Windows CGI execution

[Alexei Kosut <ak...@organic.com>]

Hmm. I've been examining how the Win32 code handles CGIs, and I'm not
quite sure that it's correct, at least from an intuitive sense.

Based on eyeballing the code, and some experience, here's how it seems to
handle execution of files (call_exec() in util_script.c):

1. If the file ends with .EXE, .BAT, or .COM (first off, it forgets .CMD
and some others), it executes it.
2. If the file is "binary" (contains a certain percentage of control
characters), it executes it.
3. If the file starts with "#!", it runs the file through the program
listed next on the line (emulating Unix' ability)
4. Otherwise, it feeds the file into CMD.EXE, as a sort of DOS shell
script.

This is all well and good (and I like the part about allowing Unix-style
#! lines), but I disagree with the fourth option here. The reason has to
do with compatibility with other servers (and note here that I haven't
actually *tried* this with others, this is based on what I've read): With
other servers, I can use Windows' registry to execute scripts. I can't
with Apache (not without editing the code). For example, I can tell
Windows to associate files ending in .pl with the Perl interpreter. Then I
can tell the server files ending in .pl are executable CGI scripts, and
it'll work. With Apache, the server decides that files ending in .pl
should be fed through CMD.EXE, and it doesn't work.

Yes, I can tack "#!perl" on the top of the script, and it'll work, but if
I'm migrating from another server (or if, say, I'm using a scripting
language that doesn't like having extra lines at the top of its files),
this might not be an option.

In other words, I think the logic should go like this:

1. If the file starst with "#!", run it through that interpeter.
2. Otherwise, try and execute it.

I mean, is it really that hard to stick a .BAT on the end of real DOS
shell scripts?

Anyhow, just a thought.

-- Alexei Kosut <ak...@organic.com>

Re: Windows CGI execution

[Ambarish Malpani <am...@isecurity.com>]

What you say is absolutely right. We do need to look for file
associations in the registry and invoke the appropriate program for
a particular script. (You still can't just invoke the script, but
need to call the associated program explicitly (as far as I know).

Ambarish


Alexei Kosut wrote:
> 
> Hmm. I've been examining how the Win32 code handles CGIs, and I'm not
> quite sure that it's correct, at least from an intuitive sense.
> 
> Based on eyeballing the code, and some experience, here's how it seems to
> handle execution of files (call_exec() in util_script.c):
> 
> 1. If the file ends with .EXE, .BAT, or .COM (first off, it forgets .CMD
> and some others), it executes it.
> 2. If the file is "binary" (contains a certain percentage of control
> characters), it executes it.
> 3. If the file starts with "#!", it runs the file through the program
> listed next on the line (emulating Unix' ability)
> 4. Otherwise, it feeds the file into CMD.EXE, as a sort of DOS shell
> script.
> 
> This is all well and good (and I like the part about allowing Unix-style
> #! lines), but I disagree with the fourth option here. The reason has to
> do with compatibility with other servers (and note here that I haven't
> actually *tried* this with others, this is based on what I've read): With
> other servers, I can use Windows' registry to execute scripts. I can't
> with Apache (not without editing the code). For example, I can tell
> Windows to associate files ending in .pl with the Perl interpreter. Then I
> can tell the server files ending in .pl are executable CGI scripts, and
> it'll work. With Apache, the server decides that files ending in .pl
> should be fed through CMD.EXE, and it doesn't work.
> 
> Yes, I can tack "#!perl" on the top of the script, and it'll work, but if
> I'm migrating from another server (or if, say, I'm using a scripting
> language that doesn't like having extra lines at the top of its files),
> this might not be an option.
> 
> In other words, I think the logic should go like this:
> 
> 1. If the file starst with "#!", run it through that interpeter.
> 2. Otherwise, try and execute it.
> 
> I mean, is it really that hard to stick a .BAT on the end of real DOS
> shell scripts?
> 
> Anyhow, just a thought.
> 
> -- Alexei Kosut <ak...@organic.com>

-- 

---------------------------------------------------------------------
Ambarish Malpani
Architect					       (408) 738-2040
ValiCert, Inc.				      http://www.valicert.com
333 W. El Camino Real, Suite 270
Sunnyvale, CA 94087