ROOTPLOIT

File: //usr/lib64/python3.8/__pycache__/cgi.cpython-38.pyc
U

&�.e���@sjdZdZddlmZmZmZddlmZddlZddl	Z	ddl
Zddlm
Z
ddlmZddlZddlZddlZdd	d
ddd
ddddddgZdadadd�Zdd�Zdd�Zdd�Zeadade	jdddfdd
�Zd1d!d�Zd"d#�Zd$d�Z Gd%d�d�Z!Gd&d	�d	�Z"e	jfd'd
�Z#d2d(d�Z$e	jfd)d�Z%d*d�Z&d+d�Z'd,d�Z(d-d�Z)d.d/�Z*e+d0k�rfe#�dS)3z�Support module for CGI (Common Gateway Interface) scripts.

This module defines a number of utilities for use by CGI scripts
written in Python.
z2.6�)�StringIO�BytesIO�
TextIOWrapper)�MappingN)�
FeedParser)�Message�MiniFieldStorage�FieldStorage�parse�parse_multipart�parse_header�test�print_exception�
print_environ�
print_form�print_directory�print_arguments�print_environ_usage�cGsFtr,ts,zttd�aWntk
r*YnXts6tantat|�dS)a�Write a log message, if there is a log file.

    Even though this function is called initlog(), you should always
    use log(); log is a variable that is set either to initlog
    (initially), to dolog (once the log file has been opened), or to
    nolog (when logging is disabled).

    The first argument is a format string; the remaining arguments (if
    any) are arguments to the % operator, so e.g.
        log("%s: %s", "a", "b")
    will write "a: b" to the log file, followed by a newline.

    If the global logfp is not None, it should be a file object to
    which log data is written.

    If the global logfp is None, the global logfile may be a string
    giving a filename to open, in append mode.  This file should be
    world writable!!!  If the file can't be opened, logging is
    silently disabled (since there is no safe place where we could
    send an error message).

    �aN)�logfile�logfp�open�OSError�nolog�log�dolog�Zallargs�r�/usr/lib64/python3.8/cgi.py�initlog8sr cGst�||d�dS)z=Write a log message to the log file.  See initlog() for docs.�
N)r�write)Zfmt�argsrrrr[srcGsdS)z9Dummy function, assigned to log when logging is disabled.Nrrrrrr_srcCsdatrt��datadS)zClose the log file.rN)rr�closer rrrrr�closelogcs
r%c
Cs^|dkrtj}t|d�r |j}nd}t|t�r4|j}d|krDd|d<|ddk�rt|d�\}}|dkrxt|||d	�S|d
kr�t	|d�}t
r�|t
kr�td��|�|��
|�}	nd
}	d|kr�|	r�|	d}	|	|d}	n*tjdd��r|	r�|	d}	|	tjd}	|	|d<n<d|k�r |d}	n(tjdd��r<tjd}	nd
}	|	|d<tjj|	||||d�S)a�Parse a query in the environment or from a file (default stdin)

        Arguments, all optional:

        fp              : file pointer; default: sys.stdin.buffer

        environ         : environment dictionary; default: os.environ

        keep_blank_values: flag indicating whether blank values in
            percent-encoded forms should be treated as blank strings.
            A true value indicates that blanks should be retained as
            blank strings.  The default false value indicates that
            blank values are to be ignored and treated as if they were
            not included.

        strict_parsing: flag indicating what to do with parsing errors.
            If false (the default), errors are silently ignored.
            If true, errors raise a ValueError exception.

        separator: str. The symbol to use for separating the query arguments.
            Defaults to &.
    N�encodingzlatin-1�REQUEST_METHOD�GET�POST�CONTENT_TYPEzmultipart/form-data)�	separator�!application/x-www-form-urlencoded�CONTENT_LENGTH�Maximum content length exceededr�QUERY_STRING�&�)r&r+)�sys�stdin�hasattrr&�
isinstancer�bufferrr�int�maxlen�
ValueError�read�decode�argv�urllibr
Zparse_qs)
�fp�environ�keep_blank_values�strict_parsingr+r&�ctype�pdictZclength�qsrrrr
vsL




��utf-8�replacer0csx|d�d�}d�|�}t�}|�|�z|d|d<Wntk
rLYnXt||||ddi|d���fd	d
��D�S)a�Parse multipart input.

