From a94d7b7c247b97402186bfa295009dab8a013a7b Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 21 Apr 2024 19:27:23 +0200
Subject: [PATCH 001/112] * fixes of some ugly sed hacks from 4 years ago

---
 src/server.sh | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/server.sh b/src/server.sh
index 215a1f3..d9a46fa 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -84,8 +84,8 @@ while read -r param; do
 			data="$(sed -E 's/\?/��Lun4_iS_CuTe�/;s/^(.*)��Lun4_iS_CuTe�//' <<< "${r[url]}")"
 			IFS='&'
 			for i in $data; do
-				name="$(sed -E 's/\=(.*)$//' <<< "$i")"
-				value="$(sed "s/$name\=//" <<< "$i")"
+				name="${i/=*/}"
+				value="${i/*=/}"
 				get_data[$name]="$value"
 			done
 		fi
@@ -99,8 +99,8 @@ while read -r param; do
 			data="$(sed -E 's/\?/��Lun4_iS_CuTe�/;s/^(.*)��Lun4_iS_CuTe�//' <<< "${r[url]}")"
 			IFS='&'
 			for i in $data; do
-				name="$(sed -E 's/\=(.*)$//' <<< "$i")"
-				value="$(sed "s/$name\=//" <<< "$i")"
+				name="${i/=*/}"
+				value="${i/*=/}"
 				get_data[$name]="$value"
 			done
 		fi		
@@ -209,8 +209,8 @@ if [[ "${r[post]}" == true ]] && [[ "${r[status]}" == 200 ||  "${r[status]}" ==
 		
 		IFS='&'
 		for i in $(tr -d '\n' <<< "$data"); do
-			name="$(sed -E 's/\=(.*)$//' <<< "$i")"
-			param="$(sed "s/$name\=//" <<< "$i")"
+			name="${i/=*/}"
+			param="${i/*=/}"
 			post_data[$name]="$param"
 		done
 		unset IFS

From 231b52f171f4e21f58ec41230ba1a01ab70d6654 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 21 Apr 2024 21:54:06 +0200
Subject: [PATCH 002/112] * fix router parameter clobbering

if a route contained a static string with the same name as one
of the named params, said string would overwrite the payload from
the previous named param. this commit adds a check for `:` in the
template to prevent this
---
 src/server.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/server.sh b/src/server.sh
index d9a46fa..2951633 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -133,7 +133,7 @@ if [[ ${r[status]} != 101 ]]; then
 			url_=(${r[url]})
 			unset IFS
 			for (( j=0; j<${#url[@]}; j++ )); do
-				if [[ ${url_[$j]} != '' ]]; then
+				if [[ ${url_[$j]} != '' && ${url[$j]} == ":"* ]]; then
 					params[$(sed 's/://' <<< "${url[$j]}")]="${url_[$j]}"
 				fi
 			done

From c459a405b2612d82b0173c549edaeb67a5cf8524 Mon Sep 17 00:00:00 2001
From: Linus Groh <mail@linusgroh.de>
Date: Sun, 19 May 2024 16:21:40 +0100
Subject: [PATCH 003/112] Ignore query when parsing URL params

---
 src/server.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/server.sh b/src/server.sh
index 2951633..73cb646 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -130,7 +130,7 @@ if [[ ${r[status]} != 101 ]]; then
 			r[view]="${route[$((i+2))]}"
 			IFS='/'
 			url=(${route[$i]})
-			url_=(${r[url]})
+			url_=($(cut -d '?' -f 1 <<< "${r[url]}"))
 			unset IFS
 			for (( j=0; j<${#url[@]}; j++ )); do
 				if [[ ${url_[$j]} != '' && ${url[$j]} == ":"* ]]; then

From 10342035a41335aa2681a8a190a61fc2ac728f12 Mon Sep 17 00:00:00 2001
From: Linus Groh <mail@linusgroh.de>
Date: Sun, 19 May 2024 19:52:10 +0100
Subject: [PATCH 004/112] Match headers on beginning of line

