avih / miniweb Goto Github PK

Miniweb doesn't list my local big file. The size of my file is 13.3GB but not shown on miniweb page.

I found it about 4 years ago, and forgot to let know.
still seems like, has vulnerbitity.

• buffersize (atoi)

https://github.com/avih/miniweb/blob/master/http.c#L2348

• allocation

phsSocket->bufferSize = phsSocket->request.payloadSize + 1;
phsSocket->request.pucPayload = malloc(phsSocket->bufferSize); // bufferSize

• memcpy(overflow)

https://github.com/avih/miniweb/blob/master/http.c#L1271 // causes overflow

Hi,

I need to use the method post ( not for file ) but for fields.

Is it possible?

How can I get the value from post?

C:\Users\admin\Desktop\miniweb-master>make
cc -DWIN32 -c -o httppil.o -O3 -Wunused-result httppil.c
In file included from /usr/include/w32api/winsock2.h:56,
from httppil.h:24,
from httppil.c:19:
/usr/include/w32api/psdk_inc/_fd_types.h:100:2: warning: #warning "fd_set and as
sociated macros have been defined in sys/types. This can cause runtime prob
lems with W32 sockets" [-Wcpp]
100 | #warning "fd_set and associated macros have been defined in sys/types.

| ^~~~~~~
In file included from httppil.h:24,
from httppil.c:19:
/usr/include/w32api/winsock2.h:1025:34: error: conflicting types for 'select'
1025 | WINSOCK_API_LINKAGE int WSAAPI select(int nfds,fd_set *readfds,fd_set
*writefds,fd_set *exceptfds,const PTIMEVAL timeout);
| ^~~~~~
In file included from /usr/include/sys/types.h:50,
from /usr/include/stdio.h:61,
from httppil.c:9:
/usr/include/sys/select.h:62:5: note: previous declaration of 'select' was here
62 | int select __P ((int __n, fd_set *__readfds, fd_set *__writefds,
| ^~~~~~
In file included from httppil.c:19:
httppil.h:59:16: error: conflicting types for 'pthread_t'
59 | typedef HANDLE pthread_t;
| ^~~~~~~~~
In file included from /usr/include/sys/types.h:223,
from /usr/include/stdio.h:61,
from httppil.c:9:
/usr/include/sys/_pthreadtypes.h:16:45: note: previous declaration of 'pthread_t
' was here
16 | typedef struct __pthread_t {char __dummy;} *pthread_t;
| ^~~~~~~~~
In file included from httppil.c:19:
httppil.h:60:16: error: conflicting types for 'pthread_mutex_t'
60 | typedef HANDLE pthread_mutex_t;
| ^~~~~~~~~~~~~~~
In file included from /usr/include/sys/types.h:223,
from /usr/include/stdio.h:61,
from httppil.c:9:
/usr/include/sys/_pthreadtypes.h:17:51: note: previous declaration of 'pthread_m
utex_t' was here
17 | typedef struct __pthread_mutex_t {char __dummy;} *pthread_mutex_t;
| ^~~~~~~~~~~~~~~
In file included from httppil.c:28:
win32/win_compat.h: In function 'cc_get_out_console_handle':
win32/win_compat.h:184:14: warning: implicit declaration of function '_fileno';
did you mean 'fileno'? [-Wimplicit-function-declaration]
184 | int fd = _fileno(f);
| ^~~~~~~
| fileno
win32/win_compat.h:186:9: warning: implicit declaration of function '_isatty' [-
Wimplicit-function-declaration]
186 | if (_isatty(fd) &&
| ^~~~~~~
win32/win_compat.h: In function 'write_console_text':
win32/win_compat.h:199:22: warning: implicit declaration of function 'wcslen' [-
Wimplicit-function-declaration]
199 | size_t out_len = wcslen(out);
| ^~~~~~
win32/win_compat.h: In function 'cc_fopen':
win32/win_compat.h:294:16: warning: implicit declaration of function '_wfopen';
did you mean '_lopen'? [-Wimplicit-function-declaration]
294 | FILE *rv = _wfopen(wfname, wmode);
| ^~~~~~~
| _lopen
win32/win_compat.h:294:16: warning: initialization of 'FILE *' {aka 'struct __sF
ILE64 *'} from 'int' makes pointer from integer without a cast [-Wint-conversion
]
win32/win_compat.h: In function 'cc_open':
win32/win_compat.h:306:14: warning: implicit declaration of function '_wopen'; d
id you mean '_lopen'? [-Wimplicit-function-declaration]
306 | int rv = _wopen(wfname, oflags);
| ^~~~~~
| _lopen
win32/win_compat.h: At top level:
win32/win_compat.h:366:19: warning: 'struct _stat64' declared inside parameter l
ist will not be visible outside of this definition or declaration
366 | #define cc_stat_s _stat64
| ^~~~~~~
win32/win_compat.h:366:19: note: in definition of macro 'cc_stat_s'
366 | #define cc_stat_s _stat64
| ^~~~~~~
win32/win_compat.h: In function 'cc_stat':
win32/win_compat.h:369:14: warning: implicit declaration of function '_wstat64'
[-Wimplicit-function-declaration]
369 | int rv = _wstat64(wp, ss);
| ^~~~~~~~
httppil.c: In function 'IsDir':
httppil.c:140:19: error: storage size of 'stDirInfo' isn't known
140 | struct cc_stat_s stDirInfo;
| ^~~~~~~~~
In file included from httppil.c:19:
httppil.c: In function 'ReadDir':
httppil.h:29:18: warning: implicit declaration of function '_snprintf'; did you
mean 'asnprintf'? [-Wimplicit-function-declaration]
29 | #define snprintf _snprintf
| ^~~~~~~~~
httppil.h:29:18: note: in definition of macro 'snprintf'
29 | #define snprintf _snprintf
| ^~~~~~~~~
httppil.c: In function 'IsFileExist':
httppil.c:220:19: error: storage size of 'stat_ret' isn't known
220 | struct cc_stat_s stat_ret;
| ^~~~~~~~
make: *** [Makefile:44: httppil.o] Error 1