    Arguments:
    fp   : input file
    pdict: dictionary containing other parameters of content-type header
    encoding, errors: request encoding and error handler, passed to
        FieldStorage

    Returns a dictionary just like parse_qs(): keys are the field names, each
    value is a list of values for that field. For non-file fields, the value
    is a list of strings.
    �boundary�asciiz multipart/form-data; boundary={}zCONTENT-LENGTHzContent-Lengthr'r))�headersr&�errorsr?r+csi|]}|��|��qSr)�getlist)�.0�k�Zfsrr�
<dictcomp>�sz#parse_multipart.<locals>.<dictcomp>)r;�formatrZset_type�KeyErrorr	)r>rCr&rJr+rGrBrIrrNrr�s


�ccs�|dd�dkr�|dd�}|�d�}|dkr`|�dd|�|�dd|�dr`|�d|d�}q&|dkrpt|�}|d|�}|��V||d�}qdS)Nr1�;r�"�\"�)�find�count�len�strip)�s�end�frrr�_parseparam�s
(
r]cCs�td|�}|��}i}|D]�}|�d�}|dkr|d|�����}||dd���}t|�dkr�|d|dkr�dkr�nn |dd�}|�d	d
��dd�}|||<q||fS)zfParse a Content-type like header.

    Return the main content-type and a dictionary of options.

    rR�=rNr1rU�����rSz\\�\rT)r]�__next__rVrY�lowerrXrF)�line�parts�keyrC�p�i�name�valuerrrr�s
,
c@s@eZdZdZdZdZdZdZiZdZ	iZ
iZdd�Zdd�Z
dS)rz=Like FieldStorage, for use when no file uploads are possible.NcCs||_||_dS)z&Constructor from field name and value.N�rhri��selfrhrirrr�__init__	szMiniFieldStorage.__init__cCsd|j|jfS)z Return printable representation.zMiniFieldStorage(%r, %r)rj�rlrrr�__repr__szMiniFieldStorage.__repr__)�__name__�
__module__�__qualname__�__doc__�filename�list�type�file�type_options�disposition�disposition_optionsrIrmrorrrrr�sc@s�eZdZdZdddejdddddddfdd�Zd	d
�Zdd�Zd
d�Z	dd�Z
dd�Zdd�Zdd�Z
d:dd�Zd;dd�Zdd�Zdd�Zdd �Zd!d"�Zd#d$�Zd%d&�ZdZd'd(�Zd)d*�Zd+Zd,d-�Zd.d/�Zd0d1�Zd2d3�Zd4d5�Zd6d7�Zd8d9�Z dS)<r	a�Store a sequence of fields, reading multipart/form-data.

    This class provides naming, typing, files stored on disk, and
    more.  At the top level, it is accessible like a dictionary, whose
    keys are the field names.  (Note: None can occur as a field name.)
    The items are either a Python list (if there's multiple values) or
    another FieldStorage or MiniFieldStorage object.  If it's a single
    object, it has the following attributes:

    name: the field name, if specified; otherwise None

    filename: the filename, if specified; otherwise None; this is the
        client side filename, *not* the file name on which it is
        stored (that's a temporary file you don't deal with)

    value: the value as a *string*; for file uploads, this
        transparently reads the file every time you request the value
        and returns *bytes*

    file: the file(-like) object from which you can read the data *as
        bytes* ; None if the data is stored a simple string

    type: the content-type, or None if not specified

    type_options: dictionary of options specified on the content-type
        line

    disposition: content-disposition, or None if not specified

    disposition_options: dictionary of corresponding options

    headers: a dictionary(-like) object (sometimes email.message.Message or a
        subclass thereof) containing *all* headers

    The class is subclassable, mostly for the purpose of overriding
    the make_file() method, which is called internally to come up with
    a file open for reading and writing.  This makes it possible to
    override the default choice of storing all files in a temporary
    directory and unlinking them as soon as they have been opened.

