luci-base: harden cookie sysauth=

[project/luci.git] / modules / luci-base / luasrc / util.lua

diff --git a/modules/luci-base/luasrc/util.lua b/modules/luci-base/luasrc/util.lua
index 896e36b..ce42af2 100644 (file)
--- a/modules/luci-base/luasrc/util.lua
+++ b/modules/luci-base/luasrc/util.lua
@@ -10,13 +10,14 @@ local string = require "string"
 local coroutine = require "coroutine"
 local tparser = require "luci.template.parser"
 local json = require "luci.jsonc"
+local lhttp = require "lucihttp"
 
 local _ubus = require "ubus"
 local _ubus_connection = nil
 
 local getmetatable, setmetatable = getmetatable, setmetatable
 local rawget, rawset, unpack = rawget, rawset, unpack
-local tostring, type, assert = tostring, type, assert
+local tostring, type, assert, error = tostring, type, assert, error
 local ipairs, pairs, next, loadstring = ipairs, pairs, next, loadstring
 local require, pcall, xpcall = require, pcall, xpcall
 local collectgarbage, get_memory_limit = collectgarbage, get_memory_limit
@@ -27,14 +28,27 @@ module "luci.util"
 -- Pythonic string formatting extension
 --
 getmetatable("").__mod = function(a, b)
+       local ok, res
+
        if not b then
                return a
        elseif type(b) == "table" then
+               local k, _
                for k, _ in pairs(b) do if type(b[k]) == "userdata" then b[k] = tostring(b[k]) end end
-               return a:format(unpack(b))
+
+               ok, res = pcall(a.format, a, unpack(b))
+               if not ok then
+                       error(res, 2)
+               end
+               return res
        else
                if type(b) == "userdata" then b = tostring(b) end
-               return a:format(b)
+
+               ok, res = pcall(a.format, a, b)
+               if not ok then
+                       error(res, 2)
+               end
+               return res
        end
 end
 
@@ -147,10 +161,33 @@ function pcdata(value)
        return value and tparser.pcdata(tostring(value))
 end
 
+function urlencode(value)
+       if value ~= nil then
+               local str = tostring(value)
+               return lhttp.urlencode(str, lhttp.ENCODE_IF_NEEDED + lhttp.ENCODE_FULL)
+                       or str
+       end
+       return nil
+end
+
+function urldecode(value, decode_plus)
+       if value ~= nil then
+               local flag = decode_plus and lhttp.DECODE_PLUS or 0
+               local str = tostring(value)
+               return lhttp.urldecode(str, lhttp.DECODE_IF_NEEDED + flag)
+                       or str
+       end
+       return nil
+end
+
 function striptags(value)
        return value and tparser.striptags(tostring(value))
 end
 
+function shellquote(value)
+       return string.format("'%s'", string.gsub(value or "", "'", "'\\''"))
+end
+
 -- for bash, ash and similar shells single-quoted strings are taken
 -- literally except for single quotes (which terminate the string)
 -- (and the exception noted below for dash (-) at the start of a
@@ -370,16 +407,6 @@ function clone(object, deep)
 end
 
 
-function dtable()
-        return setmetatable({}, { __index =
-                function(tbl, key)
-                        return rawget(tbl, key)
-                         or rawget(rawset(tbl, key, dtable()), key)
-                end
-        })
-end
-
-
 -- Serialize the contents of a table value.
 function _serialize_table(t, seen)
        assert(not seen[t], "Recursion detected.")
@@ -604,6 +631,20 @@ function execl(command)
        return data
 end
 
+
+local ubus_codes = {
+       "INVALID_COMMAND",
+       "INVALID_ARGUMENT",
+       "METHOD_NOT_FOUND",
+       "NOT_FOUND",
+       "NO_DATA",
+       "PERMISSION_DENIED",
+       "TIMEOUT",
+       "NOT_SUPPORTED",
+       "UNKNOWN_ERROR",
+       "CONNECTION_FAILED"
+}
+
 function ubus(object, method, data)
        if not _ubus_connection then
                _ubus_connection = _ubus.connect()
@@ -614,7 +655,8 @@ function ubus(object, method, data)
                if type(data) ~= "table" then
                        data = { }
                end
-               return _ubus_connection:call(object, method, data)
+               local rv, err = _ubus_connection:call(object, method, data)
+               return rv, err, ubus_codes[err]
        elseif object then
                return _ubus_connection:signatures(object)
        else
@@ -639,10 +681,11 @@ end
 function checklib(fullpathexe, wantedlib)
        local fs = require "nixio.fs"
        local haveldd = fs.access('/usr/bin/ldd')
-       if not haveldd then
+       local haveexe = fs.access(fullpathexe)
+       if not haveldd or not haveexe then
                return false
        end
-       local libs = exec("/usr/bin/ldd " .. fullpathexe)
+       local libs = exec(string.format("/usr/bin/ldd %s", shellquote(fullpathexe)))
        if not libs then
                return false
        end