# Copyright (c) 2017 D. Richard Hipp
#
# This program is free software; you can redistribute it and/or
# modify it under the terms of the Simplified BSD License (also
# known as the "2-Clause License" or "FreeBSD License".)
#
# This program is distributed in the hope that it will be useful,
# but without any warranty; without even the implied warranty of
# merchantability or fitness for a particular purpose.
#
#---------------------------------------------------------------------------
#
# Design rules:
#
# (1) All identifiers in the global namespace begin with "w3"
#
# (2) Indentifiers intended for internal use only begin with "w3Int"
#
package require Tcl 8.6
# Add text to the end of the HTTP reply. No interpretation or transformation
# of the text is performs. The argument should be enclosed within {...}
#
proc w3 {txt} {
global w3
dict append w3 .reply $txt
}
# Add text to the page under construction. Do no escaping on the text.
#
# Though "unsafe" in general, there are uses for this kind of thing.
# For example, if you want to return the complete, unmodified content of
# a file:
#
# set fd [open content.html rb]
# w3-unsafe [read $fd]
# close $fd
#
# You could do the same thing using ordinary "w3" instead of "w3-unsafe".
# The difference is that w3-safety-check will complain about the misuse
# of "w3", but it assumes that the person who write "w3-unsafe" understands
# the risks.
#
# Though occasionally necessary, the use of this interface should be minimized.
#
proc w3-unsafe {txt} {
global w3
dict append w3 .reply $txt
}
# Add text to the end of the reply under construction. The following
# substitutions are made:
#
# %html(...) Escape text for inclusion in HTML
# %url(...) Escape text for use as a URL
# %qp(...) Escape text for use as a URI query parameter
# %string(...) Escape text for use within a JSON string
# %unsafe(...) No transformations of the text
#
# The substitutions above terminate at the first ")" character. If the
# text of the TCL string in ... contains ")" characters itself, use instead:
#
# %html%(...)%
# %url%(...)%
# %qp%(...)%
# %string%(...)%
# %unsafe%(...)%
#
# In other words, use "%(...)%" instead of "(...)" to include the TCL string
# to substitute.
#
# The %unsafe substitution should be avoided whenever possible, obviously.
# In addition to the substitutions above, the text also does backslash
# escapes.
#
# The w3-trim proc works the same as w3-subst except that it also removes
# whitespace from the left margin, so that the generated HTML/CSS/Javascript
# does not appear to be indented when delivered to the client web browser.
#
if {$tcl_version>=8.7} {
proc w3-subst {txt} {
global w3
regsub -all -command \
{%(html|url|qp|string|unsafe){1,1}?(|%)\((.+)\)\2} $txt w3Int-enc txt
dict append w3 .reply [subst -novariables -nocommand $txt]
}
proc w3-trim {txt} {
global w3
regsub -all {\n\s+} [string trim $txt] \n txt
regsub -all -command \
{%(html|url|qp|string|unsafe){1,1}?(|%)\((.+)\)\2} $txt w3Int-enc txt
dict append w3 .reply [subst -novariables -nocommand $txt]
}
proc w3Int-enc {all mode nu1 txt} {
return [uplevel 2 "w3Int-enc-$mode \"$txt\""]
}
} else {
proc w3-subst {txt} {
global w3
regsub -all {%(html|url|qp|string|unsafe){1,1}?(|%)\((.+)\)\2} $txt \
{[w3Int-enc-\1 "\3"]} txt
dict append w3 .reply [uplevel 1 [list subst -novariables $txt]]
}
proc w3-trim {txt} {
global w3
regsub -all {\n\s+} [string trim $txt] \n txt
regsub -all {%(html|url|qp|string|unsafe){1,1}?(|%)\((.+)\)\2} $txt \
{[w3Int-enc-\1 "\3"]} txt
dict append w3 .reply [uplevel 1 [list subst -novariables $txt]]