According to the original documentation, MiniWeb has "transparent 7-zip decompression".

You can read about this in "/htdocs/index.htm". It says: "MiniWeb supports transparent 7-zip decompression. Web contents can be compressed into 7-zip archives and clients can access the contents inside the 7-zip archive just like in a directory."

But I can't find in your sources any library to support 7-zip. Do you have any idea on how to make this work? Have you tested this feature yet?...

By the way (off-topic), I can't successfully start the server on Windows XP (it runs without errors, but it doesn't work properly, since it doesn't resolve a proper "Interface" (host), like 127.0.0.1 or 192.168.0.105. The original release (by Stanley Huang), works just fine. But yours last release doesn't work correctly, at least on XP (I can show you some screenshots and command line arguments that I'm using, in case you need them).

– Leo

It it possible to use HTTP Basic Authentication with this server? I see "basic auth" in project description but I am not able to find any information it in documentation and app built-in help.

I want to limit access to HTTP server to one password and username, for example: user:pass@domain. Server should block access to contents if username or password is incorrect. It is possible to do it with miniweb? I see it in source code but I don't know how to set username and password.

Running miniweb with -d I would expect a directory listing. Nope.

With miniweb, SVG files aren't displayed properly in browser, because he uses Content-Type: application/octet-stream instead of the correct one image/svg+xml

I added this in my branch https://github.com/stefan-muc/miniweb/tree/stefan-muc/SVG_Content-Type maybe you want to cherry-pick one or both changes (67319d8 and eebbe28) I made there? Sadly I can't create a pull request as Github doesn't recognize my repository as a fork (despite it is one). I just haven't all changes that you made, because I didn't get them to compile on Windows, neither with Visual Studio nor with cygwin, but cherry picking should be possible when you add my repository as remote.

Hi,

This project will be used for education purposes and I need to build it for Windows. The thing is I don't know anything about this platform.
Would you be kind enough to provide information on how to build this project on Windows ?

Thanks !

How to build Windows version?

The original version of miniweb has 2 severe security vulnerabilities
directory traversals and heap based buffer overflow

https://www.exploit-db.com/raw/4923/