Mercurial > hg > rlgwebd
view webtty.js @ 190:11b7baed2e21
Stop printing credentials in the logfile.
This was nice for debugging, but could lead to security problems.
author | John "Elwin" Edwards |
---|---|
date | Sat, 31 Jan 2015 18:13:24 -0500 |
parents | 5372f1f97cf5 |
children |
line wrap: on
line source
#!/usr/bin/env node var localModules = '/usr/lib/node_modules/'; var http = require('http'); var url = require('url'); var path = require('path'); var fs = require('fs'); var pty = require(path.join(localModules, "pty.js")); var child_process = require("child_process"); var webSocketServer = require(path.join(localModules, "websocket")).server; var serveStaticRoot = fs.realpathSync("."); var sessions = {}; var nsessid = 0; var env_dontuse = {"TMUX": true, "TMUX_PANE": true}; /* Constructor for TermSessions. Note that it opens the terminal and * adds itself to the sessions dict. */ function TermSessionWS(conn, h, w) { var ss = this; /* Set up the sizes. */ w = Math.floor(Number(w)); if (!(w > 0 && w < 256)) w = 80; this.w = w; h = Math.floor(Number(h)); if (!(h > 0 && h < 256)) h = 25; this.h = h; this.conn = conn; /* Customize the environment. */ var childenv = {}; for (var key in process.env) { if (!(key in env_dontuse)) childenv[key] = process.env[key]; } var spawnopts = {"env": childenv, "cwd": process.env["HOME"], "rows": this.h, "cols": this.w}; this.term = pty.spawn("bash", [], spawnopts); this.alive = true; this.term.on("data", function (datastr) { var buf = new Buffer(datastr); if (ss.conn.connected) ss.conn.sendUTF(JSON.stringify({"t": "d", "d": buf.toString("hex")})); }); this.term.on("exit", function () { ss.alive = false; /* Wait for all the data to get collected */ setTimeout(ss.cleanup, 1000); }); this.conn.on("message", function (msg) { try { var msgObj = JSON.parse(msg.utf8Data); } catch (e) { return; } if (msgObj.t == "d") { var hexstr = msgObj["d"].replace(/[^0-9a-f]/gi, ""); if (hexstr.length % 2 != 0) { return; } var keybuf = new Buffer(hexstr, "hex"); ss.term.write(keybuf); } }); this.conn.on("close", function (msg) { if (ss.alive) ss.term.kill('SIGHUP'); console.log("WebSocket connection closed."); }); this.cleanup = function () { /* Call this when the child is dead. */ if (ss.alive) return; if (ss.conn.connected) { ss.conn.sendUTF(JSON.stringify({"t": "q"})); } }; sessions[nsessid++] = this; this.conn.sendUTF(JSON.stringify({"t": "l", "w": w, "h": h})); console.log("New WebSocket connection."); } function randkey() { rnum = Math.floor(Math.random() * 65536 * 65536); hexstr = rnum.toString(16); while (hexstr.length < 8) hexstr = "0" + hexstr; return hexstr; } /* Returns a list of the cookies in the request, obviously. */ function getCookies(req) { cookies = []; if ("cookie" in req.headers) { cookstrs = req.headers["cookie"].split("; "); for (var i = 0; i < cookstrs.length; i++) { eqsign = cookstrs[i].indexOf("="); if (eqsign > 0) { name = cookstrs[i].slice(0, eqsign).toLowerCase(); val = cookstrs[i].slice(eqsign + 1); cookies[name] = val; } else if (eqsign < 0) cookies[cookstrs[i]] = null; } } return cookies; } function urlDec(encstr) { var decstr = ""; var tnum; for (var i = 0; i < encstr.length; i++) { if (encstr.charAt(i) == "+") decstr += " "; else if (encstr.charAt(i) == "%") { tnum = Number("0x" + encstr.slice(i + 1, 2)); if (!isNaN(tnum) && tnum >= 0) decstr += String.fromCharCode(tnum); i += 2; } else decstr += encstr.charAt(i); } return decstr; } /* Returns the contents of a form */ function getFormValues(formtext) { var jsonobj; try { jsonobj = JSON.parse(formtext); } catch (e) { if (e instanceof SyntaxError) return null; } return jsonobj; } function serveStatic(req, res, fname) { var nname = path.normalize(fname); if (nname == "" || nname == "/") nname = "index-sh.html"; if (nname.match(/\/$/)) path.join(nname, "index.html"); /* it was