2
# Copyright (C) 2007-2008 The University of Melbourne
4
# This program is free software; you can redistribute it and/or modify
5
# it under the terms of the GNU General Public License as published by
6
# the Free Software Foundation; either version 2 of the License, or
7
# (at your option) any later version.
9
# This program is distributed in the hope that it will be useful,
10
# but WITHOUT ANY WARRANTY; without even the implied warranty of
11
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12
# GNU General Public License for more details.
14
# You should have received a copy of the GNU General Public License
15
# along with this program; if not, write to the Free Software
16
# Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
22
# Runs a student script in a safe execution environment.
24
# NOTE: This script currently disables cookies. This means students will be
25
# unable to write session-based or stateful web applications. This is done for
26
# security reasons (we do not want the students to see the IVLE cookie of
27
# whoever is visiting their pages).
28
# This can be resolved but needs careful sanitisation. See fixup_environ.
30
from common import studpath
32
from common.util import IVLEError, IVLEJailError
41
# TODO: Make progressive output work
42
# Question: Will having a large buffer size stop progressive output from
43
# working on smaller output
45
CGI_BLOCK_SIZE = 65535
50
"""Get the unix uid corresponding to the given login name.
51
If it is not in the dictionary of uids, then consult the
52
database and retrieve an update of the user table."""
58
res = conn.get_all('login', ['login', 'unixid'])
60
return (flds['login'], flds['unixid'])
61
uids = dict(map(repack,res))
65
def interpret_file(req, owner, jail_dir, filename, interpreter, gentle=True):
66
"""Serves a file by interpreting it using one of IVLE's builtin
67
interpreters. All interpreters are intended to run in the user's jail. The
68
jail location is provided as an argument to the interpreter but it is up
69
to the individual interpreters to create the jail.
71
req: An IVLE request object.
72
owner: Username of the user who owns the file being served.
73
jail_dir: Absolute path to the user's jail.
74
filename: Absolute filename within the user's jail.
75
interpreter: A function object to call.
77
# We can't test here whether or not the target file actually exists,
78
# because the apache user may not have permission. Instead we have to
79
# rely on the interpreter generating an error.
80
if filename.startswith(os.sep):
81
filename_abs = filename
82
filename_rel = filename[1:]
84
filename_abs = os.path.join(os.sep, filename)
85
filename_rel = filename
87
# Get the UID of the owner of the file
88
# (Note: files are executed by their owners, not the logged in user.
89
# This ensures users are responsible for their own programs and also
90
# allows them to be executed by the public).
93
# Split up req.path again, this time with respect to the jail
94
(working_dir, _) = os.path.split(filename_abs)
95
# jail_dir is the absolute jail directory.
96
# path is the filename relative to the user's jail.
97
# working_dir is the directory containing the file relative to the user's
99
# (Note that paths "relative" to the jail actually begin with a '/' as
100
# they are absolute in the jailspace)
102
return interpreter(uid, jail_dir, working_dir, filename_abs, req,
106
"""Stores flags regarding the state of reading CGI output.
107
If this is to be gentle, detection of invalid headers will result in an
109
def __init__(self, begentle=True):
110
self.gentle = begentle
111
self.started_cgi_body = False
112
self.got_cgi_headers = False
113
self.wrote_html_warning = False
115
self.headers = {} # Header names : values
117
def execute_cgi(interpreter, trampoline, uid, jail_dir, working_dir,
118
script_path, req, gentle):
120
trampoline: Full path on the local system to the CGI wrapper program
122
uid: User ID of the owner of the file.
123
jail_dir: Absolute path of owner's jail directory.
124
working_dir: Directory containing the script file relative to owner's
126
script_path: CGI script relative to the owner's jail.
127
req: IVLE request object.
129
The called CGI wrapper application shall be called using popen and receive
130
the HTTP body on stdin. It shall receive the CGI environment variables to
134
# Get the student program's directory and execute it from that context.
135
(tramp_dir, _) = os.path.split(trampoline)
137
# TODO: Don't create a file if the body length is known to be 0
138
# Write the HTTP body to a temporary file so it can be passed as a *real*
145
f.seek(0) # Rewind, for reading
147
# Set up the environment
148
# This automatically asks mod_python to load up the CGI variables into the
149
# environment (which is a good first approximation)
150
old_env = os.environ.copy()
151
for k in os.environ.keys():
153
for (k,v) in req.get_cgi_environ().items():
157
# usage: tramp uid jail_dir working_dir script_path
158
pid = subprocess.Popen(
159
[trampoline, str(uid), jail_dir, working_dir, interpreter,
161
stdin=f, stdout=subprocess.PIPE, stderr=subprocess.STDOUT,
164
# Restore the environment
165
for k in os.environ.keys():
167
for (k,v) in old_env.items():