}
}
# There must be a w3Int-enc-NAME routine for each possible substitution
# in w3-subst. Thus there are routines for "html", "url", "qp", and "unsafe".
#
# w3Int-enc-html Escape text so that it is safe to use in the
# body of an HTML document.
#
# w3Int-enc-url Escape text so that it is safe to pass as an
# argument to href= and src= attributes in HTML.
#
# w3Int-enc-qp Escape text so that it is safe to use as the
# value of a query parameter in a URL or in
# post data or in a cookie.
#
# w3Int-enc-string Escape ", ', \, and < for using inside of a
# javascript string literal. The < character
# is escaped to prevent "</script>" from causing
# problems in embedded javascript.
#
# w3Int-enc-unsafe Perform no encoding at all. Unsafe.
#
proc w3Int-enc-html {txt} {
return [string map {& & < < > > \" " \\ \} $txt]
}
proc w3Int-enc-unsafe {txt} {
return $txt
}
proc w3Int-enc-url {s} {
if {[regsub -all {[^-{}\\@~?=#_.:/a-zA-Z0-9]} $s {[w3Int-%HHchar {&}]} s]} {
set s [subst -novar -noback $s]
}
if {[regsub -all {[\\{}]} $s {[w3Int-%HHchar \\&]} s]} {
set s [subst -novar -noback $s]
}
return $s
}
proc w3Int-enc-qp {s} {
if {[regsub -all {[^-{}\\_.a-zA-Z0-9]} $s {[w3Int-%HHchar {&}]} s]} {
set s [subst -novar -noback $s]
}
if {[regsub -all {[\\{}]} $s {[w3Int-%HHchar \\&]} s]} {
set s [subst -novar -noback $s]
}
return $s
}
proc w3Int-enc-string {s} {
return [string map {\\ \\\\ \" \\\" ' \\' < \\u003c \n \\n \r \\r
\f \\f \t \\t \x01 \\u0001 \x02 \\u0002 \x03 \\u0003
\x04 \\u0004 \x05 \\u0005 \x06 \\u0006 \x07 \\u0007
\x0b \\u000b \x0e \\u000e \x0f \\u000f \x10 \\u0010
\x11 \\u0011 \x12 \\u0012 \x13 \\u0013 \x14 \\u0014
\x15 \\u0015 \x16 \\u0016 \x17 \\u0017 \x18 \\u0018
\x19 \\u0019 \x1a \\u001a \x1b \\u001b \x1c \\u001c
\x1d \\u001d \x1e \\u001e \x1f \\u001f} $s]
}
# This is a helper routine for w3Int-enc-url and w3Int-enc-qp. It returns
# an appropriate %HH encoding for the single character c. If c is a unicode
# character, then this routine might return multiple bytes: %HH%HH%HH
#
proc w3Int-%HHchar {c} {
if {$c==" "} {return +}
return [regsub -all .. [binary encode hex [encoding convertto utf-8 $c]] {%&}]
}
# Undo the www-url-encoded format.
#
# HT: This code stolen from ncgi.tcl
#
proc w3Int-decode-url {str} {
set str [string map [list + { } "\\" "\\\\" \[ \\\[ \] \\\]] $str]
regsub -all -- \
{%([Ee][A-Fa-f0-9])%([89ABab][A-Fa-f0-9])%([89ABab][A-Fa-f0-9])} \
$str {[encoding convertfrom utf-8 [binary decode hex \1\2\3]]} str
regsub -all -- \
{%([CDcd][A-Fa-f0-9])%([89ABab][A-Fa-f0-9])} \
$str {[encoding convertfrom utf-8 [binary decode hex \1\2]]} str
regsub -all -- {%([0-7][A-Fa-f0-9])} $str {\\u00\1} str
return [subst -novar $str]
