index : cgit

/*
 * The output layer every cgit page is built with, holding the escaping rules
 * for page text, attribute values, URL paths and query arguments along with
 * the small formatting helpers the rest of the code prints through. What is
 * written here is gathered into one buffer and handed to stdout in whole
 * blocks, since a page is made of a great many small fragments. cgit shares
 * stdout with the filters it runs and with git itself, so that buffer has
 * to be emptied wherever another writer takes over.
 */

#include "cgit.h"
#include "cache.h"
#include "filter.h"
#include "html.h"

#define HTML_WRITE_BUFSIZE (64 * 1024)

// The percent encoding for each byte, with NULL marking the bytes a URL may
// carry as themselves. An ampersand or plus is legal in a path but encoded all
// the same, since a bare plus in a query argument decodes back as a space, and
// an ampersand in an attribute value can start a character reference and
// quietly turn "a&copy.txt" into a different filename. The bytes left as
// themselves are the letters, the digits, and !$()*,-./:;@[]_~
static const char *url_escape_table[256] = {
	"%00", "%01", "%02", "%03", "%04", "%05", "%06", "%07",
	"%08", "%09", "%0A", "%0B", "%0C", "%0D", "%0E", "%0F",
	"%10", "%11", "%12", "%13", "%14", "%15", "%16", "%17",
	"%18", "%19", "%1A", "%1B", "%1C", "%1D", "%1E", "%1F",
	"%20", NULL,  "%22", "%23", NULL,  "%25", "%26", "%27",
	NULL,  NULL,  NULL,  "%2B", NULL,  NULL,  NULL,  NULL,
	NULL,  NULL,  NULL,  NULL,  NULL,  NULL,  NULL,  NULL,
	NULL,  NULL,  NULL,  NULL,  "%3C", "%3D", "%3E", "%3F",
	NULL,  NULL,  NULL,  NULL,  NULL,  NULL,  NULL,  NULL,
	NULL,  NULL,  NULL,  NULL,  NULL,  NULL,  NULL,  NULL,
	NULL,  NULL,  NULL,  NULL,  NULL,  NULL,  NULL,  NULL,
	NULL,  NULL,  NULL,  NULL,  "%5C", NULL,  "%5E", NULL,
	"%60", NULL,  NULL,  NULL,  NULL,  NULL,  NULL,  NULL,
	NULL,  NULL,  NULL,  NULL,  NULL,  NULL,  NULL,  NULL,
	NULL,  NULL,  NULL,  NULL,  NULL,  NULL,  NULL,  NULL,
	NULL,  NULL,  NULL,  "%7B", "%7C", "%7D", NULL,  "%7F",
	"%80", "%81", "%82", "%83", "%84", "%85", "%86", "%87",
	"%88", "%89", "%8A", "%8B", "%8C", "%8D", "%8E", "%8F",
	"%90", "%91", "%92", "%93", "%94", "%95", "%96", "%97",
	"%98", "%99", "%9A", "%9B", "%9C", "%9D", "%9E", "%9F",
	"%A0", "%A1", "%A2", "%A3", "%A4", "%A5", "%A6", "%A7",
	"%A8", "%A9", "%AA", "%AB", "%AC", "%AD", "%AE", "%AF",
	"%B0", "%B1", "%B2", "%B3", "%B4", "%B5", "%B6", "%B7",
	"%B8", "%B9", "%BA", "%BB", "%BC", "%BD", "%BE", "%BF",
	"%C0", "%C1", "%C2", "%C3", "%C4", "%C5", "%C6", "%C7",
	"%C8", "%C9", "%CA", "%CB", "%CC", "%CD", "%CE", "%CF",
	"%D0", "%D1", "%D2", "%D3", "%D4", "%D5", "%D6", "%D7",
	"%D8", "%D9", "%DA", "%DB", "%DC", "%DD", "%DE", "%DF",
	"%E0", "%E1", "%E2", "%E3", "%E4", "%E5", "%E6", "%E7",
	"%E8", "%E9", "%EA", "%EB", "%EC", "%ED", "%EE", "%EF",
	"%F0", "%F1", "%F2", "%F3", "%F4", "%F5", "%F6", "%F7",
	"%F8", "%F9", "%FA", "%FB", "%FC", "%FD", "%FE", "%FF"
};

static char out_buf[HTML_WRITE_BUFSIZE];
static size_t out_len;
static struct strbuf *capture;

static void write_out(const char *data, size_t size)
{
	int err;