    N�rrErFcCsZd}||_||_|
|_||_d|kr0|d��}d|_|dksF|dkr�d|krX|d}
ntjdd�rrtjd}
nd}
|
�t	�
�d�}
t|
�}|dkr�d	d
i}|dkr�i}|dkr�d
|d	<d|kr�|d|d	<d|kr�|d|_d
|kr�|d
|d<nt|t
tf��std��||_|dk�r*tjj|_n<t|t��r@|j|_n&t|d��rXt|d��s`td��||_||_|	|_t|t��s�tdt|�j��||_d|_||_di}}d|jk�r�t|jd�\}}||_||_ d|_!d|k�r�|d|_!d|_"d|k�r
|d|_"|j"dk	|_#d	|jk�r6t|jd	�\}}n(|j�sH|dk�rTdi}}n
d
i}}||_||_$d|k�r�|d�|j|j�|_%nd|_%d}d|jk�r�zt&|jd�}Wnt'k
�r�YnXt(�r�|t(k�r�t'd��||_)|jdk�r|dk�r||_d|_*|_+d|_,|d
k�r,|�-�n*|dd�dk�rN|�.|||�n|�/�dS)a$Constructor.  Read multipart/* until last part.

        Arguments, all optional:

        fp              : file pointer; default: sys.stdin.buffer
            (not used when the request method is GET)
            Can be :
            1. a TextIOWrapper object
            2. an object whose read() and readline() methods return bytes

        headers         : header dictionary-like object; default:
            taken from environ as per CGI spec

        outerboundary   : terminating multipart boundary
            (for internal use only)

        environ         : environment dictionary; default: os.environ

        keep_blank_values: flag indicating whether blank values in
            percent-encoded forms should be treated as blank strings.
            A true value indicates that blanks should be retained as
            blank strings.  The default false value indicates that
            blank values are to be ignored and treated as if they were
            not included.

        strict_parsing: flag indicating what to do with parsing errors.
            If false (the default), errors are silently ignored.
            If true, errors raise a ValueError exception.

        limit : used internally to read parts of multipart/form-data forms,
            to exit from the reading loop when reached. It is the difference
            between the form content-length and the number of bytes already
            read

        encoding, errors : the encoding and error handler used to decode the
            binary stream to strings. Must be the same as the charset defined
            for the page sending the form (content-type : meta http-equiv or
            header)

        max_num_fields: int. If set, then __init__ throws a ValueError
            if there are more than n fields read by parse_qsl().

        r(r'NZHEADr/r1r�surrogateescapezcontent-typer,r)r*r-�content-lengthz?headers must be mapping or an instance of email.message.Messager:�readlinezfp must be file pointerz#outerboundary must be bytes, not %srzcontent-dispositionrhrtz
text/plainrGr{r_r.�
z
multipart/)0r@rA�max_num_fieldsr+�upper�
qs_on_postr2r<�encode�localeZgetpreferredencodingrr5rr�	TypeErrorrIr3r6r>rr4r&rJ�bytesrvrp�
outerboundary�
bytes_read�limitrryrzrhrt�_binary_filerx�
innerboundaryr7r9r8�lengthrurw�done�read_urlencoded�
read_multi�read_single)rlr>rIr�r?r@rAr�r&rJr�r+�methodrDZcdisprCrBZclenrrrrm?s�/
�


�






�

zFieldStorage.__init__cCs(z|j��Wntk
r"YnXdS�N)rwr$�AttributeErrorrnrrr�__del__�szFieldStorage.__del__cCs|Sr�rrnrrr�	__enter__�szFieldStorage.__enter__cGs|j��dSr�)rwr$)rlr#rrr�__exit__�szFieldStorage.__exit__cCsd|j|j|jfS)z"Return a printable representation.zFieldStorage(%r, %r, %r))rhrtrirnrrrro�s
�zFieldStorage.__repr__cCst|���Sr�)�iter�keysrnrrr�__iter__�szFieldStorage.__iter__cCsT|dkrt|��|jr:|j�d�|j��}|j�d�n|jdk	rL|j}nd}|S)Nrir)r�rw�seekr:rurkrrr�__getattr__�s

