Decoding, validation, and path-resolution fixes for cgi-bin scripts

src/cgi-bin/augmented_diff

@@ -20,27 +20,63 @@
 
 ID=0
 BBOX=
-INFO=
 DEBUG=
-EXECBASE="`dirname $0`/../"
+EXEC_DIR="$(dirname "$(realpath "$0")")"
+BIN_DIR="$(realpath "$EXEC_DIR/../bin")"
 CACHE_DIR="/tmp/osm3s_augmented_diffs_cache/"
+NUMBER_RE='-?([0-9]+(\.[0-9]*)?|\.[0-9]+)([eE][+-]?[0-9]+)?'
+WS='[[:space:]]*'
+BBOX_RE="^${WS}${NUMBER_RE}${WS},${WS}${NUMBER_RE}${WS},${WS}${NUMBER_RE}${WS},${WS}${NUMBER_RE}${WS}\$"
+ID_RE='^(0|[1-9][0-9]{0,11})$'
 
+bad_request()
+{
+  echo "Content-Type: text/plain; charset=utf-8"
+  echo "Status: 400 Bad Request"
+  echo
+  echo "$1"
+  exit 0
+}
+
+set -f
 IFS=$'&'
 for KEY_VAL in $QUERY_STRING; do
 {
-  if [[ ${KEY_VAL:0:3} == "id=" ]]; then
-    ID="${KEY_VAL:3}"
-  elif [[ ${KEY_VAL:0:5} == "bbox=" && ${KEY_VAL:0:9} != "bbox=-180" ]]; then
-    BBOX=`echo "${KEY_VAL:5}" | $EXECBASE/bin/uncgi`
-  elif [[ ${KEY_VAL:0:6} == "debug=" ]]; then
-    DEBUG=`echo "${KEY_VAL:6}" | $EXECBASE/bin/uncgi`
+  if [[ $KEY_VAL == *=* ]]; then
+    RAW_VAL="${KEY_VAL#*=}"
+  else
+    RAW_VAL=
   fi
+  KEY=$(printf '%s' "${KEY_VAL%%=*}" | "$BIN_DIR"/uncgi) || bad_request "Malformed query string"
+  VAL=$(printf '%s' "$RAW_VAL" | "$BIN_DIR"/uncgi) || bad_request "Malformed query string"
+  case "$KEY" in
+    id)
+      if [[ $VAL =~ $ID_RE ]]; then
+        ID="$VAL"
+      else
+        bad_request "Invalid id parameter"
+      fi
+      ;;
+    bbox)
+      if [[ $VAL =~ $BBOX_RE ]]; then
+        if [[ ${VAL:0:4} != "-180" ]]; then
+          BBOX="$VAL"
+        fi
+      else
+        bad_request "Invalid bbox parameter"
+      fi
+      ;;
+    debug)
+      DEBUG="$VAL"
+      ;;
+  esac
 }; done
 unset IFS
+set +f
 
-EPOCHSECS=$(($ID * 60 + 1347432900))
-SINCE=`date --utc --date="@$EPOCHSECS" '+%FT%H:%M:%SZ'`
-UNTIL=`date --utc --date="@$(($EPOCHSECS + 60))" '+%FT%H:%M:%SZ'`
+EPOCHSECS=$((ID * 60 + 1347432900))
+SINCE=$(date --utc --date="@$EPOCHSECS" '+%FT%H:%M:%SZ')
+UNTIL=$(date --utc --date="@$((EPOCHSECS + 60))" '+%FT%H:%M:%SZ')
 
 if [[ -z $BBOX ]]; then
 
@@ -60,9 +96,9 @@ fi
 #REQUEST_METHOD=GET
 
 if [[ -z $DEBUG ]]; then
-  ./interpreter
+  "$EXEC_DIR"/interpreter
 else
   echo "Content-Type: text/plain"
   echo
-  echo $QUERY_STRING
+  echo "$QUERY_STRING"
 fi

src/cgi-bin/augmented_diff_status

@@ -19,32 +19,58 @@
 
 
 CACHE_DIR="/tmp/osm3s_augmented_diffs_cache/"
+EXEC_DIR="$(dirname "$(realpath "$0")")"
+TIMESTAMP_RE='^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$'
+WS='[[:space:]]*'
+TOKEN='[!#$%&'"'"'*+.^_`|~[:alnum:]-]+'
+HEADERS_RE="^${WS}${TOKEN}(${WS},${WS}${TOKEN})*${WS}\$"
 