	// A blob or snapshot is well past what one write can move onto a
	// pipe, so short writes are resumed rather than reported.
	while (size) {
		ssize_t written = xwrite(STDOUT_FILENO, data, size);

		// A write that moves nothing would repeat for ever, so it
		// counts as a full device, the way write_in_full treats it.
		if (!written)
			errno = ENOSPC;
		if (written <= 0)
			break;
		data += written;
		size -= written;
	}
	if (!size)
		return;
	err = errno;
	// While a cache slot is being filled stdout is a file, and a full disk
	// must not cost the visitor the page. Abandoning the fill puts stdout
	// back on the client along with what the file already holds, so only
	// the rest is written again.
	if (cache_abandon_fill()) {
		if (write_in_full(STDOUT_FILENO, data, size) < 0)
			die_errno("Unable to write the page");
		return;
	}
	// A client that has gone away fails the write with EPIPE and leaves
	// nobody to read an error page, so the request ends quietly. A filter
	// that exited early fails it the same way, and that page has a reader.
	if (err == EPIPE && !cgit_filter_holds_stdout()) {
		html_discard();
		exit(0);
	}
	errno = err;
	die_errno("Unable to write the page");
}

/*
 * Format into one of a rotating set of static buffers, so that a few results
 * can be alive at once, for example as several arguments to one call. The slot
 * count has to stay a power of two for the wrap below.
 */
char *cgit_fmt(const char *format, ...)
{
	static char buf[8][1024];
	static int slot;
	int len;
	va_list args;

	slot++;
	slot &= ARRAY_SIZE(buf) - 1;

	va_start(args, format);
	len = vsnprintf(buf[slot], sizeof(buf[slot]), format, args);
	va_end(args);
	if (len < 0 || (size_t)len >= sizeof(buf[slot])) {
		fprintf(stderr, "[cgit] String truncated: %s\n", format);
		exit(1);
	}
	return buf[slot];
}

void html_flush(void)
{
	size_t len = out_len;

	if (!len)
		return;
	// Clear the length first, because write_out can die and the error page
	// it produces would otherwise try to flush the same bytes again.
	out_len = 0;
	write_out(out_buf, len);
}

void html_discard(void)
{
	out_len = 0;
	capture = NULL;
}

void html_capture_begin(struct strbuf *sb)
{
	html_flush();
	capture = sb;
}

void html_capture_end(void)
{
	capture = NULL;
}

void html_raw(const char *data, size_t size)
{
	if (capture) {
		strbuf_add(capture, data, size);
		return;
	}
	if (size >= HTML_WRITE_BUFSIZE) {
		html_flush();
		write_out(data, size);
		return;
	}
	if (out_len + size > HTML_WRITE_BUFSIZE)
		html_flush();
	memcpy(out_buf + out_len, data, size);
	out_len += size;
}

void html(const char *txt)
{
	html_raw(txt, strlen(txt));
}

void htmlf(const char *format, ...)
{
	va_list args;
	struct strbuf sb = STRBUF_INIT;

	va_start(args, format);
	strbuf_vaddf(&sb, format, args);
	va_end(args);
	html(sb.buf);
	strbuf_release(&sb);
}

void html_txtf(const char *format, ...)
{
	va_list args;

	va_start(args, format);
	html_vtxtf(format, args);
	va_end(args);
}

void html_vtxtf(const char *format, va_list ap)
{
	va_list copy;
	struct strbuf sb = STRBUF_INIT;

	va_copy(copy, ap);
	strbuf_vaddf(&sb, format, copy);
	va_end(copy);
	html_txt(sb.buf);
	strbuf_release(&sb);
}

