Index: main.mk ================================================================== --- main.mk +++ main.mk @@ -155,19 +155,24 @@ SFLAGS = $(TCLINC) -DSQLITE_THREADSAFE=0 -DSQLITE_ENABLE_FTS5 -DSQLITE_TCLMD5 -DTCLSH -Dmain=xmain $(TCLSH): $(SSRC) $(CC) -O2 -o $@ -I. $(SFLAGS) $(SSRC) $(TCLFLAGS) -searchdb: $(TCLSH) - mkdir -p doc/search.d/ - ./$(TCLSH) $(DOC)/search/buildsearchdb.tcl - cp $(DOC)/document_header.tcl doc/document_header.tcl - cp $(DOC)/document_header.tcl doc/search.d/document_header.tcl - cp $(DOC)/search/search.tcl doc/search +doc/search: $(TCLSH) $(DOC)/search/mkscript.tcl $(DOC)/search/search.tcl.in $(DOC)/search/wapp.tcl $(DOC)/document_header.tcl + ./$(TCLSH) $(DOC)/search/mkscript.tcl $(DOC)/search/search.tcl.in >doc/search chmod +x doc/search - cp $(DOC)/search/search.tcl doc/search.d/admin + +doc/search.d/admin: $(TCLSH) $(DOC)/search/mkscript.tcl $(DOC)/search/admin.tcl.in $(DOC)/search/wapp.tcl $(DOC)/document_header.tcl + mkdir -p doc/search.d/ + ./$(TCLSH) $(DOC)/search/mkscript.tcl $(DOC)/search/admin.tcl.in >doc/search.d/admin chmod +x doc/search.d/admin + +searchdb: $(TCLSH) doc/search doc/search.d/admin + ./$(TCLSH) $(DOC)/search/buildsearchdb.tcl + +# cp $(DOC)/search/search.tcl doc/search.d/admin +# chmod +x doc/search.d/admin fts5ext.so: $(DOC)/search/fts5ext.c gcc -shared -fPIC -I. -DSQLITE_EXT \ $(DOC)/search/fts5ext.c -o fts5ext.so Index: pages/about.in ================================================================== --- pages/about.in +++ pages/about.in @@ -54,19 +54,15 @@
SQLite is a compact library. With all features enabled, the [library size] can be less than 500KiB, depending on the target platform and compiler optimization settings. (64-bit code is larger. And some compiler optimizations such as aggressive function inlining and loop unrolling can cause the -object code to be much larger.) If optional features are omitted, the -size of the SQLite library can be reduced below 300KiB. SQLite can also -be made to run in minimal stack space (4KiB) and -very little heap (100KiB), making SQLite a popular database engine -choice on memory constrained gadgets such as cellphones, PDAs, and MP3 players. +object code to be much larger.) There is a tradeoff between memory usage and speed. SQLite generally runs faster the more memory you give it. Nevertheless, performance is usually quite good even -in low-memory environments. Depending on how it is used, SQLite be +in low-memory environments. Depending on how it is used, SQLite can be [faster than the filesystem|faster than direct filesystem I/O].
SQLite is very carefully tested prior to every release and has a reputation for being very reliable. ADDED pages/assert.in Index: pages/assert.in ================================================================== --- /dev/null +++ pages/assert.in @@ -0,0 +1,129 @@ +
+This document is a work-in-progress and is not yet ready for release. +Please do not link to it, yet. +
+ ++The assert(X) macro is +[https://en.wikipedia.org/wiki/Assert.h|part of standard C], in the the +<assert.h> header file. +SQLite adds three other assert()-like macros named NEVER(X), ALWAYS(X), +and testcase(X). + +
assert(X) → +The assert(X) statement indicates that the condition X is always true. +In other words, X is an invariant. The assert(X) macro works like a +procedure in that it has no return value. + +
ALWAYS(X) → +The ALWAYS(X) function indicates that condition X is always true as far +as the developers know, but there is not proof the X is true, or the +proof is complex and error-prone, or the proof depends on implementation +details that are likely to change in the future. ALWAYS(X) behaves like +a function that returns the boolean value X, and is intended to be used +within the conditional of an "if" statement. + +
NEVER(X) → +The NEVER(X) function indicates that condition X is never true. This +is the negative analog of the ALWAYS(X) function. + +
testcase(X) → +The testcase(X) statement indicates that X is sometimes true and sometimes +false. In other words, testcase(X) indicates that X is definitely not an +invariant. Since SQLite uses 100% [MC/DC testing], the presence of a +testcase(X) macro indicates that not only is it possible for X to be either +true or false, but there are test cases to demonstrate this. +
+SQLite version 3.22.0 ([dateof:3.22.0]) contains 5290 assert() macros, +839 testcase() macros, 88 ALWAYS() macros, and 63 NEVER() macros. + +
In SQLite, the presence of assert(X) means that the developers have +a proof that X is always true. Readers can depend upon X being true to +help them reason about the code. An assert(X) is a strong statement +about the truth of X. There is no doubt. + +
The ALWAYS(X) and NEVER(X) macros are a weaker statement about the +truth of X. The presence of ALWAYS(X) or NEVER(X) means that the developers +believe X is always or never true, but there is no proof, or the proof +is complex and error-prone, or the proof depends on other aspects +of the system that seem likely to change. + +
In other systems, developers sometimes use assert(X) in a way that is +similar to the use of ALWAYS(X) in SQLite. Developers will add an +assert(X) as a +[https://blog.regehr.org/archives/1576|tacit acknowledgement that they +do not fully believe that X is always true]. +We believe that this use of assert(X) is wrong and violates the intent +and purpose of having assert(X) available in C in the first place. +An assert(X) should not be seen as a safety-net or top-rope used to +guard against mistakes. Nor is assert(X) appropriate for defense-in-depth. +An ALWAYS(X) macro, or something similar, should be used in those cases +because ALWAYS(X) is followed by code to actually deal with the problem. + +
The [https://golang.org|Go programming language] omits assert(). +The Go developers +[https://golang.org/doc/faq#assertions|recognize this is contentious]. +Disallowing assert() is essentially telling developers that they are +not allowed to expression invariants. It is as if the developers of +Go do not want coders to prove that the software is correct. +The SQLite developers believe that the lack of assert() disqualifies +Go as a language for serious development work. + +
Three separate builds are used to validate the SQLite software. +A functionality testing build is used to validate the source code. +A coverage testing build is used to validate the test suite, to confirm +that the test suite provides 100% MC/DC. The release build is used +to validate the machine code. +All tests must give the same answer in all three +builds. See the [testing|"How SQLite Is Tested"] document for more detail. + +
The assert() macros behave differently according to how SQLite is built. + +
Functionality Testing | Coverage Testing | Release | |
---|---|---|---|
assert(X) + | abort() if X is false + | no-op + | no-op + |
ALWAYS(X) + | abort() if X is false + | always true + | pass through the value X + |
NEVER(X) + | abort() if X is true + | always false + | pass through the value X + |
testcase(X) + | no-op + | do some harmless work if X is true + | no-op + |
