]> arthur.barton.de Git - netdata.git/commitdiff
prevented crashes in URL parsing where in several cases, error handling was not complete
authorCosta Tsaousis (ktsaou) <costa@tsaousis.gr>
Sun, 10 Apr 2016 15:45:43 +0000 (18:45 +0300)
committerCosta Tsaousis (ktsaou) <costa@tsaousis.gr>
Sun, 10 Apr 2016 15:45:43 +0000 (18:45 +0300)
src/web_client.c

index 639bb044cc2d2693cdba7c9f0b7c19c0228acf8e..9d7e9487d0ed653180fbb1ab562296594f9c205d 100644 (file)
@@ -781,36 +781,53 @@ int web_client_api_request_v1(struct web_client *w, char *url)
 {
        // get the command
        char *tok = mystrsep(&url, "/?&");
-       debug(D_WEB_CLIENT, "%llu: Searching for API v1 command '%s'.", w->id, tok);
-
-       if(strcmp(tok, "data") == 0)
-               return web_client_api_request_v1_data(w, url);
-       else if(strcmp(tok, "chart") == 0)
-               return web_client_api_request_v1_chart(w, url);
-       else if(strcmp(tok, "charts") == 0)
-               return web_client_api_request_v1_charts(w, url);
-
-       buffer_flush(w->response.data);
-       buffer_sprintf(w->response.data, "Unsupported v1 API command: %s", tok);
-       return 404;
+       if(tok && *tok) {
+               debug(D_WEB_CLIENT, "%llu: Searching for API v1 command '%s'.", w->id, tok);
+
+               if(strcmp(tok, "data") == 0)
+                       return web_client_api_request_v1_data(w, url);
+               else if(strcmp(tok, "chart") == 0)
+                       return web_client_api_request_v1_chart(w, url);
+               else if(strcmp(tok, "charts") == 0)
+                       return web_client_api_request_v1_charts(w, url);
+               else {
+                       buffer_flush(w->response.data);
+                       buffer_sprintf(w->response.data, "Unsupported v1 API command: %s", tok);
+                       return 404;
+               }
+       }
+       else {
+               buffer_flush(w->response.data);
+               buffer_sprintf(w->response.data, "API v1 command?");
+               return 400;
+       }
 }
 
 int web_client_api_request(struct web_client *w, char *url)
 {
        // get the api version
        char *tok = mystrsep(&url, "/?&");
-       debug(D_WEB_CLIENT, "%llu: Searching for API version '%s'.", w->id, tok);
-
-       if(strcmp(tok, "v1") == 0)
-               return web_client_api_request_v1(w, url);
-
-       buffer_flush(w->response.data);
-       buffer_sprintf(w->response.data, "Unsupported API version: %s", tok);
-       return 404;
+       if(tok && *tok) {
+               debug(D_WEB_CLIENT, "%llu: Searching for API version '%s'.", w->id, tok);
+               if(strcmp(tok, "v1") == 0)
+                       return web_client_api_request_v1(w, url);
+               else {
+                       buffer_flush(w->response.data);
+                       buffer_sprintf(w->response.data, "Unsupported API version: %s", tok);
+                       return 404;
+               }
+       }
+       else {
+               buffer_flush(w->response.data);
+               buffer_sprintf(w->response.data, "Which API version?");
+               return 400;
+       }
 }
 
 int web_client_data_request(struct web_client *w, char *url, int datasource_type)
 {
+       RRDSET *st = NULL;
+
        char *args = strchr(url, '?');
        if(args) {
                *args='\0';
@@ -819,11 +836,14 @@ int web_client_data_request(struct web_client *w, char *url, int datasource_type
 
        // get the name of the data to show
        char *tok = mystrsep(&url, "/");
-       debug(D_WEB_CLIENT, "%llu: Searching for RRD data with name '%s'.", w->id, tok);
 