zFieldStorage.__getattr__cCs^|jdkrtd��g}|jD]}|j|kr|�|�q|sBt|��t|�dkrV|dS|SdS)zDictionary style indexing.N�
not indexabler1r)rur�rh�appendrQrX)rlre�found�itemrrr�__getitem__s


zFieldStorage.__getitem__cCs8||kr0||}t|t�r(dd�|D�S|jSn|SdS)z8Dictionary style get() method, including 'value' lookup.cSsg|]
}|j�qSr�ri�rL�xrrr�
<listcomp>sz)FieldStorage.getvalue.<locals>.<listcomp>N�r5ruri�rlre�defaultrirrr�getvalues
zFieldStorage.getvaluecCs4||kr,||}t|t�r$|djS|jSn|SdS)z! Return the first value received.rNr�r�rrr�getfirsts

zFieldStorage.getfirstcCs:||kr2||}t|t�r(dd�|D�S|jgSngSdS)z  Return list of received values.cSsg|]
}|j�qSrr�r�rrrr�.sz(FieldStorage.getlist.<locals>.<listcomp>Nr�)rlrerirrrrK)s

zFieldStorage.getlistcCs*|jdkrtd��ttdd�|jD���S)zDictionary style keys() method.Nr�css|]}|jVqdSr��rh�rLr�rrr�	<genexpr>8sz$FieldStorage.keys.<locals>.<genexpr>)rur��setrnrrrr�4s
zFieldStorage.keyscs*|jdkrtd��t�fdd�|jD��S)z%Dictionary style __contains__ method.Nr�c3s|]}|j�kVqdSr�r�r��rerrr�>sz,FieldStorage.__contains__.<locals>.<genexpr>)rur��any)rlrerr�r�__contains__:s
zFieldStorage.__contains__cCst|���S)z Dictionary style len(x) support.)rXr�rnrrr�__len__@szFieldStorage.__len__cCs|jdkrtd��t|j�S)NzCannot be converted to bool.)rur��boolrnrrr�__bool__Ds
zFieldStorage.__bool__c	Cs�|j�|j�}t|t�s0td|jt|�jf��|�|j	|j
�}|jrT|d|j7}tj
j||j|j|j	|j
|j|jd�}dd�|D�|_|��dS)z+Internal: read data in query string format.�%s should return bytes, got %sr0�r&rJr�r+cSsg|]\}}t||��qSr�r�rLrerirrrr�Vsz0FieldStorage.read_urlencoded.<locals>.<listcomp>N)r>r:r�r5r�r9rvrpr;r&rJr�r=r
�	parse_qslr@rAr�r+ru�
skip_lines)rlrD�queryrrrr�Is&
��zFieldStorage.read_urlencodedcCsL|j}t|�std|f��g|_|jrftjj|j|j|j	|j
|j|j|j
d�}|j�dd�|D��|jpp|j}|j��}t|t�s�td|jt|�jf��|jt|�7_|��d|jkr�|r�|j��}|jt|�7_q�|j}|dk	�r|t|j�8}t�}	d}
|j��}|
|7}
|���s�q0�q|
�s:�q@|jt|
�7_|	�|
�|j
|j��|	��}d	|k�rz|d	=|jdk�r�dn
|j|j}
||j||||||
|j
|j||j
�}|dk	�r�|d
8}|j�r�|t|j�8}|dk�r�td��|j|j7_|j�|�|j �s@|j|j!k�r4dk�rnn�q@�q|�"�dS)
z/Internal: read a part that is itself multipart.z&Invalid boundary in multipart form: %rr�css|]\}}t||�VqdSr�r�r�rrrr�fsz*FieldStorage.read_multi.<locals>.<genexpr>r��--Nr{r}r1rzMax number of fields exceeded)#r��valid_boundaryr9rur�r=r
r�r@rAr&rJr�r+�extend�FieldStorageClass�	__class__r>r~r5r�rvrpr�rXrYrZfeedr;r$r�r�r�r�r�)rlr?r@rAZibr��klassZ
first_liner��parserZhdr_text�datarIr��partrrrr�[s��

��





��

(zFieldStorage.read_multicCs4|jdkr|��|��n|��|j�d�dS)zInternal: read an atomic part.rN)r��read_binaryr��
read_linesrwr�rnrrrr��s


zFieldStorage.read_singlei cCs�|��|_|j}|dkr�|dkr�|j�t||j��}t|t�sVt	d|jt
|�jf��|jt
|�7_|std|_q�|j�|�|t
|�}qdS)zInternal: read binary data.rr�r_N)�	make_filerwr�r>r:�min�bufsizer5r�r9rvrpr�rXr�r")rlZtodor�rrrr��s

�zFieldStorage.read_binarycCs@|jrt�|_|_nt�|_|_|jr4|��n|��dS)z0Internal: read lines until EOF or outerboundary.N)r�rrw�_FieldStorage__filerr��read_lines_to_outerboundary�read_lines_to_eofrnrrrr��s
zFieldStorage.read_linescCsv|jdk	rF|j��t|�dkrF|��|_|j��}|j�|�d|_|jrZ|j�|�n|j�|�|j	|j
��dS)z line is always bytes, not stringNi�)r��tellrXr�rwr�r"r�r;r&rJ)rlrcr�rrrZ__write�s


zFieldStorage.__writecCs:|j�d�}|jt|�7_|s*d|_q6|�|�qdS)zInternal: read lines until EOF.�r_N)r>r~r�rXr��_FieldStorage__write)rlrcrrrr��szFieldStorage.read_lines_to_eofc	CsJd|j}|d}d}d}d}|jdk	rFd|jkr>|krFnn�qF|j�d�}|jt|�7_|t|�7}|s~d|_�qF|dkr�||}d}|�d�r�|r�|��}||kr��qF||kr�d	|_�qF|}|�	d
�r�d
}|dd�}d}nL|�	d��rd}|dd�}d}n*|�	d��r.d}|dd�}d
}nd}d
}|�
||�qdS)z�Internal: read lines until outerboundary.
        Data is read as bytes: boundaries and line ends must be converted
        to bytes for comparisons.
        r�r{TrNr�r_�
r1s
������
F)r�r�r>r~r�rXr��
startswith�rstrip�endswithr�)	rl�
next_boundary�
last_boundaryZdelim�last_line_lfendZ_readrc�strippedlineZodelimrrrr��sN
$
z(FieldStorage.read_lines_to_outerboundarycCs�|jr|jrdSd|j}|d}d}|j�d�}|jt|�7_|sPd|_q�|�d�r�|r�|��}||krpq�||kr�d|_q�|�d�}q&dS)z5Internal: skip lines until outer boundary if defined.Nr�Tr�r_r1r�)r�r�r>r~r�rXr�rY)rlr�r�r�rcr�rrrr�s$
zFieldStorage.skip_linescCs&|jrt�d�Stjd|jdd�SdS)a�Overridable: return a readable & writable file.

        The file will be used as follows:
        - data is written to it
        - seek(0)
        - data is read from it

        The file is opened in binary mode for files, in text mode
        for other fields

        This version opens a temporary file for reading and writing,
        and immediately deletes (unlinks) it.  The trick (on Unix!) is
        that the file can still be used, but it can't be opened by
        another process, and it will automatically be deleted when it
        is closed or when the current process terminates.

        If you want a more permanent file, you derive a class which
        overrides this method.  If you want a visible temporary file
        that is nevertheless automatically deleted when the script
        terminates, try defining a __del__ method in a derived class
        which unlinks the temporary files you have created.

        zwb+zw+r!)r&�newlineN)r��tempfileZ
TemporaryFiler&rnrrrr�(s
�zFieldStorage.make_file)N)N)!rprqrrrs�osr?rmr�r�r�ror�r�r�r�r�rKr�r�r�r�r�r�r�r�r�r�r�r�r�r�r�r�rrrrr	sL)�
&


E	
2cCs�td�t�tjt_zNt�}t�t�t|�t|�t	�dd�}|fdd�}td�|�Wnt
�YnXtd�daz&t�}t�t�t|�t|�Wnt
�YnXd	S)
z�Robust test CGI script, usable as main program.