The default behavior of assert(X) in standard C is that it is enabled +for release builds. We find this acceptable in general. However, the +SQLite code base has many assert() statements in performance-sensitive +areas of the code. Leaving assert(X) turned causes SQLite to run about +three times slower. Also, SQLite strives to provide 100% MC/DC in an +as-delivered configuration, which is obviously impossible if assert(X) +statements are enabled. For these reasons, assert(X) is a no-op for +release builds in SQLite. ADDED pages/codeofconduct.in Index: pages/codeofconduct.in ================================================================== --- /dev/null +++ pages/codeofconduct.in @@ -0,0 +1,124 @@ +
Having been encouraged by clients to adopt a written +code of conduct, the SQLite developers elected to govern their +interactions with each other, with their clients, +and with the larger SQLite user community in +accordance with the "instruments of good works" from chapter 4 of +[https://en.wikipedia.org/wiki/Rule_of_Saint_Benedict|The Rule of St. Benedict]. +This code of conduct has proven its mettle in thousands of diverse +communities for over 1,500 years, and has served as a baseline for many +civil law codes since the time of Charlemagne. + +
+This rule is strict, and none are able to comply perfectly. +Grace is readily granted for minor transgressions. +All are encouraged to follow this rule closely, as in so +doing they may expect to live happier, healthier, and more +productive lives. The entire rule is good and wholesome, and +yet we make no enforcement of the more introspective aspects. + +
+Everyone is free to use the SQLite source code, object code, +and/or documentation regardless of their opinion of and adherence +to this rule. +SQLite has been and continues to be completely free to everyone, +without precondition. + +
+However, those who wish to participate in the SQLite community, +either by commenting on the public mailing lists or by contributing +patches or suggestions or in any other way, +are expected to present themselves in a manner +that honors the overarching spirit of the rule, even if they +disagree with specific details. +Polite and professional discussion is always welcomed, from anyone. + +
+SQLite is open-source, meaning that you can make as many copies of it as +you want and do whatever you want with those copies, without limitation. +But SQLite is not open-contribution. The project does not accept patches. +Only 27 individuals have ever contributed any code to SQLite, and of those +only 16 still have traces in the latest release. +Only 3 developers have contributed +non-comment changes within the previous five years and 96.4% of the latest +release code was written by just two people. +(The statistics in this paragraph were gathered on 2018-02-05.) + +
+Furthermore, all of the code in SQLite is original, having been written +specifically for use by SQLite. No code has been copied from unknown +sources on the internet. + +
+Many people associated "open-source" software with software that has
+grown organically through contributions from countless individuals.
+And, indeed, there is some open-source software that works that way.
+But not SQLite. SQLite uses the the
+[https://en.wikipedia.org/wiki/The_Cathedral_and_the_Bazaar|cathedral development philosopy]
+not the bazaar approach. All of the SQLite code has been written
+by people who are well known to each other.
+
+
-Even though SQLite is in the public domain and does not require -a license, some users want to obtain a license anyway. Some reasons -for obtaining a license include: +SQLite is in the public domain and does not require a license. +Even so, some organizations want legal proof of their right to use +SQLite. Circumstances where this occurs include the following:
-If you feel like you really need to purchase a license for SQLite, +If any of the above circumstances apply to you, Hwaci, the company that employs all the developers of SQLite, will sell you -one. -All proceeds from the sale of SQLite licenses are used to fund +a Warranty of Title for SQLite. +A Warranty of Title is a legal document that asserts that the claimed +authors of SQLite are the true authors, and that the authors +have the legal right to dedicate the SQLite to the public domain, and +that Hwaci will vigorously defend against challenges to those claims. +All proceeds from the sale of SQLite Warranties of Title are used to fund continuing improvement and support of SQLite.
In order to keep SQLite completely free and unencumbered by copyright, -all new contributors to the SQLite code base are asked to dedicate -their contributions to the public domain. -If you want to send a patch or enhancement for possible inclusion in the -SQLite source tree, please accompany the patch with the following statement: -
- --The author or authors of this code dedicate any and all copyright interest -in this code to the public domain. We make this dedication for the benefit -of the public at large and to the detriment of our heirs and successors. -We intend this dedication to be an overt act of relinquishment in -perpetuity of all present and future rights to this code under copyright law. -- -
-We are not able to accept patches or changes to -SQLite that are not accompanied by a statement such as the above. -In addition, if you make -changes or enhancements as an employee, then a simple statement such as the -above is insufficient. You must also send by surface mail a copyright release -signed by a company officer. -A signed original of the copyright release should be mailed to:
- --Hwaci- -
-6200 Maple Cove Lane
-Charlotte, NC 28269
-USA -
-A template copyright release is available -in PDF or -HTML. -You can use this release to make future changes. -
+the project does not accept patches. If you would like to make a +suggested change, and include a patch as a proof-of-concept, that would +be great. However please do not be offended if we rewrite your patch +from scratch. Index: pages/howtocorrupt.in ================================================================== --- pages/howtocorrupt.in +++ pages/howtocorrupt.in @@ -473,11 +473,11 @@This problem was discovered during internal testing and has never been observed in the wild. The problem was fixed on 2011-01-27 and in version 3.7.5.
-If the operating system returns an I/O error while attempting to obtain a certain lock on shared memory in [WAL | WAL mode] then SQLite might fail to reset its cache, which could lead to database corruption if subsequent writes are attempted.
@@ -530,10 +530,10 @@ that database at the same time, then the race condition might cause one of those processes to get a false indication that the recovery has already completed, allowing that process to continue using the database file without running recovery first. If that process writes to the file, then the file might go corrupt. This race condition -had apparently existing in all prior versions of SQLite for Windows going +had apparently existed in all prior versions of SQLite for Windows going back to 2004. But the race was very tight. Practically speaking, you need a fast multi-core machine in which you launch two processes to run recovery at the same moment on two separate cores. This defect was on Windows systems only and did not affect the posix OS interface. Index: pages/optoverview.in ================================================================== --- pages/optoverview.in +++ pages/optoverview.in @@ -1074,11 +1074,11 @@^The default setting is usually synchronous=FULL. - The [SQLITE_EXTRA_DURABLE] compile-time option changes the - default to synchronous=EXTRA.
