parse_query.cc

Go to the documentation of this file.

/* Copyright 2006-2011 Savarese Software Research Corporation
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     https://www.savarese.com/software/ApacheLicense-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

#include <ssrc/wispers/fcgi/parse_query.h>
#include <ssrc/wispers/fcgi/URI.h>
#include <ssrc/wispers/utility/WebStrings.h>

#include <boost/algorithm/string/trim.hpp>

__BEGIN_NS_SSRC_WSPR_FCGI

// Note, this is an approximation because a header value could contain:
//   Foo-Header: foobar; bar=" foo=value"; foo=value
// In practice, that will not be the case for well-behaved programs.
string parse_header_attribute(const string & header_value,
                              const string & attribute,
                              string::size_type pos,
                              string::size_type *end)
{
  string attr = std::move(string(" ").append(attribute).append("="));
  string::size_type end_pos = 0;

  pos = header_value.find(attr, pos);

  if(pos != string::npos) {

    pos+=attr.size();

    if(pos < header_value.size()) {
      if(header_value[pos] == '"') {
        ++pos;
        end_pos = header_value.find('"', pos);
        if(end_pos == string::npos) {
          end_pos = pos;
        }
      } else {
        end_pos = header_value.find_first_of("; \r\n", pos + 1);

        if(end_pos == string::npos) {
          end_pos = header_value.size();
        }
      }
    } else {
      pos = 0;
    }
  } else {
    pos = 0;
  }

  if(end) {
    *end = end_pos;
  }

  return header_value.substr(pos, end_pos - pos);
}

void parse_query_string(const string & query_str, parameter_map & parameters) {
  using NS_SSRC_WSPR_UTILITY::unescape_url;

  if(query_str.empty())
    return;

  string::size_type and_pos = query_str.find('&');
  string::size_type eq_pos = query_str.find('=');
  string::size_type pos = 0;
  string name, value;

  while(eq_pos != string::npos) {
    while(and_pos < eq_pos || and_pos == string::npos) {
      if(and_pos == string::npos) {
        and_pos = query_str.size();
      } else {
        pos = and_pos + 1;
        and_pos = query_str.find('&', pos);
      }
    }

    const string::size_type key_size = eq_pos - pos;
    const string::size_type value_size = and_pos - eq_pos - 1;

    if(key_size > 0) {
      name.assign(query_str, pos, key_size);
      value.assign(query_str, eq_pos + 1, value_size);
      unescape_url(name);
      unescape_url(value);

      // We do not allow leading or trailing whitespace in input values.
      boost::algorithm::trim(value);

      parameters.insert(parameter_map::value_type(name, value));
    }

    eq_pos = query_str.find('=', and_pos);
  }
}

void parse_multipart_data(const string & data, const string & boundary,
                          parameter_map & parameters)
{
  const string::size_type step = boundary.size();
  const string::size_type max_pos = data.size();
  string::size_type pos = data.find(boundary), start;

  if(pos != string::npos) {
    pos+=step;   

    while(pos < max_pos && data[pos] != '-') {
      // Since we don't handle file data, we don't bother looking
      // for specific header fields.  Instead, we assume only the
      // Content-Disposition header contains a name attribute, thereby
      // allowing us to search only for the next name attribute.
      const string && name = parse_header_attribute(data, "name", pos, &pos);

      if(name.empty()) {
        break;
      }

      // Look for start of data.
      if((pos = data.find("\r\n\r\n", pos)) == string::npos) {
        break;
      }

      start = pos + 4;

      // Look for end of data.
      if((pos = data.find(boundary, start)) == string::npos) {
        break;
      }

      if(pos - 2 >= start) {
        parameters.insert(parameter_map::value_type(name, data.substr(start, pos - start - 2)));
      }

      pos+=step;
    }
  }
}

void parse_get_parameters(const FCGIRequest & request,
                          parameter_map & parameters)
{
  const char *query_str = request.fcgx_get_param("QUERY_STRING");

  if(!query_str || *query_str == 0) {
    const char *request_uri = request.fcgx_get_param("REQUEST_URI");
    if(request_uri) {
      URI uri(request_uri);
      parse_query_string(uri.query(), parameters);
    }
  } else
    parse_query_string(query_str, parameters);
}

void parse_post_parameters(const FCGIRequest & request,
                           parameter_map & parameters)
{
  const string && content_type = request.content_type();
  const bool is_urlencoded =
    (content_type.find("application/x-www-form-urlencoded") == 0);
  const bool is_multipart =
    (is_urlencoded ? false : (content_type.find( "multipart/form-data") == 0));

  // TODO: Check that content length is less than some maximum value first.
  if(is_urlencoded || is_multipart) {
    long length = request.content_length();

    if(length > 0) {
      string data(length, ' ');
      int bytes_read = 0, total = 0;

      // Using &data[i] as a contiguous buffer may not work with some
      // STL implementations, but C++ 0x requires the behavior.
      while(length > 0) {
        bytes_read = request.fcgx_get_str(&data[total], length);
        if(bytes_read <= 0)
          break;
        total+=bytes_read;
        length-=bytes_read;
      }

      // Ignore short reads.  The error will be handled elsewhere.
      if(length != 0)
        data.resize(total);

      if(is_urlencoded) {
        parse_query_string(data, parameters);
      } else {
        string boundary("--");
        boundary.append(parse_header_attribute(content_type, "boundary"));
        if(boundary.size() > 2) {
          parse_multipart_data(data, boundary, parameters);
        }
      }
    }
  }
}

__END_NS_SSRC_WSPR_FCGI