}
# Reset the document back to an empty string.
#
proc w3-reset {} {
global w3
dict set w3 .reply {}
}
# Change the mime-type of the result document.
#
proc w3-mimetype {x} {
global w3
dict set w3 .mimetype $x
}
# Change the reply code.
#
proc w3-reply-code {x} {
global w3
dict set w3 .reply-code $x
}
# Set a cookie
#
proc w3-set-cookie {name value} {
global w3
dict lappend w3 .new-cookies $name $value
}
# Unset a cookie
#
proc w3-clear-cookie {name} {
w3-set-cookie $name {}
}
# Add extra entries to the reply header
#
proc w3-reply-extra {name value} {
global w3
dict lappend w3 .reply-extra $name $value
}
# Specifies how the web-page under construction should be cached.
# The argument should be one of:
#
# no-cache
# max-age=N (for some integer number of seconds, N)
# private,max-age=N
#
proc w3-cache-control {x} {
w3-reply-extra Cache-Control $x
}
# Redirect to a different web page
#
proc w3-redirect {uri} {
w3-reset
w3-reply-code {303 Redirect}
w3-reply-extra Location $uri
}
# Return the value of a w3 parameter
#
proc w3-param {name {dflt {}}} {
global w3
if {![dict exists $w3 $name]} {return $dflt}
return [dict get $w3 $name]
}
# Return true if a and only if the w3 parameter $name exists
#
proc w3-param-exists {name} {
global w3
return [dict exists $w3 $name]
}
# Set the value of a w3 parameter
#
proc w3-set-param {name value} {
global w3
dict set w3 $name $value
}
# Return all parameter names that match the GLOB pattern, or all
# names if the GLOB pattern is omitted.
#
proc w3-param-list {{glob {*}}} {
global w3
return [dict keys $w3 $glob]
}
# By default, W3 does not decode query parameters and POST parameters
# for cross-origin requests. This is a security restriction, designed to
# help prevent cross-site request forgery (CSRF) attacks.
#
# As a consequence of this restriction, URLs for sites generated by W3
# that contain query parameters will not work as URLs found in other
# websites. You cannot create a link from a second website into a W3
# website if the link contains query planner, by default.
#
# Of course, it is sometimes desirable to allow query parameters on external
# links. For URLs for which this is safe, the application should invoke
# w3-allow-xorigin-params. This procedure tells W3 that it is safe to
# go ahead and decode the query parameters even for cross-site requests.
#
# In other words, for W3 security is the default setting. Individual pages
# need to actively disable the cross-site request security if those pages
# are safe for cross-site access.
#
proc w3-allow-xorigin-params {} {
global w3
if {![dict exists $w3 .qp] && ![dict get $w3 SAME_ORIGIN]} {
w3Int-decode-query-params
}
}
# Set the content-security-policy.
#
# The default content-security-policy is very strict: "default-src 'self'"
# The default policy prohibits the use of in-line javascript or CSS.
#
# Provide an alternative CSP as the argument. Or use "off" to disable
# the CSP completely.
#
proc w3-content-security-policy {val} {
global w3
if {$val=="off"} {
dict unset w3 .csp
} else {
dict set w3 .csp $val
}
}
# Examine the bodys of all procedures in this program looking for
# unsafe calls to various W3 interfaces. Return a text string
# containing warnings. Return an empty string if all is ok.
#
# This routine is advisory only. It misses some constructs that are
# dangerous and flags others that are safe.
#
proc w3-safety-check {} {
set res {}
foreach p [info command] {
set ln 0
foreach x [split [info body $p] \n] {
incr ln
if {[regexp {^[ \t]*w3[ \t]+([^\n]+)} $x all tail]
&& [string index $tail 0]!="\173"
&& [regexp {[[$]} $tail]
} {
append res "$p:$ln: unsafe \"w3\" call: \"[string trim $x]\"\n"
}
if {[regexp {^[ \t]*w3-(subst|trim)[ \t]+[^\173]} $x all cx]} {
append res "$p:$ln: unsafe \"w3-$cx\" call: \"[string trim $x]\"\n"
}
}
}
return $res
}
# Return a string that descripts the current environment. Applications
# might find this useful for debugging.
#
proc w3-debug-env {} {
global w3
set out {}
foreach var [lsort [dict keys $w3]] {
if {[string index $var 0]=="."} continue
append out "$var = [list [dict get $w3 $var]]\n"
}
append out "\[pwd\] = [list [pwd]]\n"
