Codeform version 1.2.0 online!

dwks · 03-07-2007, 04:44 PM

Original codeform thread: http://cboard.cprogramming.com/showthread.php?p=632617

I've created a version of codeform that can be run online directly from your web browser! It's great. It's still very much under development, though. Check it out at http://dwks.theprogrammingsite.com/m...e/cfonline.htm

[edit] Okay, it's going to be down for a little while. [/edit]

The link is subject to change. If it does change I'll post the new link here. The main codeform page also links to there; if it changes, I'll change that too.

The online version (which is really just a Perl script that runs codeform on the web server) limits the input size to 32768 (also subject to change). If you want to format something larger, do it section by section or download the main version of codeform.

I'm worried about security holes. I never designed codeform for an internet environment and it may have buffer overruns or something, and this is the first CGI program I've ever written. Here's the Perl script I'm using. If there's anything wrong with it please let me know.

Code:

my $code = '';

my $key = '';
my $value = '';

my $input_format = '';
my $output_format = '';
my $style_format = '';

my $format = '';

my $max = 32768;

my %formats = qw(
    c_1_html => '',
    c_1_css => '',
    c_1_html => '',
    c_1_vbb => '',
    cpp_1_css => '',
    cpp_1_html => '',
    cpp_1_vbb => '',
    java_1_css => '',
    java_1_htm => '',
    java_1_vbb => ''
);  

print "Content-Type: text/html\n\n"
    . "<html><head><title>Codeform version 1.2.0 online -- finished</title>\n"
    . "</head>\n"
    . "<body><h1>Codeform version 1.2.0 online -- finished</h1><pre>\n";

$_ = <STDIN>;

tr/\+/ /;
s/%(..)/chr(hex($1))/ge;

while(/(\w+)=([^&]*)/g) {
    ($key, $value) = ($1, $2);

    if($1 eq 'code') {
        $code = $2;
    }
    elsif($1 eq 'input_format') {
        $input_format = &filename($value);
    }
    elsif($1 eq 'output_format') {
        $output_format = &filename($value);
    }
    elsif($1 eq 'style_format') {
        $style_format = &filename($value);
    }
}

#print "CODE BEFORE: ($code)\n";
$code = substr($code, 0, $max);
#print "CODE AFTER: ($code)\n";

#if($input_format eq '' || $output_format eq '' || $style_format eq '') {
#    print "$0: Format not specified\n";
#    exit(1);
#}

$format = "./rules/" . $input_format . "_" . $style_format . "_"
    . $output_format;
if(!exists($formats{$format})) {
    if($input_format eq 'cpp') {
        $format = "./rules/_" . $output_format
            . " -f ./rules/c_" . $style_format . " -f ./rules/cpp";
    }
    else {
        $format = "./rules/_" . $output_format
            . " -f ./rules/" . $input_format . "_" . $style_format;
    }
}

#print "FORMAT: ($format)\n";
#print "CALL: (./codeform -f $format -f rules/online)\n";

print "<textarea name=\"code\" rows=\"25\" cols=\"80\">\n";

if(!open(CODEFORM, "|./codeform -f $format -f rules/online")) {
    print "$0: Can't call codeform\n";
    exit(1);
}

print CODEFORM $code;
close CODEFORM;

print "</textarea>\n";
print "Input format: $input_format\n"
    . "Output format: $output_format\n"
    . "Style: $style_format\n";
print "<input type=\"button\" onClick=\"history.go(-1)\" value=\"Back\" />\n";
print "</pre></body></html>\n";

sub filename {
    $_[0] =~ s/[^\w_\d]//;
    return $_[0];
}

BTW, there's a bug in _css; it should contain this:

Code:

=midword
<::&lt;:
>::&gt;:

dwks · 03-07-2007, 10:20 PM

Okay, I've completely revamped the Perl script. I modularized it and started using the CGI module and fixed some security holes (before, you could specify any language etc some of the time). It looks like this now:

Code:

#!/usr/bin/perl
# codeform.pl by DWK
# Perl CGI script to execute codeform on a remote server

