Dust Mote Web Server

[Bob Techentin]

I am restructuring an application for starkit deployment. (Yea! Cool!)

The online help is HTML files in the doc directory, and I wrote a little
code based on "Invoking Browsers" (http://wiki.tcl.tk/557) to launch a web
browser to display the files. Once I wrap everything into the starkit, the
browsers won't be able to see the doc files. I could embed one of the help
browsers (http://wiki.tcl.tk/3196), but they're a little limited in both
graphics formats and printing.

One solution is to integrate a web server into my Tcl application, fire up a
browser, and pass it a URL to a localhost socket. I tried dropping tclhttpd
into the starkit library (http://wiki.tcl.tk/2085) but it is quite large,
and apparently more complex than [package require tclhttpd]. So my next
stop was the Dust Mote http server (http://wiki.tcl.tk/4333) which is about
30 lines of Tcl. Very cool.

The Dust Mote server responds to requests by returning a header line
(HTTP/1.0 200 OK), followed by a blank line, followed by the contents of the
file. This worked great until I tried the 'back' and 'refresh' buttons on
MS Internet Explorer. Suddenly all the pages were rendered as HTML source.

I found out, through trial and error, that IE really wants a content type
header line, so I added

if { [file extension $file] eq ".html" } {
puts $socket "Content-Type: text/html"
}

and everything seems to work. But I'm still left wondering if there is more
that I should be generating for the header. I looked at the tclhttpd code,
and find lots of mime type handling, and some things that might go into an
http header, but I'm not sure what I really need. Can anybody make
suggestions or point me to a little light reading?

Thanks,
Bob

[Donal K. Fellows]

Looking at Dust Mote, you'll need to watch out for requested pathnames
like ../etc/password and other nonsense like that (I suggest getting
friendly with [file normalize] of course). Also, you'll want to handle
the content types of all images you serve up (including encoding of the
data, which you get from [encoding system]); when you'll want to
transfer the data as binary and report the size of the data in the
headers as well; reporting the Content-Length is probably also a good
idea for text files you serve up. Probably also a good idea to return a
Server header (reporting "Dust Mote" of course!) But the main things to
add are security checks and the content-type handling.

Donal.

[Bob Techentin]

Post by Donal K. Fellows
Looking at Dust Mote, you'll need to watch out for requested
pathnames like ../etc/password and other nonsense like that (I
suggest getting friendly with [file normalize] of course). Also,
you'll want to handle the content types of all images you serve up
(including encoding of the data, which you get from [encoding
system]); when you'll want to transfer the data as binary and report
the size of the data in the headers as well; reporting the
Content-Length is probably also a good idea for text files you serve
up. Probably also a good idea to return a Server header (reporting
"Dust Mote" of course!) But the main things to add are security
checks and the content-type handling.

Thanks for the suggestions, Donal.

I'm prepending the starkit directory to the path, so the URLs served are
like http://localhost:1234/index.html, so I'm not too worried about
accessing /ect/password. But I'll look in to [file normalize]ing. Content
length should be easy, since I read the file into a string. Do you know of
a good reference to the content types and encodings? Should I be using the
tcllib mime package? (I can read the man page, but I still don't know what
to do with it.)

Thanks,
Bob

[blacksqr]

I believe the following page was made for you:

http://wiki.tcl.tk/12526


-------------------------
Steve Huntley
http://antipode.us/blosxom