return $out
}
# Tracing function for each HTTP request. This is overridden by w3-start
# if tracing is enabled.
#
proc w3Int-trace {} {}
# Start up a listening socket. Arrange to invoke w3Int-new-connection
# for each inbound HTTP connection.
#
# port Listen on this TCP port. 0 means to select a port
# that is not currently in use
#
# w3mode One of "scgi", "remote-scgi", "server", or "local".
#
# fromip If not {}, then reject all requests from IP addresses
# other than $fromip
#
proc w3Int-start-listener {port w3mode fromip} {
if {[string match *scgi $w3mode]} {
set type SCGI
set server [list w3Int-new-connection \
w3Int-scgi-readable $w3mode $fromip]
} else {
set type HTTP
set server [list w3Int-new-connection \
w3Int-http-readable $w3mode $fromip]
}
if {$w3mode=="local" || $w3mode=="scgi"} {
set x [socket -server $server -myaddr 127.0.0.1 $port]
} else {
set x [socket -server $server $port]
}
set coninfo [chan configure $x -sockname]
set port [lindex $coninfo 2]
if {$w3mode=="local"} {
w3Int-start-browser http://127.0.0.1:$port/
} elseif {$fromip!=""} {
puts "Listening for $type requests on TCP port $port from IP $fromip"
} else {
puts "Listening for $type requests on TCP port $port"
}
}
# Start a web-browser and point it at $URL
#
proc w3Int-start-browser {url} {
global tcl_platform
if {$tcl_platform(platform)=="windows"} {
exec cmd /c start $url &
} elseif {$tcl_platform(os)=="Darwin"} {
exec open $url &
} elseif {[catch {exec -ignorestderr xdg-open $url}]} {
exec firefox $url &
}
}
# This routine is a "socket -server" callback. The $chan, $ip, and $port
# arguments are added by the socket command.
#
# Arrange to invoke $callback when content is available on the new socket.
# The $callback will process inbound HTTP or SCGI content. Reject the
# request if $fromip is not an empty string and does not match $ip.
#
proc w3Int-new-connection {callback w3mode fromip chan ip port} {
upvar #0 w3Int-$chan W
if {$fromip!="" && ![string match $fromip $ip]} {
close $chan
return
}
set W [dict create REMOTE_ADDR $ip REMOTE_PORT $port W3_MODE $w3mode \
.header {}]
fconfigure $chan -blocking 0 -translation binary
fileevent $chan readable [list $callback $chan]
}
# Close an input channel
#
proc w3Int-close-channel {chan} {
if {$chan=="stdout"} {
# This happens after completing a CGI request
exit 0
} else {
unset ::w3Int-$chan
close $chan
}
}
# Process new text received on an inbound HTTP request
#
proc w3Int-http-readable {chan} {
if {[catch [list w3Int-http-readable-unsafe $chan] msg]} {
puts stderr "$msg\n$::errorInfo"
w3Int-close-channel $chan
}
}
proc w3Int-http-readable-unsafe {chan} {
upvar #0 w3Int-$chan W w3 w3
if {![dict exists $W .toread]} {
# If the .toread key is not set, that means we are still reading
# the header
set line [string trimright [gets $chan]]
set n [string length $line]
if {$n>0} {
if {[dict get $W .header]=="" || [regexp {^\s+} $line]} {
dict append W .header $line
} else {
dict append W .header \n$line
}
if {[string length [dict get $W .header]]>100000} {
error "HTTP request header too big - possible DOS attack"
}
} elseif {$n==0} {
# We have reached the blank line that terminates the header.
global argv0
if {[info exists ::argv0]} {
set a0 [file normalize $argv0]
} else {
set a0 /
}
dict set W SCRIPT_FILENAME $a0
dict set W DOCUMENT_ROOT [file dir $a0]
if {[w3Int-parse-header $chan]} {
catch {close $chan}
return
}
set len 0
if {[dict exists $W CONTENT_LENGTH]} {
set len [dict get $W CONTENT_LENGTH]
}
if {$len>0} {
# Still need to read the query content
dict set W .toread $len
} else {
# There is no query content, so handle the request immediately
set w3 $W
w3Int-handle-request $chan
}
}
} else {
# If .toread is set, that means we are reading the query content.
# Continue reading until .toread reaches zero.
set got [read $chan [dict get $W .toread]]
dict append W CONTENT $got
dict set W .toread [expr {[dict get $W .toread]-[string length $got]}]
if {[dict get $W .toread]<=0} {
# Handle the request as soon as all the query content is received
set w3 $W
w3Int-handle-request $chan
}
}
}
# Decode the HTTP request header.
#
# This routine is always running inside of a [catch], so if
# any problems arise, simply raise an error.
#
proc w3Int-parse-header {chan} {
upvar #0 w3Int-$chan W
set hdr [split [dict get $W .header] \n]
if {$hdr==""} {return 1}
set req [lindex $hdr 0]
dict set W REQUEST_METHOD [set method [lindex $req 0]]
if {[lsearch {GET HEAD POST} $method]<0} {
error "unsupported request method: \"[dict get $W REQUEST_METHOD]\""
}
set uri [lindex $req 1]
dict set W REQUEST_URI $uri
set split_uri [split $uri ?]