170
# process_cgi_line: Reads a single line of CGI output and processes it.
171
# Prints to req, and also does fancy HTML warnings if Content-Type
173
cgiflags = CGIFlags(gentle)
175
# Read from the process's stdout into req
176
data = pid.stdout.read(CGI_BLOCK_SIZE)
178
process_cgi_output(req, data, cgiflags)
179
data = pid.stdout.read(CGI_BLOCK_SIZE)
181
# If we haven't processed headers yet, now is a good time
182
if not cgiflags.started_cgi_body:
183
process_cgi_output(req, '\n', cgiflags)
185
# If we wrote an HTML warning header, write the footer
186
if cgiflags.wrote_html_warning:
192
def process_cgi_output(req, data, cgiflags):
193
"""Processes a chunk of CGI output. data is a string of arbitrary length;
194
some arbitrary chunk of output written by the CGI script."""
195
if cgiflags.started_cgi_body:
196
if cgiflags.wrote_html_warning:
197
# HTML escape text if wrote_html_warning
198
req.write(cgi.escape(data))
202
# Break data into lines of CGI header data.
203
linebuf = cgiflags.linebuf + data
204
# First see if we can split all header data
205
# We need to get the double CRLF- or LF-terminated headers, whichever
206
# is smaller, as either sequence may appear somewhere in the body.
207
usplit = linebuf.split('\n\n', 1)
208
wsplit = linebuf.split('\r\n\r\n', 1)
209
split = len(usplit[0]) > len(wsplit[0]) and wsplit or usplit
211
# Haven't seen all headers yet. Buffer and come back later.
212
cgiflags.linebuf = linebuf
217
cgiflags.linebuf = ""
218
cgiflags.started_cgi_body = True
219
# Process all the header lines
220
split = headers.split('\r\n', 1)
222
split = headers.split('\n', 1)
224
process_cgi_header_line(req, split[0], cgiflags)
225
if len(split) == 1: break
227
if cgiflags.wrote_html_warning:
228
# We're done with headers. Treat the rest as data.
229
data = headers + '\n' + data
231
split = headers.split('\r\n', 1)
233
split = headers.split('\n', 1)
235
# Is this an internal IVLE error condition?
236
hs = cgiflags.headers
237
if 'X-IVLE-Error-Type' in hs:
238
t = hs['X-IVLE-Error-Type']
239
if t == IVLEError.__name__:
240
raise IVLEError(int(hs['X-IVLE-Error-Code']),
241
hs['X-IVLE-Error-Message'])
244
raise IVLEJailError(hs['X-IVLE-Error-Type'],
245
hs['X-IVLE-Error-Message'],
246
hs['X-IVLE-Error-Info'])
248
raise IVLEError(500, 'bad error headers written by CGI')
250
# Check to make sure the required headers were written
251
if cgiflags.wrote_html_warning or not cgiflags.gentle:
252
# We already reported an error, that's enough
254
elif "Content-Type" in cgiflags.headers:
256
elif "Location" in cgiflags.headers:
257
if ("Status" in cgiflags.headers and req.status >= 300
258
and req.status < 400):
261
message = """You did not write a valid status code for
262
the given location. To make a redirect, you may wish to try:</p>
263
<pre style="margin-left: 1em">Status: 302 Found
264
Location: <redirect address></pre>"""
265
write_html_warning(req, message)
266
cgiflags.wrote_html_warning = True
268
message = """You did not print a Content-Type header.
269
CGI requires that you print a "Content-Type". You may wish to try:</p>
270
<pre style="margin-left: 1em">Content-Type: text/html</pre>"""
271
write_html_warning(req, message)
272
cgiflags.wrote_html_warning = True
274
# Call myself to flush out the extra bit of data we read
275
process_cgi_output(req, data, cgiflags)
277
def process_cgi_header_line(req, line, cgiflags):
278
"""Process a line of CGI header data. line is a string representing a
279
complete line of text, stripped and without the newline.
282
name, value = line.split(':', 1)
284
# If we are being gentle, we want to help the user understand what
285
# went wrong. Otherwise, we bail out.
286
if not cgiflags.gentle:
288
# No colon. The user did not write valid headers.
289
if len(cgiflags.headers) == 0:
290
# First line was not a header line. We can assume this is not
292
message = """You did not print a CGI header.
293
CGI requires that you print a "Content-Type". You may wish to try:</p>
294
<pre style="margin-left: 1em">Content-Type: text/html</pre>"""
296
# They printed some header at least, but there was an invalid
298
message = """You printed an invalid CGI header. You need to leave
299
a blank line after the headers, before writing the page contents."""