/*
 * The entity for a character that page text would otherwise read as markup, or
 * NULL for any other character.
 */
static const char *txt_entity(int c)
{
	switch (c) {
	case '<':
		return "&lt;";
	case '>':
		return "&gt;";
	case '&':
		return "&amp;";
	default:
		return NULL;
	}
}

void html_txt(const char *txt)
{
	if (txt)
		html_ntxt(txt, strlen(txt));
}

ssize_t html_ntxt(const char *txt, size_t len)
{
	const char *p = txt;
	ssize_t left;

	if (len > SSIZE_MAX)
		return -1;

	left = (ssize_t)len;
	while (p && *p && left--) {
		const char *entity = txt_entity(*p);

		if (entity) {
			html_raw(txt, p - txt);
			html(entity);
			txt = p + 1;
		}
		p++;
	}
	// A cut inside a multibyte character would leave an invalid sequence
	// on the page, so it backs up to where that character starts. The
	// escaped bytes are all ASCII, so no character spans one.
	if (left < 0)
		while (p > txt && (*p & 0xC0) == 0x80)
			p--;
	if (p != txt)
		html_raw(txt, p - txt);
	return left;
}

/*
 * git ends a line only at a line feed. A browser also starts one at a carriage
 * return with no line feed after it, since the HTML parser turns that into a
 * line feed, and may at the other characters Unicode makes mandatory breaks.
 * Escaping those keeps one line on the page for every line git counts, so the
 * numbers beside the text stay in step with it.
 */
const char *html_line_break_escape(const char *p, const char *end, size_t *width)
{
	const char *esc;

	switch ((unsigned char)*p) {
	case '\r':
		// The parser reads CR LF as the single line feed git ends the
		// line with.
		if (p + 1 < end && p[1] == '\n')
			return NULL;
		*width = 1;
		return "\\r";
	case '\v':
		*width = 1;
		return "\\v";
	case '\f':
		*width = 1;
		return "\\f";
	case 0xc2:
		if (end - p < 2 || memcmp(p, "\xc2\x85", 2))
			return NULL;
		*width = 2;
		return "\\u0085";
	case 0xe2:
		if (end - p >= 3 && !memcmp(p, "\xe2\x80\xa8", 3))
			esc = "\\u2028";
		else if (end - p >= 3 && !memcmp(p, "\xe2\x80\xa9", 3))
			esc = "\\u2029";
		else
			return NULL;
		*width = 3;
		return esc;
	default:
		return NULL;
	}
}

void html_blob_txt(const char *txt, size_t len)
{
	const char *end = txt + len;
	const char *p;

	for (p = txt; p < end; p++) {
		const char *entity = txt_entity(*p), *esc = NULL;
		size_t width = 1;

		if (!entity)
			esc = html_line_break_escape(p, end, &width);
		if (!entity && !esc)
			continue;
		html_raw(txt, p - txt);
		if (entity) {
			html(entity);
		} else {
			// The span lets a stylesheet tell the escape from the
			// same characters typed into the file.
			html("<span class='escape'>");
			html(esc);
			html("</span>");
		}
		p += width - 1;
		txt = p + 1;
	}
	html_raw(txt, end - txt);
}

void html_attrf(const char *format, ...)
{
	va_list args;
	struct strbuf sb = STRBUF_INIT;

	va_start(args, format);
	strbuf_vaddf(&sb, format, args);
	va_end(args);

	html_attr(sb.buf);
	strbuf_release(&sb);
}

void html_attr(const char *txt)
{
	const char *p = txt;

	while (p && *p) {
		const char *entity;

		if (*p == '\'')
			entity = "&#x27;";
		else if (*p == '"')
			entity = "&quot;";
		else
			entity = txt_entity(*p);
		if (entity) {
			html_raw(txt, p - txt);
			html(entity);
			txt = p + 1;
		}
		p++;
	}
	if (p != txt)
		html(txt);
}

void html_url_path(const char *txt)
{
	const char *p = txt;

	while (p && *p) {
		unsigned char c = *p;
		const char *esc = url_escape_table[c];
		if (esc) {
			html_raw(txt, p - txt);
			html(esc);
			txt = p + 1;
		}
		p++;
	}
	if (p != txt)
		html(txt);
}

void cgit_add_url_path(struct strbuf *sb, const char *txt)
{
	for (; *txt; txt++) {
		const char *esc = url_escape_table[(unsigned char)*txt];

		if (esc)
			strbuf_addstr(sb, esc);
		else
			strbuf_addch(sb, *txt);
	}
}

void html_attr_url(const char *txt)
{
	struct strbuf url = STRBUF_INIT;