+print_cors_headers()
+{
+  if [[ -n $HTTP_ACCESS_CONTROL_REQUEST_HEADERS && $HTTP_ACCESS_CONTROL_REQUEST_HEADERS =~ $HEADERS_RE ]]; then
+    echo "Access-Control-Allow-Headers: $HTTP_ACCESS_CONTROL_REQUEST_HEADERS"
+  fi
+  if [[ -n $HTTP_ORIGIN ]]; then
+    echo "Access-Control-Allow-Origin: *"
+  fi
+}
 
-# Do HTTP headers with respect to CORS
-echo "Content-Type: text/plain; charset=utf-8"
-if [[ -n $HTTP_ACCESS_CONTROL_REQUEST_HEADERS ]]; then
-  echo "Access-Control-Allow-Headers: $HTTP_ACCESS_CONTROL_REQUEST_HEADERS"
-fi
-if [[ -n $HTTP_ORIGIN ]]; then
-  echo "Access-Control-Allow-Origin: *"
-fi
-if [[ $REQUEST_METHOD == "OPTIONS" ]]; then {
+internal_error()
+{
+  echo "Content-Type: text/plain; charset=utf-8"
+  echo "Status: 500 Internal Server Error"
+  print_cors_headers
+  echo
+  echo "$1"
+  exit 0
+}
+
+if [[ $REQUEST_METHOD == "OPTIONS" ]]; then
+  echo "Content-Type: text/plain; charset=utf-8"
+  print_cors_headers
   echo "Access-Control-Allow-Methods: GET, POST, OPTIONS"
   echo "Content-Length: 0"
   echo
   exit 0
-}; fi
-echo
+fi
 
 if [[ -r "$CACHE_DIR/newest" ]]; then
+  echo "Content-Type: text/plain; charset=utf-8"
+  print_cors_headers
+  echo
   cat "$CACHE_DIR/newest"
   exit 0
 fi
 
-TIMESTAMP=`./timestamp | tail -n 1`
+TIMESTAMP=$("$EXEC_DIR"/timestamp | tail -n 1)
 
-if [[ ${TIMESTAMP:0:1} == "2" ]]; then
-  EPOCHSECS=`date --date=$TIMESTAMP '+%s'`
-  echo $(( ( $EPOCHSECS - 1347432960 ) / 60 ))
+if [[ ! $TIMESTAMP =~ $TIMESTAMP_RE ]]; then
+  internal_error "Invalid timestamp from backend"
 fi
+
+EPOCHSECS=$(date --date="$TIMESTAMP" '+%s')
+
+echo "Content-Type: text/plain; charset=utf-8"
+print_cors_headers
+echo
+echo $(( ( EPOCHSECS - 1347432960 ) / 60 ))

src/cgi-bin/augmented_map

@@ -17,29 +17,58 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with PT_Diagrams.  If not, see <http://www.gnu.org/licenses/>.
 
-BUF="$QUERY_STRING&"
+EXEC_DIR="$(dirname "$(realpath "$0")")"
+BIN_DIR="$(realpath "$EXEC_DIR/../bin")"
 
 ID=
 LAT=50.7421
 LON=7.0624
 ZOOM=6
 
+NUMBER_RE='-?([0-9]+(\.[0-9]*)?|\.[0-9]+)([eE][+-]?[0-9]+)?'
+ID_RE='^(0|[1-9][0-9]{0,11})$'
+LAT_RE="^${NUMBER_RE}\$"
+LON_RE="^${NUMBER_RE}\$"
+ZOOM_RE='^[0-9]{1,2}$'
+
+set -f
 IFS=$'&'
 for KEY_VAL in $QUERY_STRING; do
 {
-  if [[ ${KEY_VAL:0:3} == "id=" ]]; then
-    ID="${KEY_VAL:3}"
-  elif [[ ${KEY_VAL:0:4} == "lat=" ]]; then
-    LAT="${KEY_VAL:4}"
-  elif [[ ${KEY_VAL:0:4} == "lon=" ]]; then
-    LON="${KEY_VAL:4}"
-  elif [[ ${KEY_VAL:0:5} == "zoom=" ]]; then
-    ZOOM="${KEY_VAL:5}"
+  if [[ $KEY_VAL == *=* ]]; then
+    RAW_VAL="${KEY_VAL#*=}"
+  else
+    RAW_VAL=
   fi
+  KEY=$(printf '%s' "${KEY_VAL%%=*}" | "$BIN_DIR"/uncgi) || continue
+  VAL=$(printf '%s' "$RAW_VAL" | "$BIN_DIR"/uncgi) || continue
+  case "$KEY" in
+    id)
+      [[ $VAL =~ $ID_RE ]] && ID="$VAL"
+      ;;
+    lat)
+      [[ $VAL =~ $LAT_RE ]] && LAT="$VAL"
+      ;;
+    lon)
+      [[ $VAL =~ $LON_RE ]] && LON="$VAL"
+      ;;
+    zoom)
+      [[ $VAL =~ $ZOOM_RE ]] && ZOOM="$VAL"
+      ;;
+  esac
 }; done
 unset IFS
+set +f
 
