2
# Copyright (C) 2007-2008 The University of Melbourne
4
# This program is free software; you can redistribute it and/or modify
5
# it under the terms of the GNU General Public License as published by
6
# the Free Software Foundation; either version 2 of the License, or
7
# (at your option) any later version.
9
# This program is distributed in the hope that it will be useful,
10
# but WITHOUT ANY WARRANTY; without even the implied warranty of
11
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12
# GNU General Public License for more details.
14
# You should have received a copy of the GNU General Public License
15
# along with this program; if not, write to the Free Software
16
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
22
# Runs a student script in a safe execution environment.
24
from ivle import studpath
26
from ivle.util import IVLEError, IVLEJailError
36
# TODO: Make progressive output work
37
# Question: Will having a large buffer size stop progressive output from
38
# working on smaller output
40
CGI_BLOCK_SIZE = 65535
42
def interpret_file(req, owner, jail_dir, filename, interpreter, gentle=True):
43
"""Serves a file by interpreting it using one of IVLE's builtin
44
interpreters. All interpreters are intended to run in the user's jail. The
45
jail location is provided as an argument to the interpreter but it is up
46
to the individual interpreters to create the jail.
48
req: An IVLE request object.
49
owner: The user who owns the file being served.
50
jail_dir: Absolute path to the user's jail.
51
filename: Absolute filename within the user's jail.
52
interpreter: A function object to call.
54
# We can't test here whether or not the target file actually exists,
55
# because the apache user may not have permission. Instead we have to
56
# rely on the interpreter generating an error.
57
if filename.startswith(os.sep):
58
filename_abs = filename
59
filename_rel = filename[1:]
61
filename_abs = os.path.join(os.sep, filename)
62
filename_rel = filename
64
# (Note: files are executed by their owners, not the logged in user.
65
# This ensures users are responsible for their own programs and also
66
# allows them to be executed by the public).
68
# Split up req.path again, this time with respect to the jail
69
(working_dir, _) = os.path.split(filename_abs)
70
# jail_dir is the absolute jail directory.
71
# path is the filename relative to the user's jail.
72
# working_dir is the directory containing the file relative to the user's
74
# (Note that paths "relative" to the jail actually begin with a '/' as
75
# they are absolute in the jailspace)
77
return interpreter(owner.unixid, jail_dir, working_dir, filename_abs, req,
81
"""Stores flags regarding the state of reading CGI output.
82
If this is to be gentle, detection of invalid headers will result in an
84
def __init__(self, begentle=True):
85
self.gentle = begentle
86
self.started_cgi_body = False
87
self.got_cgi_headers = False
88
self.wrote_html_warning = False
90
self.headers = {} # Header names : values
92
def execute_cgi(interpreter, trampoline, uid, jail_dir, working_dir,
93
script_path, req, gentle):
95
trampoline: Full path on the local system to the CGI wrapper program
97
uid: User ID of the owner of the file.
98
jail_dir: Absolute path of owner's jail directory.
99
working_dir: Directory containing the script file relative to owner's
101
script_path: CGI script relative to the owner's jail.
102
req: IVLE request object.
104
The called CGI wrapper application shall be called using popen and receive
105
the HTTP body on stdin. It shall receive the CGI environment variables to
109
# Support no-op trampoline runs.
110
if interpreter is None:
111
interpreter = '/bin/true'
117
# Get the student program's directory and execute it from that context.
118
(tramp_dir, _) = os.path.split(trampoline)
120
# TODO: Don't create a file if the body length is known to be 0
121
# Write the HTTP body to a temporary file so it can be passed as a *real*
124
body = req.read() if not noop else None
128
f.seek(0) # Rewind, for reading
130
# Set up the environment
131
# This automatically asks mod_python to load up the CGI variables into the
132
# environment (which is a good first approximation)
133
old_env = os.environ.copy()
134
for k in os.environ.keys():
136
for (k,v) in req.get_cgi_environ().items():
140
# usage: tramp uid jail_dir working_dir script_path
141
pid = subprocess.Popen(
142
[trampoline, str(uid), jail_dir, working_dir, interpreter,
144
stdin=f, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
147
# Restore the environment
148
for k in os.environ.keys():
150
for (k,v) in old_env.items():