-The TEMP schema always has synchronous=OFF since the content of of TEMP is ephemeral and is not expected to survive a power outage. Attempts to change the synchronous setting for TEMP are silently ignored. Index: pages/th3.in ================================================================== --- pages/th3.in +++ pages/th3.in @@ -312,11 +312,11 @@ 0 failures on 35 th3makes and 171555634 tests in (05:08:31) 3 cores on bella SQLite 3.14.1 2016-08-11 13:08:14 34aed3a318a413fd180604365546c1f530d1c60c
As can be seen above, a single run -of multitest.tcl invokes th3make dozens or times and takes between 12 and 24 +of multitest.tcl invokes th3make dozens of times and takes between 12 and 24 CPU hours. The middle section of the output shows the arguments to each individual th3make run and the result and elapse time for that th3make. All build products and output for the separate th3make runs are captures in subdirectories for post-test analysis. The two-line summary at the bottom shows the total number of errors and tests @@ -374,12 +374,12 @@
Mutation testing can be slow, since each test can take up to 5 minutes on a fast workstation, and there are two tests for each branch instructions, and over 20,000 branch instructions. Efforts are made to expedite operation. For example, TH3 is compiled in such a -way that it exists as soon as it finds the first error, and as many -of the mutations are easily detected, many cycles happen in ly +way that it exits as soon as it finds the first error, and as many +of the mutations are easily detected, many cycles happen in only a few seconds. Nevertheless, the mutation-test.tcl script includes command-line options to limit the range of code lines tested so that mutation testing only needs to be performed on blocks of code that have recently changed. Index: pages/vtab.in ================================================================== --- pages/vtab.in +++ pages/vtab.in @@ -134,11 +134,12 @@
A virtual table is eponymous if its [xCreate] method is the exact same
function as the [xConnect] method, or if the [xCreate] method is NULL.
The [xCreate] method is called when a virtual table is first created
-using the [CREATE VIRTUAL TABLE] statement. The [xConnect] method whenever
+using the [CREATE VIRTUAL TABLE] statement. The [xConnect] method
+is invoked whenever
a database connection attaches to or reparses a schema. When these two methods
are the same, that indicates that the virtual table has no persistent
state that needs to be created and destroyed.
Libraries written in C doe not have a huge run-time dependency. +
Libraries written in C do not have a huge run-time dependency. In its minimum configuration, SQLite requires only the following routines from the standard C library:
IP | Query | Results | Timestamp + } + + set i 0 + db2 eval " + SELECT rowid, ip, query, nres, timestamp FROM log $where + ORDER BY rowid DESC + " { + + if {$isUnique} { + if {[info exists seen($query)]} continue + set seen($query) 1 + } + + wapp-trim { + | |
---|---|---|---|---|
%html($rowid) + | %html($ip) + | %html($query) + | %html($nres) | %html($timestamp) + } + incr i + if {$i >= $limit} break + } + wapp-subst { |
[htmlize $key] | [htmlize $value]" - } - append ret " |
[htmlize $key] | [htmlize $value]" - } - append ret " |
IP | Query | Results | Timestamp\n" - db2 eval " - SELECT rowid, ip, query, nres, timestamp FROM log $where - ORDER BY rowid DESC - " { - - if {[info exists ::A(unique)] && $::A(unique)} { - if {[info exists seen($query)]} continue - set seen($query) 1 - } - - set querylink "$query" - set iplink "$ip" - - append res " | |
---|---|---|---|---|
$rowid | $iplink | $querylink" - append res " | $nres | $timestamp\n" - - incr i - if {$i >= $limit} break - } - append res " |
Change log entries mentioning: [htmlize $::A(q)] -
$version |
|
You can also see the entire" - append ret " changelog as a single page if you wish.
-
- $s_title1
-
- ($url)
- $s_apis
-
- $s_content
-
- |
- }]
- }
- append ret {
- for {set i 0} {$i < 10 && ($i*10)<$nRes} {incr i} { - append ret [subst { - [expr $i+1] - }] - } - append ret
Page generated by FTS5 in about $t." - append doc "
" - append document "Error: $res\n\n" - append document $::errorInfo - append document "" -} - -puts "Content-type: text/html" -puts "Content-Length: [string length $document]" -puts "" -puts $document -puts "" -flush stdout -close stdout - -exit ADDED search/search.tcl.in Index: search/search.tcl.in ================================================================== --- /dev/null +++ search/search.tcl.in @@ -0,0 +1,309 @@ +#!/usr/bin/tclsh.docsrc +#### Import of wapp.tcl +INCLUDE wapp.tcl +#### End of wapp.tcl + +# Generate all header content for the output document +# +proc search_header {} { + wapp-trim { +DOCHEAD {Search SQLite Documentation} {} + } +} + +#------------------------------------------------------------------------- +# Add an entry to the log database for the current query. Which +# returns $nRes results. +# +proc search_add_log_entry {nRes} { + if {[wapp-param-exists donotlog]} return + sqlite3 db2 [file dir [wapp-param SCRIPT_FILENAME]]/search.d/searchlog.db + db2 timeout 10000 + set ip [wapp-param REMOTE_ADDR] + set query [wapp-param q] + db2 eval { + PRAGMA synchronous=OFF; + PRAGMA journal_mode=OFF; + BEGIN; + CREATE TABLE IF NOT EXISTS log( + ip, -- IP query was made from + query, -- Fts5 query string + nres, -- Number of results + timestamp DEFAULT CURRENT_TIMESTAMP + ); + INSERT INTO log(ip, query, nres) VALUES($ip, $query, $nRes); + COMMIT; + } + db2 close +} + +#------------------------------------------------------------------------- +# This command is similar to the builtin Tcl [time] command, except that +# it only ever runs the supplied script once. Also, instead of returning +# a string like "xxx microseconds per iteration", it returns "x.yy ms" or +# "x.yy s", depending on the magnitude of the time spent running the +# command. For example: +# +# % ttime {after 1500} +# 1.50 s +# % ttime {after 45} +# 45.02 ms +# +proc ttime {script} { + set t [lindex [time [list uplevel $script]] 0] + if {$t>1000000} { return [format "%.2f s" [expr {$t/1000000.0}]] } + return [format "%.2f ms" [expr {$t/1000.0}]] +} + +#----------------------------------------------------------------------- +# Do a search of the change log +# +proc searchchanges {} { + set q [wapp-param q] + if {$q==""} {return {}} + set open {} + set close {} + set query { + SELECT url, version, idx, highlight(change, 3, $open, $close) AS text + FROM change($q) ORDER BY rowid ASC + } + wapp-trim { +
Change log entries mentioning: %html($q) +
%html($version) + |
|
You can also see the entire + changelog as a single page if you wish.