 echo "Content-Type: text/html; charset=utf-8"
 echo
 
-cat </var/www/augmented_diffs.html | awk "{ i=index(\$0,\"\$ID\"); if (i==0) { i=index(\$0,\"\$LAT\"); if (i==0) { i=index(\$0,\"\$LON\"); if (i==0) { i=index(\$0,\"\$ZOOM\"); if (i==0) { print \$0; } else { print substr(\$0,1,i-1) \"$ZOOM\" substr(\$0,i+5); } } else { print substr(\$0,1,i-1) \"$LON\" substr(\$0,i+4); } } else { print substr(\$0,1,i-1) \"$LAT\" substr(\$0,i+4); } } else { print substr(\$0,1,i-1) \"$ID\" substr(\$0,i+3); }; }"
+awk -v id="$ID" -v lat="$LAT" -v lon="$LON" -v zoom="$ZOOM" '
+{
+  line = $0
+  sub(/\$ID/, id, line)
+  sub(/\$LAT/, lat, line)
+  sub(/\$LON/, lon, line)
+  sub(/\$ZOOM/, zoom, line)
+  print line
+}' /var/www/augmented_diffs.html

src/cgi-bin/augmented_state_by_date

@@ -17,75 +17,120 @@
 # You should have received a copy of the GNU Affero General Public License
 # along with Overpass_API.  If not, see <http://www.gnu.org/licenses/>.
 
-BUF="$QUERY_STRING&"
+EXEC_DIR="$(dirname "$(realpath "$0")")"
+BIN_DIR="$(realpath "$EXEC_DIR/../bin")"
+LOCAL_DIR="/var/www/augmented_diffs"
+
+TIME_RE='^[0-9]{4}-[0-9]{2}-[0-9]{2}T[0-9]{2}:[0-9]{2}:[0-9]{2}Z$'
+INTEGER_RE='^(0|[1-9][0-9]*)$'
+WS='[[:space:]]*'
+TOKEN='[!#$%&'"'"'*+.^_`|~[:alnum:]-]+'
+HEADERS_RE="^${WS}${TOKEN}(${WS},${WS}${TOKEN})*${WS}\$"
+
+print_cors_headers()
+{
+  if [[ -n $HTTP_ACCESS_CONTROL_REQUEST_HEADERS && $HTTP_ACCESS_CONTROL_REQUEST_HEADERS =~ $HEADERS_RE ]]; then
+    echo "Access-Control-Allow-Headers: $HTTP_ACCESS_CONTROL_REQUEST_HEADERS"
+  fi
+  if [[ -n $HTTP_ORIGIN ]]; then
+    echo "Access-Control-Allow-Origin: *"
+  fi
+}
+
+bad_request()
+{
+  echo "Content-Type: text/plain; charset=utf-8"
+  echo "Status: 400 Bad Request"
+  print_cors_headers
+  echo
+  echo "$1"
+  exit 0
+}
+
+internal_error()
+{
+  echo "Content-Type: text/plain; charset=utf-8"
+  echo "Status: 500 Internal Server Error"
+  print_cors_headers
+  echo
+  echo "$1"
+  exit 0
+}
+
+if [[ $REQUEST_METHOD == "OPTIONS" ]]; then
+  echo "Content-Type: text/plain; charset=utf-8"
+  print_cors_headers
+  echo "Access-Control-Allow-Methods: GET, POST, OPTIONS"
+  echo "Content-Length: 0"
+  echo
+  exit 0
+fi
 