set uri0 [lindex $split_uri 0]
if {![regexp {^/[-.a-z0-9_/]*$} $uri0]} {
error "invalid request uri: \"$uri0\""
}
dict set W PATH_INFO $uri0
set uri1 [lindex $split_uri 1]
dict set W QUERY_STRING $uri1
set n [llength $hdr]
for {set i 1} {$i<$n} {incr i} {
set x [lindex $hdr $i]
if {![regexp {^(.+): +(.*)$} $x all name value]} {
error "invalid header line: \"$x\""
}
set name [string toupper $name]
switch -- $name {
REFERER {set name HTTP_REFERER}
USER-AGENT {set name HTTP_USER_AGENT}
CONTENT-LENGTH {set name CONTENT_LENGTH}
CONTENT-TYPE {set name CONTENT_TYPE}
HOST {set name HTTP_HOST}
COOKIE {set name HTTP_COOKIE}
ACCEPT-ENCODING {set name HTTP_ACCEPT_ENCODING}
default {set name .hdr:$name}
}
dict set W $name $value
}
return 0
}
# Decode the QUERY_STRING parameters from a GET request or the
# application/x-www-form-urlencoded CONTENT from a POST request.
#
# This routine sets the ".qp" element of the ::w3 dict as a signal
# that query parameters have already been decoded.
#
proc w3Int-decode-query-params {} {
global w3
dict set w3 .qp 1
if {[dict exists $w3 QUERY_STRING]} {
foreach qterm [split [dict get $w3 QUERY_STRING] &] {
set qsplit [split $qterm =]
set nm [lindex $qsplit 0]
if {[regexp {^[a-z][a-z0-9]*$} $nm]} {
dict set w3 $nm [w3Int-decode-url [lindex $qsplit 1]]
}
}
}
if {[dict exists $w3 CONTENT_TYPE] && [dict exists $w3 CONTENT]} {
set ctype [dict get $w3 CONTENT_TYPE]
if {$ctype=="application/x-www-form-urlencoded"} {
foreach qterm [split [string trim [dict get $w3 CONTENT]] &] {
set qsplit [split $qterm =]
set nm [lindex $qsplit 0]
if {[regexp {^[a-z][-a-z0-9_]*$} $nm]} {
dict set w3 $nm [w3Int-decode-url [lindex $qsplit 1]]
}
}
} elseif {[string match multipart/form-data* $ctype]} {
regexp {^(.*?)\r\n(.*)$} [dict get $w3 CONTENT] all divider body
set ndiv [string length $divider]
while {[string length $body]} {
set idx [string first $divider $body]
set unit [string range $body 0 [expr {$idx-3}]]
set body [string range $body [expr {$idx+$ndiv+2}] end]
if {[regexp {^Content-Disposition: form-data; (.*?)\r\n\r\n(.*)$} \
$unit unit hdr content]} {
if {[regexp {name="(.*)"; filename="(.*)"\r\nContent-Type: (.*?)$}\
$hdr hr name filename mimetype]
&& [regexp {^[a-z][a-z0-9]*$} $name]} {
dict set w3 $name.filename \
[string map [list \\\" \" \\\\ \\] $filename]
dict set w3 $name.mimetype $mimetype
dict set w3 $name.content $content
} elseif {[regexp {name="(.*)"} $hdr hr name]