# Located at:
# http://dwks.theprogrammingsite.com/myprogs/down/codeform_online/codeform.pl

# Accessed from:
# http://dwks.theprogrammingsite.com/myprogs/down/codeform_online/cfonline.htm

use CGI qw/:standard/;

my $max = 32768;  # Maximum length in bytes of code (truncuated to this size)

# Valid compound rules files (excluding directory) for codeform
my @formats = qw/
    c_1_html
    c_1_css
    c_1_html
    c_1_vbb
    cpp_1_css
    cpp_1_html
    cpp_1_vbb
    java_1_css
    java_1_htm
    java_1_vbb
/;

# Valid input file formats for codeform
my @inputs = qw/
    c
    cpp
    java
/;

# Valid output file formats for codeform
my @outputs = qw/
    html
    vbb
    css
/;

# Valid styles for codeform
my @styles = qw/
    1
    devcpp
    kate
    scite
/;

&main();

sub main {
    print header;
    print "<html><head><title>Codeform version 1.2.0 online -- finished</title>\n"
        . "</head>\n"
        . "<body><h1>Codeform version 1.2.0 online -- finished</h1>\n";
    
    &execute_codeform(&generate_rules_file_list());
    
    print "<input type=\"button\" onClick=\"history.go(-1)\" value=\"Back\" />\n";
    print "</body></html>\n";
}

sub parse_parameter {
    my $param = $_[0];
    my $filename = param($param);
    
    if(!defined($filename)) {
        print "$0: Undefined parameter: $param\n";
        exit(1);
    }
    
    $filename =~ s/[^\w_\d]//;
    return $filename;
}

sub find_in_array {
    my $look = shift;
    
    foreach(@_) {
        if($look eq $_) {
            return 1;  # $look exists in the list
        }
    }
    
    return 0;
}

sub validate_name {
    if(!&find_in_array(@_)) {
        print "$0: Unknown format: \"$_[0]\"\n";
        exit(1);
    }
}

sub generate_rules_file_list {
    # Get the data from the parameters
    my $input = &parse_parameter('input');
    my $output = &parse_parameter('output');
    my $style = &parse_parameter('style');
    
    # Try a compound rule
    my $format = "./rules/" . $input . "_" . $style . "_" . $output;
    
    if(!&find_in_array($format, @formats)) {  # The format is not a compound
        &non_compound_format($input, $output, $style);
    }
    
    print "<pre>Input format: $input\n"
        . "Output format: $output\n"
        . "Style: $style</pre>\n";
    
    return $format;
}

sub non_compound_format {
    my $input = $_[0];
    my $output = $_[1];
    my $style = $_[2];
    
    &validate_name($input, @inputs);
    &validate_name($output, @outputs);
    &validate_name($style, @styles);
    
    if($input eq 'cpp') {  # Use ordinary C rules and add ./rules/cpp for C++
        $format = "./rules/_" . $output . " -f ./rules/c_" . $style
            . " -f ./rules/cpp";
    }
    else {
        $format = "./rules/_" . $output . " -f ./rules/" . $input . "_"
            . $style;
    }
}

sub execute_codeform {
    my $command = "./codeform -f $_[0] -f rules/online";
    
    print "<p><b><big>Code:</big></b><br />\n"
        . "<textarea name=\"code\" rows=\"25\" cols=\"80\">\n";
    
    if(!open(CODEFORM, "|$command")) {
        print "$0: Can't open pipe: \"$command\"\n";
        exit(1);
    }
    
    $code = substr(param('code'), 0, $max);  # Limit the code to $max characters
    
    print CODEFORM $code;
    close CODEFORM;
    
    print "</textarea></p>\n";
}

No, I have no idea what the extra asterisk that seems to keep appearing at the end of the generated text is.

dwks · 03-10-2007, 01:54 PM

[I would have edited the last post but it is too old now, and I can't.]

Well, it seems like I may not be able to get this to work. The script is running as the default FTP user, which means it can read, delete, and execute practically every file on the server, including those belonging to the fifty or so other users hosted on that server.

I can't create a new user and run the script with that; nor can I use another host such as tripod.lycos.co.uk because with those scripts I can't execute codeform.

So what I need is a restricted user that can still execute a program (codeform). If anyone knows how I could do this or knows of a host that allows it, please let me know.