 STATE=
-EXECBASE="`dirname $0`/../"
-BIN_DIR="${EXECBASE}bin"
 
+set -f
 IFS=$'&'
 for KEY_VAL in $QUERY_STRING; do
 {
-  if [[ ${KEY_VAL:0:9} == "osm_base=" ]]; then
-    STATE="${KEY_VAL:9}"
+  if [[ $KEY_VAL == *=* ]]; then
+    RAW_VAL="${KEY_VAL#*=}"
+  else
+    RAW_VAL=
   fi
+  KEY=$(printf '%s' "${KEY_VAL%%=*}" | "$BIN_DIR"/uncgi) || bad_request "Malformed query string"
+  VAL=$(printf '%s' "$RAW_VAL" | "$BIN_DIR"/uncgi) || bad_request "Malformed query string"
+  case "$KEY" in
+    osm_base)
+      STATE="$VAL"
+      ;;
+  esac
 }; done
 unset IFS
+set +f
 
+if [[ ! $STATE =~ $TIME_RE ]]; then
+  bad_request "Invalid osm_base parameter"
+fi
+TARGET_TIME="$STATE"
 
-TARGET_TIME="`echo "$STATE" | $BIN_DIR/uncgi`"
 LOWER="0"
-UPPER="`cat /var/www/augmented_diffs/state.txt`"
-LOCAL_DIR="/var/www/augmented_diffs/"
+UPPER=$(cat "$LOCAL_DIR/state.txt")
+if [[ ! $UPPER =~ $INTEGER_RE ]]; then
+  internal_error "Invalid state file"
+fi
 
 get_replicate_filename()
 {
-  printf -v TDIGIT3 %03u $(($TARGET % 1000))
-  ARG=$(($TARGET / 1000))
-  printf -v TDIGIT2 %03u $(($ARG % 1000))
-  ARG=$(($ARG / 1000))
+  printf -v TDIGIT3 %03u $((TARGET % 1000))
+  ARG=$((TARGET / 1000))
+  printf -v TDIGIT2 %03u $((ARG % 1000))
+  ARG=$((ARG / 1000))
   printf -v TDIGIT1 %03u $ARG
   LOCAL_PATH="$LOCAL_DIR/$TDIGIT1/$TDIGIT2"
   REPLICATE_FILENAME="$LOCAL_PATH/$TDIGIT3"
-};
+}
 
 update_state()
 {
   get_replicate_filename
-  if [[ -s "$REPLICATE_FILENAME.state.txt" ]]; then {
-    TIMESTAMP_LINE=`cat "$REPLICATE_FILENAME.state.txt"`
+  if [[ -s "$REPLICATE_FILENAME.state.txt" ]]; then
+    TIMESTAMP_LINE=$(cat "$REPLICATE_FILENAME.state.txt")
     DATA_VERSION=${TIMESTAMP_LINE:9}
-  }; fi
-};
+  fi
+}
 
-while [[ $(($LOWER + 1)) -lt $UPPER ]]; do
-{
-  TARGET=$((($LOWER + $UPPER) / 2))
+while [[ $((LOWER + 1)) -lt $UPPER ]]; do
+  TARGET=$(((LOWER + UPPER) / 2))
   update_state
-  #echo "$TARGET - $TIMESTAMP_LINE"
   if [[ -s "$REPLICATE_FILENAME.state.txt" && "$DATA_VERSION" < "$TARGET_TIME" ]]; then
-  {
     LOWER=$TARGET
-  }; else
-  {
+  else
     UPPER=$TARGET
-  }; fi
-}; done
+  fi
+done
 
-# Do HTTP headers with respect to CORS
 echo "Content-Type: text/plain; charset=utf-8"
-if [[ -n $HTTP_ACCESS_CONTROL_REQUEST_HEADERS ]]; then
-  echo "Access-Control-Allow-Headers: $HTTP_ACCESS_CONTROL_REQUEST_HEADERS"
-fi
-if [[ -n $HTTP_ORIGIN ]]; then
-  echo "Access-Control-Allow-Origin: *"
-fi
-if [[ $REQUEST_METHOD == "OPTIONS" ]]; then {
-  echo "Access-Control-Allow-Methods: GET, POST, OPTIONS"
-  echo "Content-Length: 0"
-  echo
-  exit 0
-}; fi
+print_cors_headers
 echo
 
 echo "$LOWER"