a directory */ var realname = path.join(serveStaticRoot, nname); var extension = path.extname(realname); fs.exists(realname, function (exists) { var resheaders = {}; if (!exists || !extension || extension == ".html") resheaders["Content-Type"] = "text/html"; else if (extension == ".png") resheaders["Content-Type"] = "image/png"; else if (extension == ".css") resheaders["Content-Type"] = "text/css"; else if (extension == ".js") resheaders["Content-Type"] = "text/javascript"; else if (extension == ".svg") resheaders["Content-Type"] = "image/svg+xml"; else resheaders["Content-Type"] = "application/octet-stream"; if (exists) { /* Not nice, not sensible. First see if it's readable, then respond * 200 or 500. Don't throw nasty errors. */ res.writeHead(200, resheaders); fs.readFile(realname, function (error, data) { if (error) throw error; res.write(data); res.end(); }); } else { res.writeHead(404, resheaders); res.write("<html><head><title>" + nname + "</title></head>\n<body><h1>" + nname + " Not Found</h1></body></html>\n"); res.end(); } }); return; } var errorcodes = [ "Generic Error", "Not logged in", "Invalid data" ]; function sendError(res, ecode) { res.writeHead(200, { "Content-Type": "text/plain" }); if (!(ecode >= 0 && ecode < errorcodes.length)) ecode = 0; res.write(JSON.stringify({"t": "E", "c": ecode, "s": errorcodes[ecode]})); res.end(); } function handler(req, res) { /* default headers for the response */ var resheaders = {'Content-Type': 'text/html'}; /* The request body will be added to this as it arrives. */ var reqbody = ""; var formdata; /* Register a listener to get the body. */ function moredata(chunk) { reqbody += chunk; } req.on('data', moredata); /* This will send the response once the whole request is here. */ function respond() { var target = url.parse(req.url).pathname; /* Currently only static files and WebSockets are needed. */ if (req.method == 'POST') { formdata = getFormValues(reqbody); res.writeHead(405, resheaders); res.end(); } else if (req.method == 'GET' || req.method == 'HEAD') { serveStatic(req, res, target); } else { /* Some other method */ res.writeHead(501, resheaders); res.write("<html><head><title>501</title></head>\n<body><h1>501 Not Implemented</h1></body></html>\n"); res.end(); } return; } req.on('end', respond); } process.on("exit", function () { for (var sessid in sessions) { if (sessions[sessid].alive) sessions[sessid].term.kill('SIGHUP'); } console.log("Quitting..."); return; }); function wsRespond(req) { var w, h, conn; if (req.resourceURL.pathname == "/sock") { w = parseInt(req.resourceURL.query.w); if (isNaN(w) || w <= 0 || w > 256) w = 80; h = parseInt(req.resourceURL.query.h); if (isNaN(h) || h <= 0 || h > 256) h = 25; conn = req.accept(null, req.origin); new TermSessionWS(conn, h, w); } else { req.reject(404, "No such resource."); } } /* The pty.js module doesn't wait for the processes it spawns, so they * become zombies, which leads to unpleasantness when the system runs * out of process table entries. But if the child_process module is * initialized and a child spawned, node will continue waiting for any * children. * Someday, some developer will get the bright idea of tracking how many * processes the child_process module has spawned, and not waiting if * it's zero. Until then, the following useless line will protect us * from the zombie hordes. * Figuring this out was almost as interesting as the Rogue bug where * printf debugging altered whether the high score list was checked. */ child_process.spawn("/bin/true"); process.env["TERM"] = "xterm-256color"; var webServer = http.createServer(handler); webServer.listen(8080, "127.0.0.1"); console.log('Server running at http://127.0.0.1:8080/'); var wsServer = new webSocketServer({"httpServer": webServer}); wsServer.on("request", wsRespond); console.log('WebSockets online');