Replace the structs mdoc and man by a unified struct roff_man.

[mandoc.git] / man.cgi.8

diff --git a/man.cgi.8 b/man.cgi.8
index d68da6c2a5500b0280fa3652fb7889db4a7c09b3..4d3588b0160736fedbac898dfaf19edb9c851c79 100644 (file)
--- a/man.cgi.8
+++ b/man.cgi.8
@@ -1,4 +1,4 @@
-.\"     $Id: man.cgi.8,v 1.6 2014/07/13 15:38:36 schwarze Exp $
+.\"     $Id: man.cgi.8,v 1.11 2014/09/14 19:44:28 schwarze Exp $

 .\"
 .\" Copyright (c) 2014 Ingo Schwarze <schwarze@openbsd.org>
 .\"
 .\"
 .\" Copyright (c) 2014 Ingo Schwarze <schwarze@openbsd.org>
 .\"


@@ -14,7 +14,7 @@
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"
 .\" ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 .\" OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 .\"

-.Dd $Mdocdate: July 13 2014 $
+.Dd $Mdocdate: September 14 2014 $

 .Dt MAN.CGI 8
 .Os
 .Sh NAME
 .Dt MAN.CGI 8
 .Os
 .Sh NAME


@@ -43,6 +43,12 @@ either a name of a manual page or an
 using the syntax described in the
 .Xr apropos 1
 manual; filling this in is required for each search.
 using the syntax described in the
 .Xr apropos 1
 manual; filling this in is required for each search.

+.Pp
+The expression is broken into words at whitespace.
+Whitespace characters and backslashes can be escaped
+by prepending a backslash.
+The effect of prepending a backslash to another character is undefined;
+in the current implementation, it has no effect.

 .It
 A
 .Dq Submit
 .It
 A
 .Dq Submit


@@ -189,6 +195,11 @@ element.
 An ASCII string to be used for the HTML
 .Aq TITLE
 element.
 An ASCII string to be used for the HTML
 .Aq TITLE
 element.

+.It Ev HTTP_HOST
+The FQDN of the (possibly virtual) host the HTTP server is running on.
+This is used for
+.Ic Location:
+headers in HTTP 303 responses.

 .It Ev MAN_DIR
 A path to the
 .Nm
 .It Ev MAN_DIR
 A path to the
 .Nm


@@ -262,15 +273,38 @@ For backward compatibility with the traditional
 is supported as an alias for
 .Cm sec .
 .El
 is supported as an alias for
 .Cm sec .
 .El

+.Ss Restricted character set
+For security reasons, in particular to prevent cross site scripting
+attacks, some strings used by
+.Nm
+can only contain the following characters:
+.Pp
+.Bl -dash -compact -offset indent
+.It
+lower case and upper case ASCII letters
+.It
+the ten decimal digits
+.It
+the dash
+.Pq Sq -
+.It
+the dot
+.Pq Sq \&.
+.It
+the slash
+.Pq Sq /
+.It
+the underscore
+.Pq Sq _
+.El
+.Pp
+In particular, this applies to the
+.Ev SCRIPT_NAME ,
+to all manpaths, and to all architecture names.

 .Sh ENVIRONMENT
 The web server may pass the following CGI variables to
 .Nm :
 .Bl -tag -width Ds
 .Sh ENVIRONMENT
 The web server may pass the following CGI variables to
 .Nm :
 .Bl -tag -width Ds

-.It Ev HTTP_HOST
-The FQDN of the (possibly virtual) host the HTTP server is running on.
-This is used for
-.Ic Location:
-headers in HTTP 303 responses.

 .It Ev PATH_INFO
 The final part of the URI path passed from the client to the server,
 starting after the
 .It Ev PATH_INFO
 The final part of the URI path passed from the client to the server,
 starting after the


@@ -279,7 +313,7 @@ and ending before the
 .Ev QUERY_STRING .
 It is used by the
 .Cm show
 .Ev QUERY_STRING .
 It is used by the
 .Cm show

-page to aquire the manpath and filename it needs.
+page to acquire the manpath and filename it needs.

 .It Ev QUERY_STRING
 The HTTP query string passed from the client to the server.
 It is the final part of the URI, after the question mark.
 .It Ev QUERY_STRING
 The HTTP query string passed from the client to the server.
 It is the final part of the URI, after the question mark.


@@ -293,6 +327,10 @@ binary relative to the server root, usually
 .Pa /cgi-bin/man.cgi .
 This is used for generating URIs to be embedded
 in generated HTML code and HTTP headers.
 .Pa /cgi-bin/man.cgi .
 This is used for generating URIs to be embedded
 in generated HTML code and HTTP headers.

+If this contains any character not contained in the
+.Sx Restricted character set ,
+.Nm
+reports an internal server error and exits without doing anything.

 .El
 .Sh FILES
 .Bl -tag -width Ds
 .El
 .Sh FILES
 .Bl -tag -width Ds


@@ -332,6 +370,12 @@ Manual pages documenting
 itself, linked from the index page.
 .It Pa /man/manpath.conf
 The list of available manpaths, one per line.
 itself, linked from the index page.
 .It Pa /man/manpath.conf
 The list of available manpaths, one per line.

+If any of the lines in this file contains a slash
+.Pq Sq /
+or any character not contained in the
+.Sx Restricted character set ,
+.Nm
+reports an internal server error and exits without doing anything.

 .It Pa /man/OpenBSD-current/man1/mandoc.1
 An example
 .Xr mdoc 7
 .It Pa /man/OpenBSD-current/man1/mandoc.1
 An example
 .Xr mdoc 7