No Results for: %html($q)\n} + } + + # HTML markup used to highlight keywords within FTS5 generated snippets. + # + set open {} + set close {} + set ellipsis { ... } + + # Grab the required data + # + db eval [string map [list %LIST% [join $lRowid ,]] { + SELECT + rowid AS parentid, + snippet(page, 0, $open, $close, $ellipsis, 6) AS s_apis, + snippet(page, 2, $open, $close, '', 40) AS s_title1, + snippet(page, 3, $open, $close, $ellipsis, 40) AS s_title2, + snippet(page, 4, $open, $close, $ellipsis, 40) AS s_content, + url, rank + FROM page($q) + WHERE rowid IN (%LIST%) + }] X { + foreach k [array names X] { set data($X(parentid),$k) [set X($k)] } + } + + set i1 [expr {$iStart+1}] + set i2 [expr {($nRes < $iStart+10) ? $nRes : $iStart+10}] + wapp-trim { +
+
+ %unsafe($s_title1)
+
+ (%url($url))
+ %unsafe($s_apis)
+
+ %unsafe($s_content)
+
+ |
+ }
+ }
+ wapp-subst {
\n} + for {set i 0} {$i < 10 && ($i*10)<$nRes} {incr i} { + set style $s([expr {($iStart/10)==$i}]) + wapp-trim { + %html([expr $i+1]) + } + } + wapp-subst {
%html([wapp-debug-env])+ } + return + } + + # When running using the built-in webserver in Wapp (in other words, + # when not running as CGI) any filename that contains a "." loads + # directly from the filesystem. + if {[string match *//127.0.0.1:* [wapp-param BASE_URL]] + && [string match *.* [wapp-param PATH_INFO]] + } { + set altfile [file dir [wapp-param SCRIPT_FILENAME]][wapp-param PATH_INFO] + set fd [open $altfile rb] + fconfigure $fd -translation binary + wapp-unsafe [read $fd] + close $fd + switch -glob -- $altfile { + *.html { + wapp-mimetype text/html + } + *.css { + wapp-mimetype text/css + } + *.gif { + wapp-mimetype image/gif + } + } + return + } + + search_header + sqlite3 db [file dir [wapp-param SCRIPT_FILENAME]]/search.d/search.db + set searchType [wapp-param s d] + if {$searchType=="c"} { + set cmd searchchanges + } else { + set cmd searchresults + } + db transaction { + set t [ttime {$cmd}] + } + wapp-trim { +
Page generated by FTS5 in about %html($t). +
[htmlize $key] | [htmlize $value]" - } - append ret " |
[htmlize $key] | [htmlize $value]" - } - append ret " |
Search SQLite docs for: | - - |
- Powered by FTS5. - |
${resnum}. | -
-
- $title
-
-
-
- $snippet
-
- |
-
- - | $report | - }] - } - append ret {
- for {set i 0} {$i < 10 && ($i*10)<$nRes} {incr i} { - append ret [subst { - [expr $i+1] - }] - } - append ret
Page generated in $t." - return $doc - - # return [cgi_env_dump] -} - -#========================================================================= - -set ::HEADER { - -
-
-
|
" - append document "Error: $res\n\n" - append document $::errorInfo - append document "" -} - -puts "Content-type: text/html" -puts "Content-Length: [string length $document]" -puts "" -puts $document -puts "" -flush stdout -close stdout - -exit ADDED search/wapp.tcl Index: search/wapp.tcl ================================================================== --- /dev/null +++ search/wapp.tcl @@ -0,0 +1,924 @@ +# Copyright (c) 2017 D. Richard Hipp +# +# This program is free software; you can redistribute it and/or +# modify it under the terms of the Simplified BSD License (also +# known as the "2-Clause License" or "FreeBSD License".) +# +# This program is distributed in the hope that it will be useful, +# but without any warranty; without even the implied warranty of +# merchantability or fitness for a particular purpose. +# +#--------------------------------------------------------------------------- +# +# Design rules: +# +# (1) All identifiers in the global namespace begin with "wapp" +# +# (2) Indentifiers intended for internal use only begin with "wappInt" +# + +# Add text to the end of the HTTP reply. No interpretation or transformation +# of the text is performs. The argument should be enclosed within {...} +# +proc wapp {txt} { + global wapp + dict append wapp .reply $txt +} + +# Add text to the page under construction. Do no escaping on the text. +# +# Though "unsafe" in general, there are uses for this kind of thing. +# For example, if you want to return the complete, unmodified content of +# a file: +# +# set fd [open content.html rb] +# wapp-unsafe [read $fd] +# close $fd +# +# You could do the same thing using ordinary "wapp" instead of "wapp-unsafe". +# The difference is that wapp-safety-check will complain about the misuse +# of "wapp", but it assumes that the person who write "wapp-unsafe" understands +# the risks. +# +# Though occasionally necessary, the use of this interface should be minimized. +# +proc wapp-unsafe {txt} { + global wapp + dict append wapp .reply $txt +} + +# Add text to the end of the reply under construction. The following +# substitutions are made: +# +# %html(...) Escape text for inclusion in HTML +# %url(...) Escape text for use as a URL +# %qp(...) Escape text for use as a URI query parameter +# %string(...) Escape text for use within a JSON string +# %unsafe(...) No transformations of the text +# +# The substitutions above terminate at the first ")" character. If the +# text of the TCL string in ... contains ")" characters itself, use instead: +# +# %html%(...)% +# %url%(...)% +# %qp%(...)% +# %string%(...)% +# %unsafe%(...)% +# +# In other words, use "%(...)%" instead of "(...)" to include the TCL string +# to substitute. +# +# The %unsafe substitution should be avoided whenever possible, obviously. +# In addition to the substitutions above, the text also does backslash +# escapes. +# +proc wapp-subst {txt} { + global wapp + regsub -all {%(html|url|qp|string|unsafe){1,1}?(|%)\((.+)\)\2} $txt \ + {[wappInt-enc-\1 "\3"]} txt + dict append wapp .reply [uplevel 1 [list subst -novariables $txt]] +} + +# Works like wapp-subst, but also removes whitespace from the beginning +# of lines. +# +proc wapp-trim {txt} { + global wapp + regsub -all {\n\s+} [string trim $txt] \n txt + regsub -all {%(html|url|qp|string|unsafe){1,1}?