        // do we have such a data set?
-       RRDSET *st = rrdset_find_byname(tok);
-       if(!st) st = rrdset_find(tok);
+       if(tok && *tok) {
+               debug(D_WEB_CLIENT, "%llu: Searching for RRD data with name '%s'.", w->id, tok);
+               st = rrdset_find_byname(tok);
+               if(!st) st = rrdset_find(tok);
+       }
+
        if(!st) {
                // we don't have it
                // try to send a file with that name
@@ -850,34 +870,36 @@ int web_client_data_request(struct web_client *w, char *url, int datasource_type
        if(url) {
                // parse the group count required
                tok = mystrsep(&url, "/");
-               if(tok) group_count = atoi(tok);
+               if(tok && *tok) group_count = atoi(tok);
                if(group_count < 1) group_count = 1;
                //if(group_count > save_history / 20) group_count = save_history / 20;
        }
        if(url) {
                // parse the grouping method required
                tok = mystrsep(&url, "/");
-               if(strcmp(tok, "max") == 0) group_method = GROUP_MAX;
-               else if(strcmp(tok, "average") == 0) group_method = GROUP_AVERAGE;
-               else if(strcmp(tok, "sum") == 0) group_method = GROUP_SUM;
-               else debug(D_WEB_CLIENT, "%llu: Unknown group method '%s'", w->id, tok);
+               if(tok && *tok) {
+                       if(strcmp(tok, "max") == 0) group_method = GROUP_MAX;
+                       else if(strcmp(tok, "average") == 0) group_method = GROUP_AVERAGE;
+                       else if(strcmp(tok, "sum") == 0) group_method = GROUP_SUM;
+                       else debug(D_WEB_CLIENT, "%llu: Unknown group method '%s'", w->id, tok);
+               }
        }
        if(url) {
                // parse after time
                tok = mystrsep(&url, "/");
-               if(tok) after = strtoul(tok, NULL, 10);
+               if(tok && *tok) after = strtoul(tok, NULL, 10);
                if(after < 0) after = 0;
        }
        if(url) {
                // parse before time
                tok = mystrsep(&url, "/");
-               if(tok) before = strtoul(tok, NULL, 10);
+               if(tok && *tok) before = strtoul(tok, NULL, 10);
                if(before < 0) before = 0;
        }
        if(url) {
                // parse nonzero
                tok = mystrsep(&url, "/");
-               if(tok && strcmp(tok, "nonzero") == 0) nonzero = 1;
+               if(tok && *tok && strcmp(tok, "nonzero") == 0) nonzero = 1;
        }
 
        w->response.data->contenttype = CT_APPLICATION_JSON;
@@ -896,9 +918,9 @@ int web_client_data_request(struct web_client *w, char *url, int datasource_type
 
                while(args) {
                        tok = mystrsep(&args, "&");
-                       if(tok) {
+                       if(tok && *tok) {
                                char *name = mystrsep(&tok, "=");
-                               if(name && strcmp(name, "tqx") == 0) {
+                               if(name && *name && strcmp(name, "tqx") == 0) {
                                        char *key = mystrsep(&tok, ":");
                                        char *value = mystrsep(&tok, ";");
                                        if(key && value && *key && *value) {
@@ -1090,118 +1112,142 @@ void web_client_process(struct web_client *w) {
                        w->last_url[URL_MAX] = '\0';
 
                        tok = mystrsep(&url, "/?");
+                       if(tok && *tok) {
+                               debug(D_WEB_CLIENT, "%llu: Processing command '%s'.", w->id, tok);
 
