From 61de0371b13dcc414263ed33759e16989db8aa19 Mon Sep 17 00:00:00 2001
From: Al Beano <albino@autistici.org>
Date: Thu, 25 Aug 2016 21:36:27 +0100
Subject: [PATCH] input validation, db schema

---
 README.md               |  5 ++++-
 db.sql                  |  6 ++++++
 tormon/e_email.tt       |  2 ++
 tormon/e_fingerprint.tt |  2 ++
 tormon/e_security.tt    |  2 ++
 tormon/tormon.fcgi      | 33 +++++++++++++++++++++++++++------
 6 files changed, 43 insertions(+), 7 deletions(-)
 create mode 100644 db.sql
 create mode 100644 tormon/e_email.tt
 create mode 100644 tormon/e_fingerprint.tt
 create mode 100644 tormon/e_security.tt

diff --git a/README.md b/README.md
index c2fbfa2..d9ab07d 100644
--- a/README.md
+++ b/README.md
@@ -6,8 +6,11 @@ chown www:www /var/www/run
 install -o www -g www -m 0400 httpd.conf /etc/
 echo "permit nopass root as www" >> /etc/doas.conf
 curl -L https://cpanmin.us | perl - App::cpanminus
-cpanm -l /var/www/perl5 FCGI Switch Template::Simple File::Slurp
+cpanm -l /var/www/perl5 FCGI Switch Template::Simple File::Slurp Email::Valid
 install -o www -g www -m 0500 tormon/* /var/www/tormon/
+cat db.sql | sqlite3 /var/www/tormon.db
+chown www:www /var/www/tormon.db
+chmod 0600 /var/www/tormon.db
 echo 'echo "Starting tormon" && doas -u www /var/www/tormon/tormon.fcgi &' >> /etc/rc.local
 sh /etc/rc.local # assuming tormon is the only thing in rc.local
 rcctl enable httpd
diff --git a/db.sql b/db.sql
new file mode 100644
index 0000000..27bc3f6
--- /dev/null
+++ b/db.sql
@@ -0,0 +1,6 @@
+create table users (
+  id int primary key not null,
+  email text not null,
+  confirmed int not null,
+  subscriptions text
+);
diff --git a/tormon/e_email.tt b/tormon/e_email.tt
new file mode 100644
index 0000000..8715448
--- /dev/null
+++ b/tormon/e_email.tt
@@ -0,0 +1,2 @@
+<h1>Error</h1>
+The email address you entered does not appear to be valid. Please go back and try again.
diff --git a/tormon/e_fingerprint.tt b/tormon/e_fingerprint.tt
new file mode 100644
index 0000000..0c8d318
--- /dev/null
+++ b/tormon/e_fingerprint.tt
@@ -0,0 +1,2 @@
+<h1>Error</h1>
+The fingerprint you entered does not appear to be valid. Please go back and try again.
diff --git a/tormon/e_security.tt b/tormon/e_security.tt
new file mode 100644
index 0000000..1f17c91
--- /dev/null
+++ b/tormon/e_security.tt
@@ -0,0 +1,2 @@
+<h1>Error</h1>
+You did not answer the security question correctly. Please go back and try again.
diff --git a/tormon/tormon.fcgi b/tormon/tormon.fcgi
index 91ad1f7..625b41f 100755
--- a/tormon/tormon.fcgi
+++ b/tormon/tormon.fcgi
@@ -6,6 +6,7 @@ use FCGI;
 use Switch;
 use File::Slurp;
 use Template::Simple;
+use Email::Valid;
 use FindBin qw($Bin);
 
 my $VERSION = "1.0";
@@ -34,17 +35,37 @@ while ($request->Accept() <= 0) {
   my $code;
 
   switch ($ENV{"REQUEST_URI"}) {
-    case "/debug" {
-      # TODO - remove this, it's a security vulnerability
-      use Data::Dumper;
-      $content = "<textarea>" . Dumper(\%ENV) . "</textarea>";
-      $code = "\n"; # 200 OK
-    }
     case "/" {
       my $tt = read_file("$Bin/index.tt");
       $content = ${ $tmpl->render($tt, {version => $VERSION}) };
       $code = "\n"; # 200 OK
     }
+    case "/subscribe" {
+      read STDIN, my $buf, $ENV{"CONTENT_LENGTH"};
+      my @pairs = split /&/, $buf;
+      my %input;
+      for (@pairs) {
+        $_ =~ s/\+/ /g;
+        $_ =~ s/%([a-fA-F0-9][a-fA-F0-9])/pack("C", hex($1))/eg;
+        my ($a, $b) = split '=', $_;
+        $input{$a} = $b;
+      }
+
+      if (!($input{"spam"} =~ m/London/i)) {
+        $content = read_file("$Bin/e_security.tt");
+        last;
+      }
+      if (!($input{"fp"} =~ m/^[A-F0-9]{40}$/)) {
+        $content = read_file("$Bin/e_fingerprint.tt");
+        last;
+      }
+      if (!Email::Valid->address($input{"email"})) {
+        $content = read_file("$Bin/e_email.tt");
+        last;
+      }
+
+      # Add the email to database
+    }
     else {
       my $tt = read_file("$Bin/error.tt");
       $content = ${ $tmpl->render($tt, {err => 404}) };