(|%)\((.+)\)\2} $txt \ + {[wappInt-enc-\1 "\3"]} txt + dict append wapp .reply [uplevel 1 [list subst -novariables $txt]] +} + +# There must be a wappInt-enc-NAME routine for each possible substitution +# in wapp-subst. Thus there are routines for "html", "url", "qp", and "unsafe". +# +# wappInt-enc-html Escape text so that it is safe to use in the +# body of an HTML document. +# +# wappInt-enc-url Escape text so that it is safe to pass as an +# argument to href= and src= attributes in HTML. +# +# wappInt-enc-qp Escape text so that it is safe to use as the +# value of a query parameter in a URL or in +# post data or in a cookie. +# +# wappInt-enc-string Escape ", ', \, and < for using inside of a +# javascript string literal. The < character +# is escaped to prevent "" from causing +# problems in embedded javascript. +# +# wappInt-enc-unsafe Perform no encoding at all. Unsafe. +# +proc wappInt-enc-html {txt} { + return [string map {& & < < > > \" " \\ \} $txt] +} +proc wappInt-enc-unsafe {txt} { + return $txt +} +proc wappInt-enc-url {s} { + if {[regsub -all {[^-{}@~?=#_.:/a-zA-Z0-9]} $s {[wappInt-%HHchar {&}]} s]} { + set s [subst -novar -noback $s] + } + if {[regsub -all {[{}]} $s {[wappInt-%HHchar \\&]} s]} { + set s [subst -novar -noback $s] + } + return $s +} +proc wappInt-enc-qp {s} { + if {[regsub -all {[^-{}_.a-zA-Z0-9]} $s {[wappInt-%HHchar {&}]} s]} { + set s [subst -novar -noback $s] + } + if {[regsub -all {[{}]} $s {[wappInt-%HHchar \\&]} s]} { + set s [subst -novar -noback $s] + } + return $s +} +proc wappInt-enc-string {s} { + return [string map {\\ \\\\ \" \\\" ' \\' < \\u003c} $s] +} + +# This is a helper routine for wappInt-enc-url and wappInt-enc-qp. It returns +# an appropriate %HH encoding for the single character c. If c is a unicode +# character, then this routine might return multiple bytes: %HH%HH%HH +# +proc wappInt-%HHchar {c} { + if {$c==" "} {return +} + return [regsub -all .. [binary encode hex [encoding convertto utf-8 $c]] {%&}] +} + + +# Undo the www-url-encoded format. +# +# HT: This code stolen from ncgi.tcl +# +proc wappInt-decode-url {str} { + set str [string map [list + { } "\\" "\\\\" \[ \\\[ \] \\\]] $str] + regsub -all -- \ + {%([Ee][A-Fa-f0-9])%([89ABab][A-Fa-f0-9])%([89ABab][A-Fa-f0-9])} \ + $str {[encoding convertfrom utf-8 [binary decode hex \1\2\3]]} str + regsub -all -- \ + {%([CDcd][A-Fa-f0-9])%([89ABab][A-Fa-f0-9])} \ + $str {[encoding convertfrom utf-8 [binary decode hex \1\2]]} str + regsub -all -- {%([0-7][A-Fa-f0-9])} $str {\\u00\1} str + return [subst -novar $str] +} + +# Reset the document back to an empty string. +# +proc wapp-reset {} { + global wapp + dict set wapp .reply {} +} + +# Change the mime-type of the result document. +# +proc wapp-mimetype {x} { + global wapp + dict set wapp .mimetype $x +} + +# Change the reply code. +# +proc wapp-reply-code {x} { + global wapp + dict set wapp .reply-code $x +} + +# Set a cookie +# +proc wapp-set-cookie {name value} { + global wapp + dict lappend wapp .new-cookies $name $value +} + +# Unset a cookie +# +proc wapp-clear-cookie {name} { + wapp-set-cookie $name {} +} + +# Add extra entries to the reply header +# +proc wapp-reply-extra {name value} { + global wapp + dict lappend wapp .reply-extra $name $value +} + +# Specifies how the web-page under construction should be cached. +# The argument should be one of: +# +# no-cache +# max-age=N (for some integer number of seconds, N) +# private,max-age=N +# +proc wapp-cache-control {x} { + wapp-reply-extra Cache-Control $x +} + +# Redirect to a different web page +# +proc wapp-redirect {uri} { + wapp-reply-code {307 Redirect} + wapp-reply-extra Location $uri +} + +# Return the value of a wapp parameter +# +proc wapp-param {name {dflt {}}} { + global wapp + if {![dict exists $wapp $name]} {return $dflt} + return [dict get $wapp $name] +} + +# Return true if a and only if the wapp parameter $name exists +# +proc wapp-param-exists {name} { + global wapp + return [dict exists $wapp $name] +} + +# Set the value of a wapp parameter +# +proc wapp-set-param {name value} { + global wapp + dict set wapp $name $value +} + +# Return all parameter names that match the GLOB pattern, or all +# names if the GLOB pattern is omitted. +# +proc wapp-param-list {{glob {*}}} { + global wapp + return [dict keys $wapp $glob] +} + +# By default, Wapp does not decode query parameters and POST parameters +# for cross-origin requests. This is a security restriction, designed to +# help prevent cross-site request forgery (CSRF) attacks. +# +# As a consequence of this restriction, URLs for sites generated by Wapp +# that contain query parameters will not work as URLs found in other +# websites. You cannot create a link from a second website into a Wapp +# website if the link contains query planner, by default. +# +# Of course, it is sometimes desirable to allow query parameters on external +# links. For URLs for which this is safe, the application should invoke +# wapp-allow-xorigin-params. This procedure tells Wapp that it is safe to +# go ahead and decode the query parameters even for cross-site requests. +# +# In other words, for Wapp security is the default setting. Individual pages +# need to actively disable the cross-site request security if those pages +# are safe for cross-site access. +# +proc wapp-allow-xorigin-params {} { + global wapp + if {![dict exists $wapp .qp] && ![dict get $wapp SAME_ORIGIN]} { + wappInt-decode-query-params + } +} + +# Set the content-security-policy. +# +# The default content-security-policy is very strict: "default-src 'self'" +# The default policy prohibits the use of in-line javascript or CSS. +# +# Provide an alternative CSP as the argument. Or use "off" to disable +# the CSP completely. +# +proc wapp-content-security-policy {val} { + global wapp + if {$val=="off"} { + dict unset wapp .csp + } else { + dict set wapp .csp $val + } +} + +# Examine the bodys of all procedures in this program looking for +# unsafe calls to various Wapp interfaces. Return a text string +# containing warnings. Return an empty string if all is ok. +# +# This routine is advisory only. It misses some constructs that are +# dangerous and flags others that are safe. +# +proc wapp-safety-check {} { + set res {} + foreach p [info procs] { + set ln 0 + foreach x [split [info body $p] \n] { + incr ln + if {[regexp {^[ \t]*wapp[ \t]+([^\n]+)} $x all tail] + && [string index $tail 0]!