---
 src/server.sh | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/src/server.sh b/src/server.sh
index 73cb646..c82ae7c 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -30,10 +30,10 @@ while read -r param; do
 	if [[ "$param_l" == $'\015' ]]; then
 		break
 		
-	elif [[ "$param_l" == *"content-length:"* ]]; then
+	elif [[ "$param_l" == "content-length:"* ]]; then
 		r[content_length]="$(sed 's/Content-Length: //i;s/\r//' <<< "$param")"
 
-	elif [[ "$param_l" == *"content-type:"* ]]; then
+	elif [[ "$param_l" == "content-type:"* ]]; then
 		r[content_type]="$(sed 's/Content-Type: //i;s/\r//' <<< "$param")"
 		if [[ "${r[content_type]}" == *"multipart/form-data"* ]]; then
 			tmpdir=$(mktemp -d)
@@ -42,7 +42,7 @@ while read -r param; do
 			r[content_boundary]="$(sed -E 's/(.*)boundary=//i;s/\r//;s/ //' <<< "${r[content_type]}")"
 		fi
 		
-	elif [[ "$param_l" == *"host:"* ]]; then
+	elif [[ "$param_l" == "host:"* ]]; then
 		r[host]="$(sed 's/Host: //i;s/\r//;s/\\//g' <<< "$param")"
 		r[host_portless]="$(sed -E 's/:(.*)$//' <<< "${r[host]}")"
 		if [[ -f "config/$(basename -- ${r[host]})" ]]; then
@@ -51,22 +51,22 @@ while read -r param; do
 			source "config/$(basename -- ${r[host_portless]})"
 		fi
 
-	elif [[ "$param_l" == *"user-agent:"* ]]; then
+	elif [[ "$param_l" == "user-agent:"* ]]; then
 		r[user_agent]="$(sed 's/User-Agent: //i;s/\r//;s/\\//g' <<< "$param")"
 		
-	elif [[ "$param_l" == *"upgrade:"* && $(sed 's/Upgrade: //i;s/\r//' <<< "$param") == "websocket" ]]; then
+	elif [[ "$param_l" == "upgrade:"* && $(sed 's/Upgrade: //i;s/\r//' <<< "$param") == "websocket" ]]; then
 		r[status]=101
 		
-	elif [[ "$param_l" == *"sec-websocket-key:"* ]]; then
+	elif [[ "$param_l" == "sec-websocket-key:"* ]]; then
 		r[websocket_key]="$(sed 's/Sec-WebSocket-Key: //i;s/\r//' <<< "$param")"
 		
-	elif [[ "$param_l" == *"authorization: basic"* ]]; then
+	elif [[ "$param_l" == "authorization: basic"* ]]; then
 		login_simple "$param"
 		
-	elif [[ "$param_l" == *"authorization: bearer"* ]]; then
+	elif [[ "$param_l" == "authorization: bearer"* ]]; then
 		r[authorization]="$(sed 's/Authorization: Bearer //i;s/\r//' <<< "$param")"
 
-	elif [[ "$param_l" == *"cookie: "* ]]; then
+	elif [[ "$param_l" == "cookie: "* ]]; then
 		IFS=';'
 		for i in $(IFS=' '; echo "$param" | sed -E 's/Cookie: //i;;s/%/\\x/g'); do
 			name="$((grep -Poh "[^ ].*?(?==)" | head -1) <<< $i)"
@@ -74,7 +74,7 @@ while read -r param; do
 			cookies[$name]="$(echo -e $value)"
 		done
 
-	elif [[ "$param_l" == *"range: bytes="* ]]; then
+	elif [[ "$param_l" == "range: bytes="* ]]; then
 		r[range]="$(sed 's/Range: bytes=//;s/\r//' <<< "$param")"
 		
 	elif [[ "$param" == *"GET "* ]]; then

From a65b600952d64365717f3bd3a6753d78f2e0bbc8 Mon Sep 17 00:00:00 2001
From: Linus Groh <mail@linusgroh.de>
Date: Tue, 4 Jun 2024 00:17:53 +0100
Subject: [PATCH 005/112] Don't run ncat within background loop in the
 background too

