Don't let HTTP API pass through untrusted function

[minetest.git] / src / script / lua_api / l_http.cpp

diff --git a/src/script/lua_api/l_http.cpp b/src/script/lua_api/l_http.cpp
index ac261cd6038d4ff8039a0a33a210092aecde71ac..b385b698c8a56a576b8512bf9727e60c5e4c8069 100644 (file)
--- a/src/script/lua_api/l_http.cpp
+++ b/src/script/lua_api/l_http.cpp
@@ -42,34 +42,52 @@ void ModApiHttp::read_http_fetch_request(lua_State *L, HTTPFetchRequest &req)
 
        req.caller = httpfetch_caller_alloc_secure();
        getstringfield(L, 1, "url", req.url);
-       lua_getfield(L, 1, "user_agent");
-       if (lua_isstring(L, -1))
-               req.useragent = getstringfield_default(L, 1, "user_agent", "");
-       lua_pop(L, 1);
+       getstringfield(L, 1, "user_agent", req.useragent);
        req.multipart = getboolfield_default(L, 1, "multipart", false);
-       req.timeout = getintfield_default(L, 1, "timeout", 3) * 1000;
+       if (getintfield(L, 1, "timeout", req.timeout))
+               req.timeout *= 1000;
+
+       lua_getfield(L, 1, "method");
+       if (lua_isstring(L, -1)) {
+               std::string mth = getstringfield_default(L, 1, "method", "");
+               if (mth == "GET")
+                       req.method = HTTP_GET;
+               else if (mth == "POST")
+                       req.method = HTTP_POST;
+               else if (mth == "PUT")
+                       req.method = HTTP_PUT;
+               else if (mth == "DELETE")
+                       req.method = HTTP_DELETE;
+       }
+       lua_pop(L, 1);
 
-       // post_data: if table, post form data, otherwise raw data
+       // post_data: if table, post form data, otherwise raw data DEPRECATED use data and method instead
        lua_getfield(L, 1, "post_data");
+       if (lua_isnil(L, 2)) {
+               lua_pop(L, 1);
+               lua_getfield(L, 1, "data");
+       }
+       else {
+               req.method = HTTP_POST;
+       }
+
        if (lua_istable(L, 2)) {
                lua_pushnil(L);
-               while (lua_next(L, 2) != 0)
-               {
-                       req.post_fields[luaL_checkstring(L, -2)] = luaL_checkstring(L, -1);
+               while (lua_next(L, 2) != 0) {
+                       req.fields[readParam<std::string>(L, -2)] = readParam<std::string>(L, -1);
                        lua_pop(L, 1);
                }
        } else if (lua_isstring(L, 2)) {
-               req.post_data = readParam<std::string>(L, 2);
+               req.raw_data = readParam<std::string>(L, 2);
        }
+
        lua_pop(L, 1);
 
        lua_getfield(L, 1, "extra_headers");
        if (lua_istable(L, 2)) {
                lua_pushnil(L);
-               while (lua_next(L, 2) != 0)
-               {
-                       const char *header = luaL_checkstring(L, -1);
-                       req.extra_headers.emplace_back(header);
+               while (lua_next(L, 2) != 0) {
+                       req.extra_headers.emplace_back(readParam<std::string>(L, -1));
                        lua_pop(L, 1);
                }
        }
@@ -83,7 +101,25 @@ void ModApiHttp::push_http_fetch_result(lua_State *L, HTTPFetchResult &res, bool
        setboolfield(L, -1, "timeout", res.timeout);
        setboolfield(L, -1, "completed", completed);
        setintfield(L, -1, "code", res.response_code);
-       setstringfield(L, -1, "data", res.data.c_str());
+       setstringfield(L, -1, "data", res.data);
+}
+
+// http_api.fetch_sync(HTTPRequest definition)
+int ModApiHttp::l_http_fetch_sync(lua_State *L)
+{
+       NO_MAP_LOCK_REQUIRED;
+
+       HTTPFetchRequest req;
+       read_http_fetch_request(L, req);
+
+       infostream << "Mod performs HTTP request with URL " << req.url << std::endl;
+
+       HTTPFetchResult res;
+       httpfetch_sync(req, res);
+
+       push_http_fetch_result(L, res, true);
+
+       return 1;
 }
 
 // http_api.fetch_async(HTTPRequest definition)
@@ -94,7 +130,7 @@ int ModApiHttp::l_http_fetch_async(lua_State *L)
        HTTPFetchRequest req;
        read_http_fetch_request(L, req);
 
-       actionstream << "Mod performs HTTP request with URL " << req.url << std::endl;
+       infostream << "Mod performs HTTP request with URL " << req.url << std::endl;
        httpfetch_async(req);
 
        // Convert handle to hex string since lua can't handle 64-bit integers
@@ -127,6 +163,20 @@ int ModApiHttp::l_http_fetch_async_get(lua_State *L)
        return 1;
 }
 
+int ModApiHttp::l_set_http_api_lua(lua_State *L)
+{
+       NO_MAP_LOCK_REQUIRED;
+
+       // This is called by builtin to give us a function that will later
+       // populate the http_api table with additional method(s).
+       // We need this because access to the HTTP api is security-relevant and
+       // any mod could just mess with a global variable.
+       luaL_checktype(L, 1, LUA_TFUNCTION);
+       lua_rawseti(L, LUA_REGISTRYINDEX, CUSTOM_RIDX_HTTP_API_LUA);
+
+       return 0;
+}
+
 int ModApiHttp::l_request_http_api(lua_State *L)
 {
        NO_MAP_LOCK_REQUIRED;
@@ -169,25 +219,57 @@ int ModApiHttp::l_request_http_api(lua_State *L)
                return 1;
        }
 
-       lua_getglobal(L, "core");
-       lua_getfield(L, -1, "http_add_fetch");
+       lua_rawgeti(L, LUA_REGISTRYINDEX, CUSTOM_RIDX_HTTP_API_LUA);
+       assert(lua_isfunction(L, -1));
 
        lua_newtable(L);
        HTTP_API(fetch_async);
        HTTP_API(fetch_async_get);
 
        // Stack now looks like this:
-       // <core.http_add_fetch> <table with fetch_async, fetch_async_get>
-       // Now call core.http_add_fetch to append .fetch(request, callback) to table
+       // <function> <table with fetch_async, fetch_async_get>
+       // Now call it to append .fetch(request, callback) to table
        lua_call(L, 1, 1);
 
        return 1;
 }
+
+int ModApiHttp::l_get_http_api(lua_State *L)
+{
+       NO_MAP_LOCK_REQUIRED;
+
+       lua_newtable(L);
+       HTTP_API(fetch_async);
+       HTTP_API(fetch_async_get);
+       HTTP_API(fetch_sync);
+
+       return 1;
+}
+
 #endif
 
 void ModApiHttp::Initialize(lua_State *L, int top)
 {
 #if USE_CURL
-       API_FCT(request_http_api);
+
+       bool isMainmenu = false;
+#ifndef SERVER
+       isMainmenu = ModApiBase::getGuiEngine(L) != nullptr;
+#endif
+
+       if (isMainmenu) {
+               API_FCT(get_http_api);
+       } else {
+               API_FCT(request_http_api);
+               API_FCT(set_http_api_lua);
+       }
+
+#endif
+}
+
+void ModApiHttp::InitializeAsync(lua_State *L, int top)
+{
+#if USE_CURL
+       API_FCT(get_http_api);
 #endif
 }