="\173" + && [regexp {[[$]} $tail] + } { + append res "$p:$ln: unsafe \"wapp\" call: \"[string trim $x]\"\n" + } + if {[regexp {^[ \t]*wapp-(subst|trim)[ \t]+[^\173]} $x all cx]} { + append res "$p:$ln: unsafe \"wapp-$cx\" call: \"[string trim $x]\"\n" + } + } + } + return $res +} + +# Return a string that descripts the current environment. Applications +# might find this useful for debugging. +# +proc wapp-debug-env {} { + global wapp + set out {} + foreach var [lsort [dict keys $wapp]] { + if {[string index $var 0]=="."} continue + append out "$var = [list [dict get $wapp $var]]\n" + } + append out "\[pwd\] = [list [pwd]]\n" + return $out +} + +# Tracing function for each HTTP request. This is overridden by wapp-start +# if tracing is enabled. +# +proc wappInt-trace {} {} + +# Start up a listening socket. Arrange to invoke wappInt-new-connection +# for each inbound HTTP connection. +# +# port Listen on this TCP port. 0 means to select a port +# that is not currently in use +# +# wappmode One of "scgi", "server", or "local". +# +proc wappInt-start-listener {port wappmode} { + if {$wappmode=="scgi"} { + set type SCGI + set server [list wappInt-new-connection wappInt-scgi-readable $wappmode] + } else { + set type HTTP + set server [list wappInt-new-connection wappInt-http-readable $wappmode] + } + if {$wappmode=="local"} { + set x [socket -server $server -myaddr 127.0.0.1 $port] + } else { + set x [socket -server $server $port] + } + set coninfo [chan configure $x -sockname] + set port [lindex $coninfo 2] + if {$wappmode=="local"} { + wappInt-start-browser http://127.0.0.1:$port/ + } else { + puts "Listening for $type requests on TCP port $port" + } +} + +# Start a web-browser and point it at $URL +# +proc wappInt-start-browser {url} { + global tcl_platform + if {$tcl_platform(platform)=="windows"} { + exec cmd /c start $url & + } elseif {$tcl_platform(os)=="Darwin"} { + exec open $url & + } elseif {[catch {exec xdg-open $url}]} { + exec firefox $url & + } +} + +# This routine is a "socket -server" callback. The $chan, $ip, and $port +# arguments are added by the socket command. +# +# Arrange to invoke $callback when content is available on the new socket. +# The $callback will process inbound HTTP or SCGI content. +# +proc wappInt-new-connection {callback wappmode chan ip port} { + upvar #0 wappInt-$chan W + set W [dict create REMOTE_ADDR $ip REMOTE_PORT $port WAPP_MODE $wappmode \ + .header {}] + fconfigure $chan -blocking 0 -translation binary + fileevent $chan readable [list $callback $chan] +} + +# Close an input channel +# +proc wappInt-close-channel {chan} { + if {$chan=="stdout"} { + # This happens after completing a CGI request + exit 0 + } else { + unset ::wappInt-$chan + close $chan + } +} + +# Process new text received on an inbound HTTP request +# +proc wappInt-http-readable {chan} { + if {[catch [list wappInt-http-readable-unsafe $chan] msg]} { + puts stderr "$msg\n$::errorInfo" + wappInt-close-channel $chan + } +} +proc wappInt-http-readable-unsafe {chan} { + upvar #0 wappInt-$chan W wapp wapp + if {![dict exists $W .toread]} { + # If the .toread key is not set, that means we are still reading + # the header + set line [string trimright [gets $chan]] + set n [string length $line] + if {$n>0} { + if {[dict get $W .header]=="" || [regexp {^\s+} $line]} { + dict append W .header $line + } else { + dict append W .header \n$line + } + if {[string length [dict get $W .header]]>100000} { + error "HTTP request header too big - possible DOS attack" + } + } elseif {$n==0} { + # We have reached the blank line that terminates the header. + global argv0 + set a0 [file normalize $argv0] + dict set W SCRIPT_FILENAME $a0 + dict set W DOCUMENT_ROOT [file dir $a0] + if {[wappInt-parse-header $chan]} { + catch {close $chan} + return + } + set len 0 + if {[dict exists $W CONTENT_LENGTH]} { + set len [dict get $W CONTENT_LENGTH] + } + if {$len>0} { + # Still need to read the query content + dict set W .toread $len + } else { + # There is no query content, so handle the request immediately + set wapp $W + wappInt-handle-request $chan 0 + } + } + } else { + # If .toread is set, that means we are reading the query content. + # Continue reading until .toread reaches zero. + set got [read $chan [dict get $W .toread]] + dict append W CONTENT $got + dict set W .toread [expr {[dict get $W .toread]-[string length $got]}] + if {[dict get $W .toread]<=0} { + # Handle the request as soon as all the query content is received + set wapp $W + wappInt-handle-request $chan 0 + } + } +} + +# Decode the HTTP request header. +# +# This routine is always running inside of a [catch], so if +# any problems arise, simply raise an error. +# +proc wappInt-parse-header {chan} { + upvar #0 wappInt-$chan W + set hdr [split [dict get $W .header] \n] + if {$hdr==""} {return 1} + set req [lindex $hdr 0] + dict set W REQUEST_METHOD [set method [lindex $req 0]] + if {[lsearch {GET HEAD POST} $method]<0} { + error "unsupported request method: \"[dict get $W REQUEST_METHOD]\"" + } + set uri [lindex $req 1] + set split_uri [split $uri ?] + set uri0 [lindex $split_uri 0] + if {![regexp {^/[-.a-z0-9_/]*$} $uri0]} { + error "invalid request uri: \"$uri0\"" + } + dict set W REQUEST_URI $uri0 + dict set W PATH_INFO $uri0 + set uri1 [lindex $split_uri 1] + dict set W QUERY_STRING $uri1 + set n [llength $hdr] + for {set i 1} {$i<$n} {incr i} { + set x [lindex $hdr $i] + if {![regexp {^(.