-                       debug(D_WEB_CLIENT, "%llu: Processing command '%s'.", w->id, tok);
-
-                       if(strcmp(tok, "api") == 0) {
-                               // the client is requesting api access
-                               datasource_type = DATASOURCE_JSON;
-                               code = web_client_api_request(w, url);
-                       }
-#ifdef NETDATA_INTERNAL_CHECKS
-                       else if(strcmp(tok, "exit") == 0) {
-                               netdata_exit = 1;
-                               code = 200;
-                               w->response.data->contenttype = CT_TEXT_PLAIN;
-                               buffer_flush(w->response.data);
-                               buffer_strcat(w->response.data, "will do");
-                       }
-#endif
-                       else if(strcmp(tok, WEB_PATH_DATA) == 0) { // "data"
-                               // the client is requesting rrd data
-                               datasource_type = DATASOURCE_JSON;
-                               code = web_client_data_request(w, url, datasource_type);
-                       }
-                       else if(strcmp(tok, WEB_PATH_DATASOURCE) == 0) { // "datasource"
-                               // the client is requesting google datasource
-                               code = web_client_data_request(w, url, datasource_type);
-                       }
-                       else if(strcmp(tok, WEB_PATH_GRAPH) == 0) { // "graph"
-                               // the client is requesting an rrd graph
-
-                               // get the name of the data to show
-                               tok = mystrsep(&url, "/?&");
-                               debug(D_WEB_CLIENT, "%llu: Searching for RRD data with name '%s'.", w->id, tok);
-
-                               // do we have such a data set?
-                               RRDSET *st = rrdset_find_byname(tok);
-                               if(!st) st = rrdset_find(tok);
-                               if(!st) {
-                                       // we don't have it
-                                       // try to send a file with that name
-                                       buffer_flush(w->response.data);
-                                       code = mysendfile(w, tok);
+                               if(strcmp(tok, "api") == 0) {
+                                       // the client is requesting api access
+                                       datasource_type = DATASOURCE_JSON;
+                                       code = web_client_api_request(w, url);
                                }
-                               else {
+#ifdef NETDATA_INTERNAL_CHECKS
+                               else if(strcmp(tok, "exit") == 0) {
+                                       netdata_exit = 1;
                                        code = 200;
-                                       debug(D_WEB_CLIENT_ACCESS, "%llu: Sending %s.json of RRD_STATS...", w->id, st->name);
-                                       w->response.data->contenttype = CT_APPLICATION_JSON;
+                                       w->response.data->contenttype = CT_TEXT_PLAIN;
                                        buffer_flush(w->response.data);
-                                       rrd_stats_graph_json(st, url, w->response.data);
+                                       buffer_strcat(w->response.data, "will do");
+                               }
+#endif
+                               else if(strcmp(tok, WEB_PATH_DATA) == 0) { // "data"
+                                       // the client is requesting rrd data
+                                       datasource_type = DATASOURCE_JSON;
+                                       code = web_client_data_request(w, url, datasource_type);
+                               }
+                               else if(strcmp(tok, WEB_PATH_DATASOURCE) == 0) { // "datasource"
+                                       // the client is requesting google datasource
+                                       code = web_client_data_request(w, url, datasource_type);
+                               }
+                               else if(strcmp(tok, WEB_PATH_GRAPH) == 0) { // "graph"
+                                       // the client is requesting an rrd graph
+
+                                       // get the name of the data to show
+                                       tok = mystrsep(&url, "/?&");
+                                       if(tok && *tok) {
+                                               debug(D_WEB_CLIENT, "%llu: Searching for RRD data with name '%s'.", w->id, tok);
+
+                                               // do we have such a data set?
+                                               RRDSET *st = rrdset_find_byname(tok);
+                                               if(!st) st = rrdset_find(tok);
+                                               if(!st) {
+                                                       // we don't have it
+                                                       // try to send a file with that name
+                                                       buffer_flush(w->response.data);
+                                                       code = mysendfile(w, tok);
+                                               }
+                                               else {
+                                                       code = 200;
+                                                       debug(D_WEB_CLIENT_ACCESS, "%llu: Sending %s.json of RRD_STATS...", w->id, st->name);
+                                                       w->response.data->contenttype = CT_APPLICATION_JSON;
+                                                       buffer_flush(w->response.data);
+                                                       rrd_stats_graph_json(st, url, w->response.data);
+                                               }
+                                       }
+                                       else {
+                                               code = 400;
+                                               buffer_flush(w->response.data);
+                                               buffer_strcat(w->response.data, "Graph name?\r\n");
+                                       }
                                }
-                       }
 #ifdef NETDATA_INTERNAL_CHECKS
-                       else if(strcmp(tok, "debug") == 0) {
-                               buffer_flush(w->response.data);
+                               else if(strcmp(tok, "debug") == 0) {
+                                       buffer_flush(w->response.data);
 
-                               // get the name of the data to show
-                               tok = mystrsep(&url, "/?&");
-                               debug(D_WEB_CLIENT, "%llu: Searching for RRD data with name '%s'.", w->id, tok);
-
-                               // do we have such a data set?
-                               RRDSET *st = rrdset_find_byname(tok);
-                               if(!st) st = rrdset_find(tok);
-                               if(!st) {
-                                       code = 404;
-                                       buffer_sprintf(w->response.data, "Chart %s is not found.\r\n", tok);
-                                       debug(D_WEB_CLIENT_ACCESS, "%llu: %s is not found.", w->id, tok);
+                                       // get the name of the data to show
+                                       tok = mystrsep(&url, "/?&");
+                                       if(tok && *tok) {
+                                               debug(D_WEB_CLIENT, "%llu: Searching for RRD data with name '%s'.", w->id, tok);
+
+                                               // do we have such a data set?
+                                               RRDSET *st = rrdset_find_byname(tok);
+                                               if(!st) st = rrdset_find(tok);
+                                               if(!st) {
+                                                       code = 404;
+                                                       buffer_sprintf(w->response.data, "Chart %s is not found.\r\n", tok);
+                                                       debug(D_WEB_CLIENT_ACCESS, "%llu: %s is not found.", w->id, tok);
+                                               }
+                                               else {
+                                                       code = 200;
+                                                       debug_flags |= D_RRD_STATS;
+                                                       st->debug = st->debug?0:1;
+                                                       buffer_sprintf(w->response.data, "Chart %s has now debug %s.\r\n", tok, st->debug?"enabled":"disabled");
+                                                       debug(D_WEB_CLIENT_ACCESS, "%llu: debug for %s is %s.", w->id, tok, st->debug?"enabled":"disabled");
+                                               }
+                                       }
+                                       else {
+                                               code = 500;
+                                               buffer_flush(w->response.data);
+                                               buffer_strcat(w->response.data, "debug which chart?\r\n");
+                                       }
                                }
-                               else {
+                               else if(strcmp(tok, "mirror") == 0) {
                                        code = 200;
-                                       debug_flags |= D_RRD_STATS;
-                                       st->debug = st->debug?0:1;
-                                       buffer_sprintf(w->response.data, "Chart %s has now debug %s.\r\n", tok, st->debug?"enabled":"disabled");
-                                       debug(D_WEB_CLIENT_ACCESS, "%llu: debug for %s is %s.", w->id, tok, st->debug?"enabled":"disabled");
-                               }
-                       }
-                       else if(strcmp(tok, "mirror") == 0) {
-                               code = 200;
 