153
# We don't want any output! Bail out after the process terminates.
158
# process_cgi_line: Reads a single line of CGI output and processes it.
159
# Prints to req, and also does fancy HTML warnings if Content-Type
161
cgiflags = CGIFlags(gentle)
163
# Read from the process's stdout into req
164
data = pid.stdout.read(CGI_BLOCK_SIZE)
166
process_cgi_output(req, data, cgiflags)
167
data = pid.stdout.read(CGI_BLOCK_SIZE)
169
# If we haven't processed headers yet, now is a good time
170
if not cgiflags.started_cgi_body:
171
process_cgi_output(req, '\n', cgiflags)
173
# If we wrote an HTML warning header, write the footer
174
if cgiflags.wrote_html_warning:
180
def process_cgi_output(req, data, cgiflags):
181
"""Processes a chunk of CGI output. data is a string of arbitrary length;
182
some arbitrary chunk of output written by the CGI script."""
183
if cgiflags.started_cgi_body:
184
if cgiflags.wrote_html_warning:
185
# HTML escape text if wrote_html_warning
186
req.write(cgi.escape(data))
190
# Break data into lines of CGI header data.
191
linebuf = cgiflags.linebuf + data
192
# First see if we can split all header data
193
# We need to get the double CRLF- or LF-terminated headers, whichever
194
# is smaller, as either sequence may appear somewhere in the body.
195
usplit = linebuf.split('\n\n', 1)
196
wsplit = linebuf.split('\r\n\r\n', 1)
197
split = len(usplit[0]) > len(wsplit[0]) and wsplit or usplit
199
# Haven't seen all headers yet. Buffer and come back later.
200
cgiflags.linebuf = linebuf
205
cgiflags.linebuf = ""
206
cgiflags.started_cgi_body = True
207
# Process all the header lines
208
split = headers.split('\r\n', 1)
210
split = headers.split('\n', 1)
212
process_cgi_header_line(req, split[0], cgiflags)
213
if len(split) == 1: break
215
if cgiflags.wrote_html_warning:
216
# We're done with headers. Treat the rest as data.
217
data = headers + '\n' + data
219
split = headers.split('\r\n', 1)
221
split = headers.split('\n', 1)
223
# Is this an internal IVLE error condition?
224
hs = cgiflags.headers
225
if 'X-IVLE-Error-Type' in hs:
226
t = hs['X-IVLE-Error-Type']
227
if t == IVLEError.__name__:
228
raise IVLEError(int(hs['X-IVLE-Error-Code']),
229
hs['X-IVLE-Error-Message'])
232
raise IVLEJailError(hs['X-IVLE-Error-Type'],
233
hs['X-IVLE-Error-Message'],
234
hs['X-IVLE-Error-Info'])
236
raise IVLEError(500, 'bad error headers written by CGI')
238
# Check to make sure the required headers were written
239
if cgiflags.wrote_html_warning or not cgiflags.gentle:
240
# We already reported an error, that's enough
242
elif "Content-Type" in cgiflags.headers:
244
elif "Location" in cgiflags.headers:
245
if ("Status" in cgiflags.headers and req.status >= 300
246
and req.status < 400):
249
message = """You did not write a valid status code for
250
the given location. To make a redirect, you may wish to try:</p>
251
<pre style="margin-left: 1em">Status: 302 Found
252
Location: <redirect address></pre>"""
253
write_html_warning(req, message)
254
cgiflags.wrote_html_warning = True
256
message = """You did not print a Content-Type header.
257
CGI requires that you print a "Content-Type". You may wish to try:</p>
258
<pre style="margin-left: 1em">Content-Type: text/html</pre>"""
259
write_html_warning(req, message)
260
cgiflags.wrote_html_warning = True
262
# Call myself to flush out the extra bit of data we read
263
process_cgi_output(req, data, cgiflags)
265
def process_cgi_header_line(req, line, cgiflags):
266
"""Process a line of CGI header data. line is a string representing a
267
complete line of text, stripped and without the newline.
270
name, value = line.split(':', 1)
272
# No colon. The user did not write valid headers.
273
# If we are being gentle, we want to help the user understand what
274
# went wrong. Otherwise, just admit we screwed up.
276
if not cgiflags.gentle:
277
message = """An unexpected server error has occured."""
279
elif len(cgiflags.headers) == 0:
280
# First line was not a header line. We can assume this is not
282
message = """You did not print a CGI header.