&& [regexp {^[a-z][a-z0-9]*$} $name]} {
dict set w3 $name $content
}
}
}
}
}
}
# Invoke application-supplied methods to generate a reply to
# a single HTTP request.
#
# This routine uses the global variable ::w3 and so must not be nested.
# It must run to completion before the next instance runs. If a recursive
# instances of this routine starts while another is running, the the
# recursive instance is added to a queue to be invoked after the current
# instance finishes. Yes, this means that W3 IS SINGLE THREADED. Only
# a single page rendering instance my be running at a time. There can
# be multiple HTTP requests inbound at once, but only one my be processed
# at a time once the request is full read and parsed.
#
set w3IntPending {}
set w3IntLock 0
proc w3Int-handle-request {chan} {
global w3IntPending w3IntLock
fileevent $chan readable {}
if {$w3IntLock} {
# Another instance of request is already running, so defer this one
lappend w3IntPending [list w3Int-handle-request $chan]
return
}
set w3IntLock 1
catch [list w3Int-handle-request-unsafe $chan]
set w3IntLock 0
if {[llength $w3IntPending]>0} {
# If there are deferred requests, then launch the oldest one
after idle [lindex $w3IntPending 0]
set w3IntPending [lrange $w3IntPending 1 end]
}
}
proc w3Int-handle-request-unsafe {chan} {
global w3
dict set w3 .reply {}
dict set w3 .mimetype {text/html; charset=utf-8}
dict set w3 .reply-code {200 Ok}
dict set w3 .csp {default-src 'self'}
# Set up additional CGI environment values
#
if {![dict exists $w3 HTTP_HOST]} {
dict set w3 BASE_URL {}
} elseif {[dict exists $w3 HTTPS]} {
dict set w3 BASE_URL https://[dict get $w3 HTTP_HOST]
} else {
dict set w3 BASE_URL http://[dict get $w3 HTTP_HOST]
}
if {![dict exists $w3 REQUEST_URI]} {
dict set w3 REQUEST_URI /
}
if {[dict exists $w3 SCRIPT_NAME]} {
dict append w3 BASE_URL [dict get $w3 SCRIPT_NAME]
} else {
dict set w3 SCRIPT_NAME {}
}
if {![dict exists $w3 PATH_INFO]} {
# If PATH_INFO is missing (ex: nginx) then construct it
set URI [dict get $w3 REQUEST_URI]
regsub {\?.*} $URI {} URI
set skip [string length [dict get $w3 SCRIPT_NAME]]
dict set w3 PATH_INFO [string range $URI $skip end]
}
if {[regexp {^/([^/]+)(.*)$} [dict get $w3 PATH_INFO] all head tail]} {
dict set w3 PATH_HEAD $head
dict set w3 PATH_TAIL [string trimleft $tail /]
} else {
dict set w3 PATH_INFO {}
dict set w3 PATH_HEAD {}
dict set w3 PATH_TAIL {}
}
dict set w3 SELF_URL [dict get $w3 BASE_URL]/[dict get $w3 PATH_HEAD]
# Parse query parameters from the query string, the cookies, and
# POST data
#
if {[dict exists $w3 HTTP_COOKIE]} {
foreach qterm [split [dict get $w3 HTTP_COOKIE] {;}] {
set qsplit [split [string trim $qterm] =]
set nm [lindex $qsplit 0]
if {[regexp {^[a-z][-a-z0-9_]*$} $nm]} {
dict set w3 $nm [w3Int-decode-url [lindex $qsplit 1]]
}
}
}
set same_origin 0
if {[dict exists $w3 HTTP_REFERER]} {
set referer [dict get $w3 HTTP_REFERER]
set base [dict get $w3 BASE_URL]