-                               debug(D_WEB_CLIENT_ACCESS, "%llu: Mirroring...", w->id);
+                                       debug(D_WEB_CLIENT_ACCESS, "%llu: Mirroring...", w->id);
 
-                               // replace the zero bytes with spaces
-                               buffer_char_replace(w->response.data, '\0', ' ');
+                                       // replace the zero bytes with spaces
+                                       buffer_char_replace(w->response.data, '\0', ' ');
 
-                               // just leave the buffer as is
-                               // it will be copied back to the client
-                       }
+                                       // just leave the buffer as is
+                                       // it will be copied back to the client
+                               }
 #endif
-                       else if(strcmp(tok, "list") == 0) {
-                               code = 200;
+                               else if(strcmp(tok, "list") == 0) {
+                                       code = 200;
 
-                               debug(D_WEB_CLIENT_ACCESS, "%llu: Sending list of RRD_STATS...", w->id);
+                                       debug(D_WEB_CLIENT_ACCESS, "%llu: Sending list of RRD_STATS...", w->id);
 
-                               buffer_flush(w->response.data);
-                               RRDSET *st = rrdset_root;
+                                       buffer_flush(w->response.data);
+                                       RRDSET *st = rrdset_root;
 
-                               for ( ; st ; st = st->next )
-                                       buffer_sprintf(w->response.data, "%s\n", st->name);
-                       }
-                       else if(strcmp(tok, "all.json") == 0) {
-                               code = 200;
-                               debug(D_WEB_CLIENT_ACCESS, "%llu: Sending JSON list of all monitors of RRD_STATS...", w->id);
+                                       for ( ; st ; st = st->next )
+                                               buffer_sprintf(w->response.data, "%s\n", st->name);
+                               }
+                               else if(strcmp(tok, "all.json") == 0) {
+                                       code = 200;
+                                       debug(D_WEB_CLIENT_ACCESS, "%llu: Sending JSON list of all monitors of RRD_STATS...", w->id);
 
-                               w->response.data->contenttype = CT_APPLICATION_JSON;
-                               buffer_flush(w->response.data);
-                               rrd_stats_all_json(w->response.data);
-                       }
-                       else if(strcmp(tok, "netdata.conf") == 0) {
-                               code = 200;
-                               debug(D_WEB_CLIENT_ACCESS, "%llu: Sending netdata.conf ...", w->id);
+                                       w->response.data->contenttype = CT_APPLICATION_JSON;
+                                       buffer_flush(w->response.data);
+                                       rrd_stats_all_json(w->response.data);
+                               }
+                               else if(strcmp(tok, "netdata.conf") == 0) {
+                                       code = 200;
+                                       debug(D_WEB_CLIENT_ACCESS, "%llu: Sending netdata.conf ...", w->id);
 
-                               w->response.data->contenttype = CT_TEXT_PLAIN;
-                               buffer_flush(w->response.data);
-                               generate_config(w->response.data, 0);
+                                       w->response.data->contenttype = CT_TEXT_PLAIN;
+                                       buffer_flush(w->response.data);
+                                       generate_config(w->response.data, 0);
+                               }
+                               else {
+                                       char filename[FILENAME_MAX+1];
+                                       url = filename;
+                                       strncpy(filename, w->last_url, FILENAME_MAX);
+                                       filename[FILENAME_MAX] = '\0';
+                                       tok = mystrsep(&url, "?");
+                                       buffer_flush(w->response.data);
+                                       code = mysendfile(w, (tok && *tok)?tok:"/");
+                               }
                        }
                        else {
                                char filename[FILENAME_MAX+1];
@@ -1224,7 +1270,10 @@ void web_client_process(struct web_client *w) {
                }
 
                // free url_decode() buffer
-               if(pointer_to_free) free(pointer_to_free);
+               if(pointer_to_free) {
+                       free(pointer_to_free);
+                       pointer_to_free = NULL;
+               }
        }
        else if(w->response.data->len > TOO_BIG_REQUEST) {
                strcpy(w->last_url, "too big request");