More sanitizing input, fix issue with parsing time on MySQL.

experimental/webtry/webtry.go

 package main
 
 import (
         "bytes"
         "crypto/md5"
         "database/sql"
         "encoding/base64"
         "encoding/json"
         "flag"
         "fmt"
@@ skipping 16 matching lines @@
         RESULT_COMPILE = `c++ -DSK_GAMMA_SRGB -DSK_GAMMA_APPLY_TO_A8 -DSK_SCALAR_TO_FLOAT_EXCLUDED -DSK_ALLOW_STATIC_GLOBAL_INITIALIZERS=1 -DSK_SUPPORT_GPU=0 -DSK_SUPPORT_OPENCL=0 -DSK_FORCE_DISTANCEFIELD_FONTS=0 -DSK_SCALAR_IS_FLOAT -DSK_CAN_USE_FLOAT -DSK_SAMPLES_FOR_X -DSK_BUILD_FOR_UNIX -DSK_USE_POSIX_THREADS -DSK_SYSTEM_ZLIB=1 -DSK_DEBUG -DSK_DEVELOPER=1 -I../../src/core -I../../src/images -I../../tools/flags -I../../include/config -I../../include/core -I../../include/pathops -I../../include/pipe -I../../include/effects -I../../include/ports -I../../src/sfnt -I../../include/utils -I../../src/utils -I../../include/images -g -fno-exceptions -fstrict-aliasing -Wall -Wextra -Winit-self -Wpointer-arith -Wno-unused-parameter -Wno-c++11-extensions -Werror -m64 -fno-rtti -Wnon-virtual-dtor -c ../../../cache/%s.cpp -o ../../../cache/%s.o`
         LINK           = `c++ -m64 -lstdc++ -lm -o ../../../inout/%s -Wl,--start-group ../../../cache/%s.o obj/experimental/webtry/webtry.main.o obj/gyp/libflags.a libskia_images.a libskia_core.a libskia_effects.a obj/gyp/libjpeg.a obj/gyp/libwebp_dec.a obj/gyp/libwebp_demux.a obj/gyp/libwebp_dsp.a obj/gyp/libwebp_enc.a obj/gyp/libwebp_utils.a libskia_utils.a libskia_opts.a libskia_opts_ssse3.a libskia_ports.a libskia_sfnt.a -Wl,--end-group -lpng -lz -lgif -lpthread -lfontconfig -ldl -lfreetype`
         DEFAULT_SAMPLE = `SkPaint p;
 p.setColor(SK_ColorRED);
 p.setAntiAlias(true);
 p.setStyle(SkPaint::kStroke_Style);
 p.setStrokeWidth(10);
 
 canvas->drawLine(20, 20, 100, 100, p);
 `
+        // Don't increase above 2^16 w/o altering the db tables to accept something bigger than TEXT.
+        MAX_TRY_SIZE = 64000
 )
 
 var (
         // codeTemplate is the cpp code template the user's code is copied into.
         codeTemplate *template.Template = nil
 
         // indexTemplate is the main index.html page we serve.
         indexTemplate *htemplate.Template = nil
 
         // recentTemplate is a list of recent  images.
@@ skipping 61 matching lines @@
         req.Header.Add("X-Google-Metadata-Request", "True")
         if resp, err := client.Do(req); err == nil {
                 password, err := ioutil.ReadAll(resp.Body)
                 if err != nil {
                         log.Printf("ERROR: Failed to read password from metadata server: %q\n", err)
                         panic(err)
                 }
                 // The IP address of the database is found here:
                 //    https://console.developers.google.com/project/31977622648/sql/instances/webtry/overview
                 // And 3306 is the default port for MySQL.
-                db, err = sql.Open("mysql", fmt.Sprintf("webtry:%s@tcp(173.194.83.52:3306)/webtry", password))
+                db, err = sql.Open("mysql", fmt.Sprintf("webtry:%s@tcp(173.194.83.52:3306)/webtry?parseTime=true", password))
                 if err != nil {
                         log.Printf("ERROR: Failed to open connection to SQL server: %q\n", err)
                         panic(err)
                 }
         } else {
                 // Fallback to sqlite for local use.
                 db, err = sql.Open("sqlite3", "./webtry.db")
                 if err != nil {
                         log.Printf("ERROR: Failed to open: %q\n", err)
                         panic(err)
@@ skipping 156 matching lines @@
                         log.Printf("Error: failed to fetch from database: %q", err)
                         continue
                 }
                 recent = append(recent, Try{Hash: hash, CreateTS: create_ts.Format("2006-02-01")})
         }
         if err := recentTemplate.Execute(w, Recent{Tries: recent}); err != nil {
                 log.Printf("ERROR: Failed to expand template: %q\n", err)
         }
 }
 
+// hasPreProcessor returns true if any line in the code begins with a # char.
+func hasPreProcessor(code string) bool {
+        lines := strings.Split(code, "\n")
+        for _, s := range lines {
+                if strings.HasPrefix(strings.TrimSpace(s), "#") {
+                        return true
+                }
+        }
+        return false
+}
+
 // mainHandler handles the GET and POST of the main page.
 func mainHandler(w http.ResponseWriter, r *http.Request) {
         log.Printf("Main Handler: %q\n", r.URL.Path)
         if r.Method == "GET" {
                 code := DEFAULT_SAMPLE
                 match := directLink.FindStringSubmatch(r.URL.Path)
                 if len(match) == 2 && r.URL.Path != "/" {
                         hash := match[1]
                         if db == nil {
                                 http.NotFound(w, r)
                                 return
                         }
                         // Update 'code' with the code found in the database.
                         if err := db.QueryRow("SELECT code FROM webtry WHERE hash=?", hash).Scan(&code); err != nil {
                                 http.NotFound(w, r)
                                 return
                         }
                 }
                 // Expand the template.
                 if err := indexTemplate.Execute(w, userCode{UserCode: code}); err != nil {
                         log.Printf("ERROR: Failed to expand template: %q\n", err)
                 }
         } else if r.Method == "POST" {
                 w.Header().Set("Content-Type", "application/json")
-                b, err := ioutil.ReadAll(r.Body)
+                buf := bytes.NewBuffer(make([]byte, 0, MAX_TRY_SIZE))
+                n, err := buf.ReadFrom(r.Body)
                 if err != nil {
                         reportError(w, r, err, "Failed to read a request body.")
                         return
                 }
-                code := string(b)
+                if n == MAX_TRY_SIZE {
+                        err := fmt.Errorf("Code length equal to, or exceeded, %d", MAX_TRY_SIZE)
+                        reportError(w, r, err, "Code too large.")
+                        return
+                }
+                code := string(buf.Bytes())
+                if hasPreProcessor(code) {
+                        err := fmt.Errorf("Found preprocessor macro in code.")
+                        reportError(w, r, err, "Preprocessor macros aren't allowed.")
+                        return
+                }
                 hash, err := expandCode(LineNumbers(code))
                 if err != nil {
                         reportError(w, r, err, "Failed to write the code to compile.")
                         return
                 }
                 writeToDatabase(hash, code)
                 message, err := doCmd(fmt.Sprintf(RESULT_COMPILE, hash, hash), true)
                 if err != nil {
                         reportError(w, r, err, "Failed to compile the code:\n"+message)
                         return
@@ skipping 42 matching lines @@
 }
 
 func main() {
         flag.Parse()
         http.HandleFunc("/i/", imageHandler)
         http.HandleFunc("/recent/", recentHandler)
         http.HandleFunc("/css/", cssHandler)
         http.HandleFunc("/", mainHandler)
         log.Fatal(http.ListenAndServe(*port, nil))
 }