|
Lines 55-60
under scan_dir are scanned. This is usef
WebKitTools/pywebsocket/mod_pywebsocket/standalone.py_sec1
|
| 55 |
Note: |
55 |
Note: |
| 56 |
This server is derived from SocketServer.ThreadingMixIn. Hence a thread is |
56 |
This server is derived from SocketServer.ThreadingMixIn. Hence a thread is |
| 57 |
used for each request. |
57 |
used for each request. |
|
|
58 |
|
| 59 |
SECURITY WARNING: This uses CGIHTTPServer and CGIHTTPServer is not secure. |
| 60 |
It may execute arbitrary Python code or external programs. It should not be |
| 61 |
used outside a firewall. |
| 58 |
""" |
62 |
""" |
| 59 |
|
63 |
|
| 60 |
import BaseHTTPServer |
64 |
import BaseHTTPServer |
|
Lines 272-281
class WebSocketRequestHandler(CGIHTTPSer
WebKitTools/pywebsocket/mod_pywebsocket/standalone.py_sec2
|
| 272 |
def is_cgi(self): |
276 |
def is_cgi(self): |
| 273 |
"""Test whether self.path corresponds to a CGI script. |
277 |
"""Test whether self.path corresponds to a CGI script. |
| 274 |
|
278 |
|
| 275 |
Add extra check that self.path doesn't contains ..""" |
279 |
Add extra check that self.path doesn't contains .. |
|
|
280 |
Also check if the file is a executable file or not. |
| 281 |
If the file is not executable, it is handled as static file or dir |
| 282 |
rather than a CGI script. |
| 283 |
""" |
| 276 |
if CGIHTTPServer.CGIHTTPRequestHandler.is_cgi(self): |
284 |
if CGIHTTPServer.CGIHTTPRequestHandler.is_cgi(self): |
| 277 |
if '..' in self.path: |
285 |
if '..' in self.path: |
| 278 |
return False |
286 |
return False |
|
|
287 |
scriptfile = self.translate_path(self.path.split('?', 2)[0]) |
| 288 |
if not os.path.isfile(scriptfile): |
| 289 |
return False |
| 290 |
if not self.is_executable(scriptfile): |
| 291 |
return False |
| 279 |
return True |
292 |
return True |
| 280 |
return False |
293 |
return False |
| 281 |
|
294 |
|
|
Lines 321-346
def _alias_handlers(dispatcher, websock_
WebKitTools/pywebsocket/mod_pywebsocket/standalone.py_sec3
|
| 321 |
|
334 |
|
| 322 |
def _main(): |
335 |
def _main(): |
| 323 |
parser = optparse.OptionParser() |
336 |
parser = optparse.OptionParser() |
|
|
337 |
parser.add_option('-H', '--server-host', '--server_host', |
| 338 |
dest='server_host', |
| 339 |
default='', |
| 340 |
help='server hostname to listen to') |
| 324 |
parser.add_option('-p', '--port', dest='port', type='int', |
341 |
parser.add_option('-p', '--port', dest='port', type='int', |
| 325 |
default=handshake._DEFAULT_WEB_SOCKET_PORT, |
342 |
default=handshake._DEFAULT_WEB_SOCKET_PORT, |
| 326 |
help='port to listen to') |
343 |
help='port to listen to') |
| 327 |
parser.add_option('-w', '--websock_handlers', dest='websock_handlers', |
344 |
parser.add_option('-w', '--websock-handlers', '--websock_handlers', |
|
|
345 |
dest='websock_handlers', |
| 328 |
default='.', |
346 |
default='.', |
| 329 |
help='Web Socket handlers root directory.') |
347 |
help='Web Socket handlers root directory.') |
| 330 |
parser.add_option('-m', '--websock_handlers_map_file', |
348 |
parser.add_option('-m', '--websock-handlers-map-file', |
|
|
349 |
'--websock_handlers_map_file', |
| 331 |
dest='websock_handlers_map_file', |
350 |
dest='websock_handlers_map_file', |
| 332 |
default=None, |
351 |
default=None, |
| 333 |
help=('Web Socket handlers map file. ' |
352 |
help=('Web Socket handlers map file. ' |
| 334 |
'Each line consists of alias_resource_path and ' |
353 |
'Each line consists of alias_resource_path and ' |
| 335 |
'existing_resource_path, separated by spaces.')) |
354 |
'existing_resource_path, separated by spaces.')) |
| 336 |
parser.add_option('-s', '--scan_dir', dest='scan_dir', |
355 |
parser.add_option('-s', '--scan-dir', '--scan_dir', dest='scan_dir', |
| 337 |
default=None, |
356 |
default=None, |
| 338 |
help=('Web Socket handlers scan directory. ' |
357 |
help=('Web Socket handlers scan directory. ' |
| 339 |
'Must be a directory under websock_handlers.')) |