    Write minimal HTTP headers and dump all information provided to
    the script in HTML form.

    zContent-type: text/htmlcSstd�dS)Nz,testing print_exception() -- <I>italics?</I>)�execrrrrr\[sztest.<locals>.fcSs
|�dSr�r)r\rrr�g]sztest.<locals>.gz9<H3>What follows is a test, not an actual exception:</H3>z*<H1>Second try with a small maxlen...</H1>�2N)�printr2�stdout�stderrr	rrrrrrr8)r?�formr\r�rrrr
Js4
c	Csx|dkrt��\}}}ddl}t�td�|�||�|�||�}tdt�d�|dd���t�|d�f�~dS)Nrz+<H3>Traceback (most recent call last):</H3>z<PRE>%s<B>%s</B></PRE>rr_)	r2�exc_info�	tracebackr��	format_tb�format_exception_only�html�escape�join)rvri�tbr�r�rurrrrqs

��c	Cs\t|���}t�td�td�|D]"}tdt�|�dt�||��q&td�t�dS)z#Dump the shell environment as HTML.z<H3>Shell Environment:</H3>�<DL>�<DT>�<DD>�</DL>N)�sortedr�r�r�r�)r?r�rerrrrs cCs�t|���}t�td�|s&td�td�|D]Z}tdt�|�ddd�||}tdt�tt|���d	�td
t�t|���q2td�t�dS)
z$Dump the contents of a form as HTML.z<H3>Form Contents:</H3>z<P>No form fields.r�r��:� )r[z<i>z</i>r�r�N)r�r�r�r�r��reprrv)r�r�rerirrrr�sc
Csjt�td�zt��}Wn6tk
rP}ztdt�t|���W5d}~XYnXtt�|��t�dS)z#Dump the current directory as HTML.z#<H3>Current Working Directory:</H3>zOSError:N)r�r��getcwdrr�r��str)�pwd�msgrrrr�s&cCs(t�td�t�ttj�t�dS)Nz <H3>Command Line Arguments:</H3>)r�r2r<rrrrr�s

cCstd�dS)z9Dump a list of environment variables used by CGI as HTML.a�
<H3>These environment variables could have been set:</H3>
<UL>
<LI>AUTH_TYPE
<LI>CONTENT_LENGTH
<LI>CONTENT_TYPE
<LI>DATE_GMT
<LI>DATE_LOCAL
<LI>DOCUMENT_NAME
<LI>DOCUMENT_ROOT
<LI>DOCUMENT_URI
<LI>GATEWAY_INTERFACE
<LI>LAST_MODIFIED
<LI>PATH
<LI>PATH_INFO
<LI>PATH_TRANSLATED
<LI>QUERY_STRING
<LI>REMOTE_ADDR
<LI>REMOTE_HOST
<LI>REMOTE_IDENT
<LI>REMOTE_USER
<LI>REQUEST_METHOD
<LI>SCRIPT_NAME
<LI>SERVER_NAME
<LI>SERVER_PORT
<LI>SERVER_PROTOCOL
<LI>SERVER_ROOT
<LI>SERVER_SOFTWARE
</UL>
In addition, HTTP headers sent by the server may be passed in the
environment as well.  Here are some common variable names:
<UL>
<LI>HTTP_ACCEPT
<LI>HTTP_CONNECTION
<LI>HTTP_HOST
<LI>HTTP_PRAGMA
<LI>HTTP_REFERER
<LI>HTTP_USER_AGENT
</UL>
N)r�rrrrr�scCs(ddl}t|t�rd}nd}|�||�S)Nrs^[ -~]{0,200}[!-~]$z^[ -~]{0,200}[!-~]$)�rer5r��match)rZr�Z_vb_patternrrrr��s

r��__main__)rErFr0)NNNN),rs�__version__�iorrrZcollections.abcrr2r�Zurllib.parser=Zemail.parserrZ
email.messagerr�r�r��__all__rrr rrr%rr8r?r
rr]rrr	r
rrrrrrr�rprrrr�<module>sh�#	�
F
:'
/