if {$referer==$base || [string match $base/* $referer]} {
set same_origin 1
}
}
dict set w3 SAME_ORIGIN $same_origin
if {$same_origin} {
w3Int-decode-query-params
}
# Invoke the application-defined handler procedure for this page
# request. If an error occurs while running that procedure, generate
# an HTTP reply that contains the error message.
#
w3-before-dispatch-hook
w3Int-trace
set mname [dict get $w3 PATH_HEAD]
if {[catch {
if {$mname!="" && [llength [info command w3-page-$mname]]>0} {
w3-page-$mname
} else {
w3-default
}
} msg]} {
if {[w3-param W3_MODE]=="local" || [w3-param W3_MODE]=="server"} {
puts "ERROR: $::errorInfo"
}
w3-reset
w3-reply-code "500 Internal Server Error"
w3-mimetype text/html
w3-trim {
<h1>W3 Application Error</h1>
<pre>%html($::errorInfo)</pre>
}
dict unset w3 .new-cookies
}
w3-before-reply-hook
# Transmit the HTTP reply
#
set rc [dict get $w3 .reply-code]
if {$rc=="ABORT"} {
# If the page handler invokes "w3-reply-code ABORT" then close the
# TCP/IP connection without sending any reply
w3Int-close-channel $chan
return
} elseif {$chan=="stdout"} {
puts $chan "Status: $rc\r"
} else {
puts $chan "HTTP/1.1 $rc\r"
puts $chan "Server: w3\r"
puts $chan "Connection: close\r"
}
if {[dict exists $w3 .reply-extra]} {
foreach {name value} [dict get $w3 .reply-extra] {
puts $chan "$name: $value\r"
}
}
if {[dict exists $w3 .csp]} {
puts $chan "Content-Security-Policy: [dict get $w3 .csp]\r"
}
set mimetype [dict get $w3 .mimetype]
puts $chan "Content-Type: $mimetype\r"
if {[dict exists $w3 .new-cookies]} {
foreach {nm val} [dict get $w3 .new-cookies] {
if {[regexp {^[a-z][-a-z0-9_]*$} $nm]} {
if {$val==""} {
puts $chan "Set-Cookie: $nm=; HttpOnly; Path=/; Max-Age=1\r"
} else {
set val [w3Int-enc-url $val]
puts $chan "Set-Cookie: $nm=$val; HttpOnly; Path=/\r"
}
}
}
}
if {[string match text/* $mimetype]} {
set reply [encoding convertto utf-8 [dict get $w3 .reply]]
if {[regexp {\ygzip\y} [w3-param HTTP_ACCEPT_ENCODING]]} {
catch {w3Int-gzip-reply reply chan}
}
} else {
set reply [dict get $w3 .reply]
}
puts $chan "Content-Length: [string length $reply]\r"
puts $chan \r
puts -nonewline $chan $reply
flush $chan
w3Int-close-channel $chan
}
# Compress the reply content
#
proc w3Int-gzip-reply {replyVar chanVar} {
upvar $replyVar reply $chanVar chan
set x [zlib gzip $reply]
set reply $x
puts $chan "Content-Encoding: gzip\r"
}
# This routine runs just prior to request-handler dispatch. The
# default implementation is a no-op, but applications can override
# to do additional transformations or checks.
#
proc w3-before-dispatch-hook {} {return}
# This routine runs after the request-handler dispatch and just
# before the reply is generated. The default implementation is
# a no-op, but applications can override to do validation and security
# checks on the reply, such as verifying that no sensitive information
# such as an API key or password is accidentally included in the
# reply text.
#
proc w3-before-reply-hook {} {return}
# Process a single CGI request
#
proc w3Int-handle-cgi-request {} {
global w3 env
foreach key [array names env {[A-Z]*}] {dict set w3 $key $env($key)}
set len 0
if {[dict exists $w3 CONTENT_LENGTH]} {
set len [dict get $w3 CONTENT_LENGTH]
}
if {$len>0} {
fconfigure stdin -translation binary
dict set w3 CONTENT [read stdin $len]
}
dict set w3 W3_MODE cgi
fconfigure stdout -translation binary
w3Int-handle-request-unsafe stdout
}
# Process new text received on an inbound SCGI request
#
proc w3Int-scgi-readable {chan} {
if {[catch [list w3Int-scgi-readable-unsafe $chan] msg]} {
puts stderr "$msg\n$::errorInfo"