If I can't get that to work, I might require a password to execute codeform online or something; that way myself and anyone who requests the password can execute it. That idea has problems, too: I've never used Perl's security functions or whatever, and what if someone signed up at CBoard just to ask me for the password so that they could crash the server? . . . all in all not a good solution.

Perhaps I could convert codeform's source code to Perl somehow and embed it in that script, or create a CGI program in C or C++ compiled with codeform . . . can you do that?

Anyway, I'm open to suggestions.

siavoshkc · Yesterday, 10:31 AM

Why using Perl?

twomers · Yesterday, 10:34 AM

Hey siav..., is your one still around?

kryptkat · Yesterday, 11:56 AM

edit arrgh color did not copy and paste!

very nice little prog. much better than the other two i looked at.

suggestion 1

color control. allow user to select or set other colors and for what they are used for.

suggestion 2

win api recognition.

siavoshkc · Yesterday, 08:20 PM

Quote:

Hey siav..., is your one still around?

Mine is not supported anymore!!! I have no time to make the final version. Maybe in the summer.

03-10-2007, 01:54 PM	#3
dwks DWK Join Date: Apr 2005 Location: Canada Posts: 4,087	[I would have edited the last post but it is too old now, and I can't.] Well, it seems like I may not be able to get this to work. The script is running as the default FTP user, which means it can read, delete, and execute practically every file on the server, including those belonging to the fifty or so other users hosted on that server. I can't create a new user and run the script with that; nor can I use another host such as tripod.lycos.co.uk because with those scripts I can't execute codeform. So what I need is a restricted user that can still execute a program (codeform). If anyone knows how I could do this or knows of a host that allows it, please let me know. If I can't get that to work, I might require a password to execute codeform online or something; that way myself and anyone who requests the password can execute it. That idea has problems, too: I've never used Perl's security functions or whatever, and what if someone signed up at CBoard just to ask me for the password so that they could crash the server? . . . all in all not a good solution. Perhaps I could convert codeform's source code to Perl somehow and embed it in that script, or create a CGI program in C or C++ compiled with codeform . . . can you do that? Anyway, I'm open to suggestions. __________________ dwk Seek and ye shall find. quaere et invenies. (Latin by dwks.) "Only those who will risk going too far can possibly find out how far one can go." -- TS Eliot "I have not failed. I've just found 10,000 ways that won't work." -- Thomas Alva Edison "The only real mistake is the one from which we learn nothing." -- John Powell My website: http://dwks.theprogrammingsite.com/ Other programming boards: TPSBoard DaniWeb codeform version 1.2.0 online is here!
dwks is online now

Yesterday, 10:31 AM	#4
siavoshkc System Novice Join Date: Jan 2006 Location: Tehran Posts: 924	Why using Perl? __________________ Microsoft Visual Studio 2005 Professional (On Microsoft Windows XP SP2) gcc (On Fedora Core 5) Code: push offset string "Live FREE, die WELL!" (404228h) Learn the language before using it. (C++ Books and C Books) Read the FAQ before making a problem. Then make a Google and Forum search. Download my code painter from here.<<<<Not Now SiavoshKC
siavoshkc is offline

Yesterday, 10:34 AM	#5
twomers Registered Pusher Join Date: Dec 2005 Location: Ireland Posts: 1,527	Hey siav..., is your one still around? __________________ "I will show you fear in a handful of dust." - TS Eliot Foreman: You stash your drugs in a lupus textbook? House: It's never lupus
twomers is offline

Yesterday, 11:56 AM	#6
kryptkat Registered User Join Date: Dec 2002 Posts: 284	edit arrgh color did not copy and paste! very nice little prog. much better than the other two i looked at. suggestion 1 color control. allow user to select or set other colors and for what they are used for. suggestion 2 win api recognition. Last edited by kryptkat : Yesterday at 12:00 PM.
kryptkat is offline

Thread Tools	Search this Thread
Show Printable Version Email this Page Subscribe to this Thread Add a Poll to this Thread	Search this Thread: Advanced Search
Display Modes	Rate This Thread
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode	Rate This Thread:

vBulletin Message

Cancel Changes