+): +(.*)$} $x all name value]} { + error "invalid header line: \"$x\"" + } + set name [string toupper $name] + switch -- $name { + REFERER {set name HTTP_REFERER} + USER-AGENT {set name HTTP_USER_AGENT} + CONTENT-LENGTH {set name CONTENT_LENGTH} + CONTENT-TYPE {set name CONTENT_TYPE} + HOST {set name HTTP_HOST} + COOKIE {set name HTTP_COOKIE} + ACCEPT-ENCODING {set name HTTP_ACCEPT_ENCODING} + default {set name .hdr:$name} + } + dict set W $name $value + } + return 0 +} + +# Decode the QUERY_STRING parameters from a GET request or the +# application/x-www-form-urlencoded CONTENT from a POST request. +# +# This routine sets the ".qp" element of the ::wapp dict as a signal +# that query parameters have already been decoded. +# +proc wappInt-decode-query-params {} { + global wapp + dict set wapp .qp 1 + if {[dict exists $wapp QUERY_STRING]} { + foreach qterm [split [dict get $wapp QUERY_STRING] &] { + set qsplit [split $qterm =] + set nm [lindex $qsplit 0] + if {[regexp {^[a-z][a-z0-9]*$} $nm]} { + dict set wapp $nm [wappInt-decode-url [lindex $qsplit 1]] + } + } + } + if {[dict exists $wapp CONTENT_TYPE] && [dict exists $wapp CONTENT]} { + set ctype [dict get $wapp CONTENT_TYPE] + if {$ctype=="application/x-www-form-urlencoded"} { + foreach qterm [split [string trim [dict get $wapp CONTENT]] &] { + set qsplit [split $qterm =] + set nm [lindex $qsplit 0] + if {[regexp {^[a-z][-a-z0-9_]*$} $nm]} { + dict set wapp $nm [wappInt-decode-url [lindex $qsplit 1]] + } + } + } elseif {[string match multipart/form-data* $ctype]} { + regexp {^(.*?)\r\n(.*)$} [dict get $wapp CONTENT] all divider body + set ndiv [string length $divider] + while {[string length $body]} { + set idx [string first $divider $body] + set unit [string range $body 0 [expr {$idx-3}]] + set body [string range $body [expr {$idx+$ndiv+2}] end] + if {[regexp {^Content-Disposition: form-data; (.*?)\r\n\r\n(.*)$} \ + $unit unit hdr content] && + [regexp {name="(.*)"; filename="(.*)"\r\nContent-Type: (.*?)$}\ + $hdr hr name filename mimetype]} { + dict set wapp $name.filename \ + [string map [list \\\" \" \\\\ \\] $filename] + dict set wapp $name.mimetype $mimetype + dict set wapp $name.content $content + } + } + } + } +} + +# Invoke application-supplied methods to generate a reply to +# a single HTTP request. +# +# This routine always runs within [catch], so handle exceptions by +# invoking [error]. +# +proc wappInt-handle-request {chan useCgi} { + global wapp + dict set wapp .reply {} + dict set wapp .mimetype {text/html; charset=utf-8} + dict set wapp .reply-code {200 Ok} + dict set wapp .csp {default-src 'self'} + + # Set up additional CGI environment values + # + if {![dict exists $wapp HTTP_HOST]} { + dict set wapp BASE_URL {} + } elseif {[dict exists $wapp HTTPS]} { + dict set wapp BASE_URL https://[dict get $wapp HTTP_HOST] + } else { + dict set wapp BASE_URL http://[dict get $wapp HTTP_HOST] + } + if {![dict exists $wapp REQUEST_URI]} { + dict set wapp REQUEST_URI / + } elseif {[regsub {\?.*} [dict get $wapp REQUEST_URI] {} newR]} { + # Some servers (ex: nginx) append the query parameters to REQUEST_URI. + # These need to be stripped off + dict set wapp REQUEST_URI $newR + } + if {[dict exists $wapp SCRIPT_NAME]} { + dict append wapp BASE_URL [dict get $wapp SCRIPT_NAME] + } else { + dict set wapp SCRIPT_NAME {} + } + if {![dict exists $wapp PATH_INFO]} { + # If PATH_INFO is missing (ex: nginx) the construct it + set URI [dict get $wapp REQUEST_URI] + set skip [string length [dict get $wapp SCRIPT_NAME]] + dict set wapp PATH_INFO [string range $URI $skip end] + } + if {[regexp {^/([^/]+)(.*)$} [dict get $wapp PATH_INFO] all head tail]} { + dict set wapp PATH_HEAD $head + dict set wapp PATH_TAIL [string trimleft $tail /] + } else { + dict set wapp PATH_INFO {} + dict set wapp PATH_HEAD {} + dict set wapp PATH_TAIL {} + } + dict set wapp SELF_URL [dict get $wapp BASE_URL]/[dict get $wapp PATH_HEAD] + + # Parse query parameters from the query string, the cookies, and + # POST data + # + if {[dict exists $wapp HTTP_COOKIE]} { + foreach qterm [split [dict get $wapp HTTP_COOKIE] {;}] { + set qsplit [split [string trim $qterm] =] + set nm [lindex $qsplit 0] + if {[regexp {^[a-z][-a-z0-9_]*$} $nm]} { + dict set wapp $nm [wappInt-decode-url [lindex $qsplit 1]] + } + } + } + set same_origin 0 + if {[dict exists $wapp HTTP_REFERER]} { + set referer [dict get $wapp HTTP_REFERER] + set base [dict get $wapp BASE_URL] + if {$referer==$base || [string match $base/* $referer]} { + set same_origin 1 + } + } + dict set wapp SAME_ORIGIN $same_origin + if {$same_origin} { + wappInt-decode-query-params + } + + # Invoke the application-defined handler procedure for this page + # request. If an error occurs while running that procedure, generate + # an HTTP reply that contains the error message. + # + wapp-before-dispatch-hook + wappInt-trace + set mname [dict get $wapp PATH_HEAD] + if {[catch { + if {$mname!="" && [llength [info proc wapp-page-$mname]]>0} { + wapp-page-$mname + } else { + wapp-default + } + } msg]} { + if {[wapp-param WAPP_MODE]=="local" || [wapp-param WAPP_MODE]=="server"} { + puts "ERROR: $::errorInfo" + } + wapp-reset + wapp-reply-code "500 Internal Server Error" + wapp-mimetype text/html + wapp-trim { +
