value # FIXME: Only the last header will end up here.
344
def write_html_warning(req, text, warning="Warning"):
345
"""Prints an HTML warning about invalid CGI interaction on the part of the
346
user. text may contain HTML markup."""
347
req.content_type = "text/html"
348
req.write("""<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
349
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
350
<html xmlns="http://www.w3.org/1999/xhtml">
352
<meta http-equiv="Content-Type"
353
content="text/html; charset=utf-8" />
355
<body style="margin: 0; padding: 0; font-family: sans-serif;">
356
<div style="background-color: #faa; border-bottom: 1px solid black;
358
<p><strong>%s</strong>: %s
360
<div style="margin: 8px;">
362
""" % (warning, text))
364
location_cgi_python = os.path.join(conf.ivle_install_dir,
367
# Mapping of interpreter names (as given in conf/app/server.py) to
368
# interpreter functions.
370
interpreter_objects = {
372
: functools.partial(execute_cgi, "/usr/bin/python",
373
location_cgi_python),
375
: functools.partial(execute_cgi, None,
376
location_cgi_python),
382
def fixup_environ(req):
383
"""Assuming os.environ has been written with the CGI variables from
384
apache, make a few changes for security and correctness.
386
Does not modify req, only reads it.
389
# Comments here are on the heavy side, explained carefully for security
390
# reasons. Please read carefully before making changes.
392
# Remove DOCUMENT_ROOT and SCRIPT_FILENAME. Not part of CGI spec and
393
# exposes unnecessary details about server.
395
del env['DOCUMENT_ROOT']
398
del env['SCRIPT_FILENAME']
401
# Remove PATH. The PATH here is the path on the server machine; not useful
402
# inside the jail. It may be a good idea to add another path, reflecting
403
# the inside of the jail, but not done at this stage.
408
# Remove SCRIPT_FILENAME. Not part of CGI spec (see SCRIPT_NAME).
410
# PATH_INFO is wrong because the script doesn't physically exist.
411
# Apache makes it relative to the "serve" app. It should actually be made
412
# relative to the student's script. intepretservice does that in the jail,
413
# so here we just clear it.
414
env['PATH_INFO'] = ''
415
env['PATH_TRANSLATED'] = ''
417
# CGI specifies that REMOTE_HOST SHOULD be set, and MAY just be set to
418
# REMOTE_ADDR. Since Apache does not appear to set this, set it to
420
if 'REMOTE_HOST' not in env and 'REMOTE_ADDR' in env:
421
env['REMOTE_HOST'] = env['REMOTE_ADDR']
423
# SCRIPT_NAME is the path to the script WITHOUT PATH_INFO.
424
script_name = req.uri
425
env['SCRIPT_NAME'] = script_name
427
# SERVER_SOFTWARE is actually not Apache but IVLE, since we are
428
# custom-making the CGI request.
429
env['SERVER_SOFTWARE'] = "IVLE/" + str(conf.ivle_version)
431
# Additional environment variables
432
username = studpath.url_to_jailpaths(req.path)[0]
433
env['HOME'] = os.path.join('/home', username)
added
removed
lib/common/interpret.py