	// These are the bytes RFC 3986 allows in no part of a url.
	for (; *txt; txt++) {
		unsigned char c = *txt;

		if (c <= ' ' || c >= 0x7f || strchr("\"<>\\^`{|}", c))
			strbuf_addstr(&url, url_escape_table[c]);
		else
			strbuf_addch(&url, c);
	}
	html_attr(url.buf);
	strbuf_release(&url);
}

void html_url_arg(const char *txt)
{
	const char *p = txt;

	while (p && *p) {
		unsigned char c = *p;
		const char *esc = url_escape_table[c];
		if (c == ' ')
			esc = "+";
		if (esc) {
			html_raw(txt, p - txt);
			html(esc);
			txt = p + 1;
		}
		p++;
	}
	if (p != txt)
		html(txt);
}

void html_header_arg_in_quotes(const char *txt)
{
	const char *p = txt;

	while (p && *p) {
		unsigned char c = *p;
		const char *esc = NULL;
		if (c == '\\')
			esc = "\\\\";
		else if (c == '\r')
			esc = "\\r";
		else if (c == '\n')
			esc = "\\n";
		else if (c == '"')
			esc = "\\\"";
		// A header line carries no other control byte either, and a web
		// server refuses the whole response over one.
		else if (c < 0x20 || c == 0x7f)
			esc = "?";
		if (esc) {
			html_raw(txt, p - txt);
			html(esc);
			txt = p + 1;
		}
		p++;
	}
	if (p != txt)
		html(txt);
}

void html_header_ext_value(const char *txt)
{
	const char *p = txt;

	while (p && *p) {
		unsigned char c = *p;

		// The attr-char set of RFC 8187, which leaves nothing that
		// could end the parameter or the header line.
		if (!isalnum(c) && !strchr("!#$&+-.^_`|~", c)) {
			html_raw(txt, p - txt);
			htmlf("%%%02X", c);
			txt = p + 1;
		}
		p++;
	}
	if (p != txt)
		html(txt);
}

/*
 * A query string goes into a header the way it arrived, already encoded by
 * the client, except that a byte a header line cannot carry is percent-encoded
 * so the line stays one line.
 */
void html_header_query(const char *txt)
{
	const char *p = txt;

	while (p && *p) {
		unsigned char c = *p;
		if (c <= ' ' || c >= 0x7f) {
			html_raw(txt, p - txt);
			html(url_escape_table[c]);
			txt = p + 1;
		}
		p++;
	}
	if (p != txt)
		html(txt);
}

void html_hidden(const char *name, const char *value)
{
	html("<input type='hidden' name='");
	html_attr(name);
	html("' value='");
	html_attr(value);
	html("'>");
}

void html_option(const char *value, const char *text, const char *selected_value)
{
	html("<option value='");
	html_attr(value);
	html("'");
	if (selected_value && !strcmp(selected_value, value))
		html(" selected");
	html(">");
	html_txt(text);
	html("</option>\n");
}

void html_intoption(int value, const char *text, int selected_value)
{
	htmlf("<option value='%d'%s>", value, value == selected_value ? " selected" : "");
	html_txt(text);
	html("</option>\n");
}

void html_include(const char *filename)
{
	FILE *f;
	char buf[4096];
	size_t len;

	if (!(f = fopen(filename, "r"))) {
		fprintf(stderr, "[cgit] Unable to include %s: %s (%d)\n", filename, strerror(errno), errno);
		return;
	}
	while ((len = fread(buf, 1, sizeof(buf), f)) > 0)
		html_raw(buf, len);
	fclose(f);
}