w3Int-close-channel $chan
}
}
proc w3Int-scgi-readable-unsafe {chan} {
upvar #0 w3Int-$chan W w3 w3
if {![dict exists $W .toread]} {
# If the .toread key is not set, that means we are still reading
# the header.
#
# An SGI header is short. This implementation assumes the entire
# header is available all at once.
#
dict set W .remove_addr [dict get $W REMOTE_ADDR]
set req [read $chan 15]
set n [string length $req]
scan $req %d:%s len hdr
incr len [string length "$len:,"]
append hdr [read $chan [expr {$len-15}]]
foreach {nm val} [split $hdr \000] {
if {$nm==","} break
dict set W $nm $val
}
set len 0
if {[dict exists $W CONTENT_LENGTH]} {
set len [dict get $W CONTENT_LENGTH]
}
if {$len>0} {
# Still need to read the query content
dict set W .toread $len
} else {
# There is no query content, so handle the request immediately
dict set W SERVER_ADDR [dict get $W .remove_addr]
set w3 $W
w3Int-handle-request $chan
}
} else {
# If .toread is set, that means we are reading the query content.
# Continue reading until .toread reaches zero.
set got [read $chan [dict get $W .toread]]
dict append W CONTENT $got
dict set W .toread [expr {[dict get $W .toread]-[string length $got]}]
if {[dict get $W .toread]<=0} {
# Handle the request as soon as all the query content is received
dict set W SERVER_ADDR [dict get $W .remove_addr]
set w3 $W
w3Int-handle-request $chan
}
}
}
# Start up the w3 framework. Parameters are a list passed as the
# single argument.
#
# -server $PORT Listen for HTTP requests on this TCP port $PORT
#
# -local $PORT Listen for HTTP requests on 127.0.0.1:$PORT
#
# -scgi $PORT Listen for SCGI requests on 127.0.0.1:$PORT
#
# -remote-scgi $PORT Listen for SCGI requests on TCP port $PORT
#
# -cgi Handle a single CGI request
#
# With no arguments, the behavior is called "auto". In "auto" mode,
# if the GATEWAY_INTERFACE environment variable indicates CGI, then run
# as CGI. Otherwise, start an HTTP server bound to the loopback address
# only, on an arbitrary TCP port, and automatically launch a web browser
# on that TCP port.
#
# Additional options:
#
# -fromip GLOB Reject any incoming request where the remote
# IP address does not match the GLOB pattern. This
# value defaults to '127.0.0.1' for -local and -scgi.
#
# -nowait Do not wait in the event loop. Return immediately
# after all event handlers are established.
#
# -trace "puts" each request URL as it is handled, for
# debugging
#
# -debug Disable content compression
#
# -lint Run w3-safety-check on the application instead
# of running the application itself
#
# -Dvar=value Set TCL global variable "var" to "value"
#
#
proc w3-start {arglist} {
global env
set mode auto
set port 0
set nowait 0
set fromip {}
set n [llength $arglist]
for {set i 0} {$i<$n} {incr i} {
set term [lindex $arglist $i]
if {[string match --* $term]} {set term [string range $term 1 end]}
switch -glob -- $term {
-server {
incr i;
set mode "server"
set port [lindex $arglist $i]
}
-local {
incr i;
set mode "local"
set fromip 127.0.0.1
set port [lindex $arglist $i]
}
-scgi {
incr i;
set mode "scgi"
set fromip 127.0.0.1
set port [lindex $arglist $i]
}
-remote-scgi {
incr i;
set mode "remote-scgi"
set port [lindex $arglist $i]
}
-cgi {
set mode "cgi"
}
-fromip {
incr i
set fromip [lindex $arglist $i]
}
-nowait {
set nowait 1
}
-debug {
proc w3Int-gzip-reply {a b} {return}
}
-trace {
proc w3Int-trace {} {
set q [w3-param QUERY_STRING]
set uri [w3-param BASE_URL][w3-param PATH_INFO]
if {$q!=""} {append uri ?$q}
puts $uri
}
}
-lint {
set res [w3-safety-check]
if {$res!=""} {
puts "Potential problems in this code:"
puts $res
exit 1
} else {
exit
}
}
-D*=* {
if {[regexp {^.D([^=]+)=(.*)$} $term all var val]} {
set ::$var $val
}
}
default {
error "unknown option: $term"
}
}
}
if {$mode=="auto"} {
if {[info exists env(GATEWAY_INTERFACE)]
&& [string match CGI/1.* $env(GATEWAY_INTERFACE)]} {
set mode cgi
} else {
set mode local
}
}
if {$mode=="cgi"} {
w3Int-handle-cgi-request
} else {
w3Int-start-listener $port $mode $fromip
if {!$nowait} {
vwait ::forever
}
}
}
# Call this version 1.0
package provide w3 1.0