300
write_html_warning(req, message)
301
cgiflags.wrote_html_warning = True
302
# Handle the rest of this line as normal data
303
process_cgi_output(req, line + '\n', cgiflags)
307
value = value.strip()
308
if name == "Content-Type":
309
req.content_type = value
310
elif name == "Location":
312
elif name == "Status":
313
# Must be an integer, followed by a space, and then the status line
314
# which we ignore (seems like Apache has no way to send a custom
317
req.status = int(value.split(' ', 1)[0])
319
if not cgiflags.gentle:
320
# This isn't user code, so it should be good.
321
# Get us out of here!
323
message = """The "Status" CGI header was invalid. You need to
324
print a number followed by a message, such as "302 Found"."""
325
write_html_warning(req, message)
326
cgiflags.wrote_html_warning = True
327
# Handle the rest of this line as normal data
328
process_cgi_output(req, line + '\n', cgiflags)
330
# Generic HTTP header
331
# FIXME: Security risk letting users write arbitrary headers?
332
req.headers_out[name] = value
333
cgiflags.headers[name] = value
335
def write_html_warning(req, text):
336
"""Prints an HTML warning about invalid CGI interaction on the part of the
337
user. text may contain HTML markup."""
338
req.content_type = "text/html"
339
req.write("""<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
340
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
341
<html xmlns="http://www.w3.org/1999/xhtml">
343
<meta http-equiv="Content-Type"
344
content="text/html; charset=utf-8" />
346
<body style="margin: 0; padding: 0; font-family: sans-serif;">
347
<div style="background-color: #faa; border-bottom: 1px solid black;
349
<p><strong>Warning</strong>: %s
351
<div style="margin: 8px;">
355
location_cgi_python = os.path.join(conf.ivle_install_dir,
358
# Mapping of interpreter names (as given in conf/app/server.py) to
359
# interpreter functions.
361
interpreter_objects = {
363
: functools.partial(execute_cgi, "/usr/bin/python",
364
location_cgi_python),
370
def fixup_environ(req):
371
"""Assuming os.environ has been written with the CGI variables from
372
apache, make a few changes for security and correctness.
374
Does not modify req, only reads it.
377
# Comments here are on the heavy side, explained carefully for security
378
# reasons. Please read carefully before making changes.
380
# Remove HTTP_COOKIE. It is a security risk to have students see the IVLE
381
# cookie of their visitors.
383
del env['HTTP_COOKIE']
386
# Remove DOCUMENT_ROOT and SCRIPT_FILENAME. Not part of CGI spec and
387
# exposes unnecessary details about server.
389
del env['DOCUMENT_ROOT']
392
del env['SCRIPT_FILENAME']
395
# Remove PATH. The PATH here is the path on the server machine; not useful
396
# inside the jail. It may be a good idea to add another path, reflecting
397
# the inside of the jail, but not done at this stage.
402
# Remove SCRIPT_FILENAME. Not part of CGI spec (see SCRIPT_NAME).
404
# PATH_INFO is wrong because the script doesn't physically exist.
405
# Apache makes it relative to the "serve" app. It should actually be made
406
# relative to the student's script.
407
# TODO: At this stage, it is not possible to add a path after the script,
408
# so PATH_INFO is always "".
410
env['PATH_INFO'] = path_info
412
# PATH_TRANSLATED currently points to a non-existant location within the
413
# local web server directory. Instead make it represent a path within the
415
(username, _, path_translated) = studpath.url_to_jailpaths(req.path)
416
if len(path_translated) == 0 or path_translated[0] != os.sep:
417
path_translated = os.sep + path_translated
418
env['PATH_TRANSLATED'] = path_translated
420
# CGI specifies that REMOTE_HOST SHOULD be set, and MAY just be set to
421
# REMOTE_ADDR. Since Apache does not appear to set this, set it to
423
if 'REMOTE_HOST' not in env and 'REMOTE_ADDR' in env:
424
env['REMOTE_HOST'] = env['REMOTE_ADDR']
426
# SCRIPT_NAME is the path to the script WITHOUT PATH_INFO.
427
script_name = req.uri
428
if len(path_info) > 0:
429
script_name = script_name[:-len(path_info)]
430
env['SCRIPT_NAME'] = script_name
432
# SERVER_SOFTWARE is actually not Apache but IVLE, since we are
433
# custom-making the CGI request.
434
env['SERVER_SOFTWARE'] = "IVLE/" + str(conf.ivle_version)
436
# Additional environment variables
437
env['HOME'] = os.path.join('/home', username)
added
removed
lib/common/interpret.py