358 |
'Must be a directory under websock_handlers.')) |
| 340 |
parser.add_option('-d', '--document_root', dest='document_root', |
359 |
parser.add_option('-d', '--document-root', '--document_root', |
| 341 |
default='.', |
360 |
dest='document_root', default='.', |
| 342 |
help='Document root directory.') |
361 |
help='Document root directory.') |
| 343 |
parser.add_option('-x', '--cgi_paths', dest='cgi_paths', |
362 |
parser.add_option('-x', '--cgi-paths', '--cgi_paths', dest='cgi_paths', |
| 344 |
default=None, |
363 |
default=None, |
| 345 |
help=('CGI paths relative to document_root.' |
364 |
help=('CGI paths relative to document_root.' |
| 346 |
'Comma-separated. (e.g -x /cgi,/htbin) ' |
365 |
'Comma-separated. (e.g -x /cgi,/htbin) ' |
|
Lines 348-368
def _main():
WebKitTools/pywebsocket/mod_pywebsocket/standalone.py_sec4
|
| 348 |
'as CGI programs. Must be executable.')) |
367 |
'as CGI programs. Must be executable.')) |
| 349 |
parser.add_option('-t', '--tls', dest='use_tls', action='store_true', |
368 |
parser.add_option('-t', '--tls', dest='use_tls', action='store_true', |
| 350 |
default=False, help='use TLS (wss://)') |
369 |
default=False, help='use TLS (wss://)') |
| 351 |
parser.add_option('-k', '--private_key', dest='private_key', |
370 |
parser.add_option('-k', '--private-key', '--private_key', |
|
|
371 |
dest='private_key', |
| 352 |
default='', help='TLS private key file.') |
372 |
default='', help='TLS private key file.') |
| 353 |
parser.add_option('-c', '--certificate', dest='certificate', |
373 |
parser.add_option('-c', '--certificate', dest='certificate', |
| 354 |
default='', help='TLS certificate file.') |
374 |
default='', help='TLS certificate file.') |
| 355 |
parser.add_option('-l', '--log_file', dest='log_file', |
375 |
parser.add_option('-l', '--log-file', '--log_file', dest='log_file', |
| 356 |
default='', help='Log file.') |
376 |
default='', help='Log file.') |
| 357 |
parser.add_option('--log_level', type='choice', dest='log_level', |
377 |
parser.add_option('--log-level', '--log_level', type='choice', |
| 358 |
default='warn', |
378 |
dest='log_level', default='warn', |
| 359 |
choices=['debug', 'info', 'warn', 'error', 'critical'], |
379 |
choices=['debug', 'info', 'warn', 'error', 'critical'], |
| 360 |
help='Log level.') |
380 |
help='Log level.') |
| 361 |
parser.add_option('--log_max', dest='log_max', type='int', |
381 |
parser.add_option('--log-max', '--log_max', dest='log_max', type='int', |
| 362 |
default=_DEFAULT_LOG_MAX_BYTES, |
382 |
default=_DEFAULT_LOG_MAX_BYTES, |
| 363 |
help='Log maximum bytes') |
383 |
help='Log maximum bytes') |
| 364 |
parser.add_option('--log_count', dest='log_count', type='int', |
384 |
parser.add_option('--log-count', '--log_count', dest='log_count', |
| 365 |
default=_DEFAULT_LOG_BACKUP_COUNT, |
385 |
type='int', default=_DEFAULT_LOG_BACKUP_COUNT, |
| 366 |
help='Log backup count') |
386 |
help='Log backup count') |
| 367 |
parser.add_option('--strict', dest='strict', action='store_true', |
387 |
parser.add_option('--strict', dest='strict', action='store_true', |
| 368 |
default=False, help='Strictly check handshake request') |
388 |
default=False, help='Strictly check handshake request') |
|
Lines 407-413
def _main():
WebKitTools/pywebsocket/mod_pywebsocket/standalone.py_sec5
|
| 407 |
WebSocketRequestHandler.options = options |
427 |
WebSocketRequestHandler.options = options |
| 408 |
WebSocketServer.options = options |
428 |
WebSocketServer.options = options |
| 409 |
|
429 |
|
| 410 |
server = WebSocketServer(('', options.port), WebSocketRequestHandler) |
430 |
server = WebSocketServer((options.server_host, options.port), |
|
|
431 |
WebSocketRequestHandler) |
| 411 |
server.serve_forever() |
432 |
server.serve_forever() |
| 412 |
except Exception, e: |
433 |
except Exception, e: |
| 413 |
logging.critical(str(e)) |
434 |
logging.critical(str(e)) |