283
CGI requires that you print a "Content-Type". You may wish to try:</p>
284
<pre style="margin-left: 1em">Content-Type: text/html</pre>"""
286
# They printed some header at least, but there was an invalid
288
message = """You printed an invalid CGI header. You need to leave
289
a blank line after the headers, before writing the page contents."""
290
write_html_warning(req, message, warning=warning)
291
cgiflags.wrote_html_warning = True
292
# Handle the rest of this line as normal data
293
process_cgi_output(req, line + '\n', cgiflags)
297
value = value.strip()
298
if name == "Content-Type":
299
req.content_type = value
300
elif name == "Location":
302
elif name == "Status":
303
# Must be an integer, followed by a space, and then the status line
304
# which we ignore (seems like Apache has no way to send a custom
307
req.status = int(value.split(' ', 1)[0])
309
if not cgiflags.gentle:
310
# This isn't user code, so it should be good.
311
# Get us out of here!
313
message = """The "Status" CGI header was invalid. You need to
314
print a number followed by a message, such as "302 Found"."""
315
write_html_warning(req, message)
316
cgiflags.wrote_html_warning = True
317
# Handle the rest of this line as normal data
318
process_cgi_output(req, line + '\n', cgiflags)
320
# Generic HTTP header
321
# FIXME: Security risk letting users write arbitrary headers?
322
req.headers_out.add(name, value)
323
cgiflags.headers[name] = value # FIXME: Only the last header will end up here.
325
def write_html_warning(req, text, warning="Warning"):
326
"""Prints an HTML warning about invalid CGI interaction on the part of the
327
user. text may contain HTML markup."""
328
req.content_type = "text/html"
329
req.write("""<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
330
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
331
<html xmlns="http://www.w3.org/1999/xhtml">
333
<meta http-equiv="Content-Type"
334
content="text/html; charset=utf-8" />
336
<body style="margin: 0; padding: 0; font-family: sans-serif;">
337
<div style="background-color: #faa; border-bottom: 1px solid black;
339
<p><strong>%s</strong>: %s
341
<div style="margin: 8px;">
343
""" % (warning, text))
345
location_cgi_python = os.path.join(ivle.conf.lib_path, "trampoline")
347
# Mapping of interpreter names (as given in conf/app/server.py) to
348
# interpreter functions.
350
interpreter_objects = {
352
: functools.partial(execute_cgi, "/usr/bin/python",
353
location_cgi_python),
355
: functools.partial(execute_cgi, None,
356
location_cgi_python),
362
def fixup_environ(req):
363
"""Assuming os.environ has been written with the CGI variables from
364
apache, make a few changes for security and correctness.
366
Does not modify req, only reads it.
369
# Comments here are on the heavy side, explained carefully for security
370
# reasons. Please read carefully before making changes.
372
# Remove DOCUMENT_ROOT and SCRIPT_FILENAME. Not part of CGI spec and
373
# exposes unnecessary details about server.
375
del env['DOCUMENT_ROOT']
378
del env['SCRIPT_FILENAME']
381
# Remove PATH. The PATH here is the path on the server machine; not useful
382
# inside the jail. It may be a good idea to add another path, reflecting
383
# the inside of the jail, but not done at this stage.
388
# Remove SCRIPT_FILENAME. Not part of CGI spec (see SCRIPT_NAME).
390
# PATH_INFO is wrong because the script doesn't physically exist.
391
# Apache makes it relative to the "serve" app. It should actually be made
392
# relative to the student's script. intepretservice does that in the jail,
393
# so here we just clear it.
394
env['PATH_INFO'] = ''
395
env['PATH_TRANSLATED'] = ''
397
# CGI specifies that REMOTE_HOST SHOULD be set, and MAY just be set to
398
# REMOTE_ADDR. Since Apache does not appear to set this, set it to
400
if 'REMOTE_HOST' not in env and 'REMOTE_ADDR' in env:
401
env['REMOTE_HOST'] = env['REMOTE_ADDR']
403
# SCRIPT_NAME is the path to the script WITHOUT PATH_INFO.
404
script_name = req.uri
405
env['SCRIPT_NAME'] = script_name
407
# SERVER_SOFTWARE is actually not Apache but IVLE, since we are
408
# custom-making the CGI request.
409
env['SERVER_SOFTWARE'] = "IVLE/" + str(ivle.conf.ivle_version)
411
# Additional environment variables
412
username = studpath.url_to_jailpaths(req.path)[0]
413
env['HOME'] = os.path.join('/home', username)
added
removed
ivle/interpret.py