%html($::errorInfo)+ } + dict unset wapp .new-cookies + } + + # Transmit the HTTP reply + # + if {$chan=="stdout"} { + puts $chan "Status: [dict get $wapp .reply-code]\r" + } else { + puts $chan "HTTP/1.1 [dict get $wapp .reply-code]\r" + puts $chan "Server: wapp\r" + puts $chan "Connection: close\r" + } + if {[dict exists $wapp .reply-extra]} { + foreach {name value} [dict get $wapp .reply-extra] { + puts $chan "$name: $value\r" + } + } + if {[dict exists $wapp .csp]} { + puts $chan "Content-Security-Policy: [dict get $wapp .csp]\r" + } + set mimetype [dict get $wapp .mimetype] + puts $chan "Content-Type: $mimetype\r" + if {[dict exists $wapp .new-cookies]} { + foreach {nm val} [dict get $wapp .new-cookies] { + if {[regexp {^[a-z][-a-z0-9_]*$} $nm]} { + if {$val==""} { + puts $chan "Set-Cookie: $nm=; HttpOnly; Path=/; Max-Age=1\r" + } else { + set val [wappInt-enc-url $val] + puts $chan "Set-Cookie: $nm=$val; HttpOnly; Path=/\r" + } + } + } + } + if {[string match text/* $mimetype]} { + set reply [encoding convertto utf-8 [dict get $wapp .reply]] + if {[regexp {\ygzip\y} [wapp-param HTTP_ACCEPT_ENCODING]]} { + catch { + set x [zlib gzip $reply] + set reply $x + puts $chan "Content-Encoding: gzip\r" + } + } + } else { + set reply [dict get $wapp .reply] + } + puts $chan "Content-Length: [string length $reply]\r" + puts $chan \r + puts $chan $reply + flush $chan + wappInt-close-channel $chan +} + +# This routine runs just prior to request-handler dispatch. The +# default implementation is a no-op, but applications can override +# to do additional transformations or checks. +# +proc wapp-before-dispatch-hook {} {return} + +# Process a single CGI request +# +proc wappInt-handle-cgi-request {} { + global wapp env + foreach key { + CONTENT_LENGTH + CONTENT_TYPE + DOCUMENT_ROOT + HTTP_ACCEPT_ENCODING + HTTP_COOKIE + HTTP_HOST + HTTP_REFERER + HTTP_USER_AGENT + HTTPS + PATH_INFO + QUERY_STRING + REMOTE_ADDR + REQUEST_METHOD + REQUEST_URI + REMOTE_USER + SCRIPT_FILENAME + SCRIPT_NAME + SERVER_NAME + SERVER_PORT + SERVER_PROTOCOL + } { + if {[info exists env($key)]} { + dict set wapp $key $env($key) + } + } + set len 0 + if {[dict exists $wapp CONTENT_LENGTH]} { + set len [dict get $wapp CONTENT_LENGTH] + } + if {$len>0} { + fconfigure stdin -translation binary + dict set wapp CONTENT [read stdin $len] + } + dict set wapp WAPP_MODE cgi + fconfigure stdout -translation binary + wappInt-handle-request stdout 1 +} + +# Process new text received on an inbound SCGI request +# +proc wappInt-scgi-readable {chan} { + if {[catch [list wappInt-scgi-readable-unsafe $chan] msg]} { + puts stderr "$msg\n$::errorInfo" + wappInt-close-channel $chan + } +} +proc wappInt-scgi-readable-unsafe {chan} { + upvar #0 wappInt-$chan W wapp wapp + if {![dict exists $W .toread]} { + # If the .toread key is not set, that means we are still reading + # the header. + # + # An SGI header is short. This implementation assumes the entire + # header is available all at once. + # + set req [read $chan 15] + set n [string length $req] + scan $req %d:%s len hdr + incr len [string length "$len:,"] + append hdr [read $chan [expr {$len-15}]] + foreach {nm val} [split $hdr \000] { + if {$nm==","} break + dict set W $nm $val + } + set len 0 + if {[dict exists $W CONTENT_LENGTH]} { + set len [dict get $W CONTENT_LENGTH] + } + if {$len>0} { + # Still need to read the query content + dict set W .toread $len + } else { + # There is no query content, so handle the request immediately + set wapp $W + wappInt-handle-request $chan 0 + } + } else { + # If .toread is set, that means we are reading the query content. + # Continue reading until .toread reaches zero. + set got [read $chan [dict get $W .toread]] + dict append W CONTENT $got + dict set W .toread [expr {[dict get $W .toread]-[string length $got]}] + if {[dict get $W .toread]<=0} { + # Handle the request as soon as all the query content is received + set wapp $W + wappInt-handle-request $chan 0 + } + } +} + +# Start up the wapp framework. Parameters are a list passed as the +# single argument. +# +# -server $PORT Listen for HTTP requests on this TCP port $PORT +# +# -local $PORT Listen for HTTP requests on 127.0.0.1:$PORT +# +# -scgi $PORT Listen for SCGI requests on TCP port $PORT +# +# -cgi Handle a single CGI request +# +# With no arguments, the behavior is called "auto". In "auto" mode, +# if the GATEWAY_INTERFACE environment variable indicates CGI, then run +# as CGI. Otherwise, start an HTTP server bound to the loopback address +# only, on an arbitrary TCP port, and automatically launch a web browser +# on that TCP port. +# +# Additional options: +# +# -trace "puts" each request URL as it is handled, for +# debugging +# +# -lint Run wapp-safety-check on the application instead +# of running the application itself +# +# -Dvar=value Set TCL global variable "var" to "value" +# +# +proc wapp-start {arglist} { + global env + set mode auto + set port 0 + set n [llength $arglist] + for {set i 0} {$i<$n} {incr i} { + set term [lindex $arglist $i] + if {[string match --* $term]} {set term [string range $term 1 end]} + switch -glob -- $term { + -server { + incr i; + set mode "server" + set port [lindex $arglist $i] + } + -local { + incr i; + set mode "local" + set port [lindex $arglist $i] + } + -scgi { + incr i; + set mode "scgi" + set port [lindex $arglist $i] + } + -cgi { + set mode "cgi" + } + -trace { + proc wappInt-trace {} { + set q [wapp-param QUERY_STRING] + set uri [wapp-param BASE_URL][wapp-param PATH_INFO] + if {$q!=""} {append uri ?$q} + puts $uri + } + } + -lint { + set res [wapp-safety-check] + if {$res!=""} { + puts "Potential problems in this code:" + puts $res + exit 1 + } else { + exit + } + } + -D*=* { + if {[regexp {^.D([^=]+)=(.*)$} $term all var val]} { + set ::$var $val + } + } + default { + error "unknown option: $term" + } + } + } + if {($mode=="auto" + && [info exists env(GATEWAY_INTERFACE)] + && [string match CGI/1.* $env(GATEWAY_INTERFACE)]) + || $mode=="cgi" + } { + wappInt-handle-cgi-request + return + } + if {$mode=="scgi"} { + wappInt-start-listener $port scgi + } elseif {$mode=="server"} { + wappInt-start-listener $port server + } else { + wappInt-start-listener $port local + } + vwait ::forever +} + +# Call this version 1.0 +package provide wapp 1.0