Cgi Utils

wiki

CGI Header

print"Content-type: text/html; charset=iso-8859-1\r\n\r\n"

Parse POST variables

-- Written by RiciLake.

-- The author places the code into the public domain, renouncing all rights and responsibilities.

-- Don't use this in a real application, see notes below.

function parsecgi(str)

  local rv = {}

  for pair in str:gmatch"[^&]+" do

    local key, val = pair:match"([^=]*)=(.*)"

    if key then rv[key] = val end

  end

  return rv

end

This implementation is dangerous in various ways:

• It accepts invalid keys, since it has no idea what valid keys are
• It doesn't properly handle repeated keys
• It ignores (or throw an error) on invalid CGI strings where there is no = in a segment
• It doesn't handle the "search" case where the CGI string consists of term[+term]*
• It doesn't decode + or %xx in values (or keys, although valid keys should not need % encoding in my opinion)

So here's a slightly better one, which still doesn't handle the "search" case. You have to give it a freshly constructed table of legal keys; if a key can have multiple values, you provide a table as the associated value (which is filled in), and otherwise you provide the default value (or false). Illegal keys are either ignored or throw errors. Segments without an = throw an error. Errors are thrown because invalid query/post strings are most likely to be attack attempts, and ought (in my opinion) to be rejected; consequently, you should wrap your CGI handler in a pcall and return a 403 or 404 error to the browser.

The function deliberately does not attempt to %-decode keys, on the basis that a valid key should never need to be %-encoded and consequently a URL of that form is likely to be an obscure attempt to attack the server.

A possible enhancement would be to also check that the supplied value is numeric in the case that the initial table has a number as the default value.

-- Written by RiciLake.

-- The author places the code into the public domain, renouncing all rights and responsibilities.

-- Replace + with space and %xx with the corresponding character.

local function cgidecode(str)

  return (str:gsub('+', ' '):gsub("%%(%x%x)", function(xx) return string.char(tonumber(xx, 16)) end))

end



-- Main function

-- Sample invocation:  cgivals = parsecgi(str, {count = 10, start = 1, names = {}})

function parsecgi(str, keys, ignore_invalid)

  local keyfound = {}

  for pair in str:gmatch"[^&]+" do

    local key, val = pair:match"([^=]*)=(.*)"

    if not key then error"Invalid query string" end

    local default = keys[key]

    if default == nil then

      if not ignore_invalid then error"Invalid query string" end

    else

      if type(default) == "table" then default[#default+1] = cgidecode(val)

      elseif keyfound[key] then error"Invalid query string"

      else

        keyfound[key] = true

        keys[key] = cgidecode(val)

      end

    end

  end

  return keys

end

Parse GET variables

str = os.getenv("QUERY_STRING")

...

Handle SCGI Requests

-- Assigns header information to variable "l", and returns "Hello!" back as the webpage content.

-- This could use some cleaning up - error checking, removal of repetition, improved scoping.



-- The SCGI protocol has the HTTP requests forwarded to a specified port (default 4000), with

-- headers passed directly through TCP (and an ASCII string length prefix followed by a ":", 

-- with the key-value pairs of the header seperated by null characters "\0")



-- With no parsing, this code handles about 950 requests per second on a 2 year old laptop.



local socket = require("socket")

local host = host or "*"

local port = port or 4000

local s = assert(socket.bind(host, port))

local i, p   = s:getsockname()

assert(i, p)

print("Waiting on " .. i .. ":" .. p .. "...")

while 1 do

  c = assert(s:accept())

  print("Connection requested.")

  len = ""

  l, e = c:receive(1)

  while not e do

    if l == ":" then header_len = tonumber(len) ; break end

    len = len .. l

    l, e = c:receive(1)

  end

  l,e = c:receive(header_len)

  c:send("Status: 200 OK\r\n")

  c:send("Content-Type: text/plain\r\n")

  c:send("\r\n")

  c:send("Hello!")

  c:close()

end

The following lines in httpd.conf (Apache 2) will allow this SCGI example to function - although 127.0.0.1 will need to be changed to a more suitable IP address.

LoadModule scgi_module modules/mod_scgi.so

SCGIMount /dynamic 127.0.0.1:4000