---
 http.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/http.sh b/http.sh
index 482aeab..ac4333b 100755
--- a/http.sh
+++ b/http.sh
@@ -190,7 +190,7 @@ else
 			done &
 		else
 			while true; do
-				ncat -i 600s -l -U "$socket" -c src/server.sh -k 2>> /dev/null &
+				ncat -i 600s -l -U "$socket" -c src/server.sh -k 2>> /dev/null
 			done &
 		fi
 		socat TCP-LISTEN:${cfg[port]},fork,bind=${cfg[ip]} UNIX-CLIENT:$socket &

From 4e6c5c0ba3af3d93a67961651db0906c6dfa686f Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Wed, 17 Jul 2024 22:09:01 +0200
Subject: [PATCH 006/112] template: tpl includes with {{#PATH}}

---
 src/template.sh | 26 ++++++++++++++++++++++++--
 1 file changed, 24 insertions(+), 2 deletions(-)

diff --git a/src/template.sh b/src/template.sh
index 9ef0969..a1164b5 100755
--- a/src/template.sh
+++ b/src/template.sh
@@ -12,9 +12,30 @@ function render() {
 	local -n ref=$1
 	local tmp=$(mktemp)
 
+	# hack below!
+	# this whole code iterates over an array we control, but I want to add
+	# template includes. Hence, we have to pre-parse the template to
+	# find all of our include statements and add them to the roundup.
+
+	while read elem; do
+		ref[#$elem]=
+	done <<< "$(grep -Poh '{{#.*?}}' <<< "$template" | sed 's/{{#//;s/}}$//')"
+
 	local key
+	IFS=$'\n'
 	for key in ${!ref[@]}; do
-		if [[ "$key" == "_"* ]]; then # iter mode
+		if [[ "$key" == "#"* ]]; then # include mode
+			local file="${key/\#/}"
+
+			# below check prevents the loop loading itself as a template.
+			# this is possibly not enough to prevent all recursions, but
+			# i see it as a last-ditch measure. so it'll do here.
+			if [[ "$file" == "$2" ]]; then
+				echo 's'$'\02''\{\{'"\\$key"'\}\}'$'\02''I cowardly refuse to endlessly recurse\!'$'\02''g;' >> "$tmp"
+			elif [[ -f "$file" ]]; then
+				echo 's'$'\02''\{\{'"\\$key"'\}\}'$'\02'"$(tr -d $'\01'$'\02' < "$file" | sed 's/\&/�UwU�/g')"$'\02''g;' >> "$tmp"
+			fi
+		elif [[ "$key" == "_"* ]]; then # iter mode
 			local subtemplate=$(mktemp)
 			echo "$template" | grep "{{start $key}}" -A99999 | grep "{{end $key}}" -B99999 | tr '\n' $'\01' > "$subtemplate"
 
@@ -34,7 +55,7 @@ function render() {
 			rm "$subtemplate"
 		elif [[ "$key" == "@"* && "${ref[$key]}" != '' ]]; then
 			local value="$(sed -E 's/\&/�UwU�/g' <<< "${ref[$key]}")"
-			echo 's'$'\02''\{\{\'"$key"'\}\}'$'\02'''"$value"''$'\02''g;' >> "$tmp"
+			echo 's'$'\02''\{\{\'"$key"'\}\}'$'\02'''"$value"''$'\02''g;' >> "$tmp" #'
 		elif [[ "$key" == '?'* ]]; then
 			local _key="\\?${key/?/}"
 
@@ -55,6 +76,7 @@ function render() {
 			echo 's'$'\02''\{\{\.'"$key"'\}\}'$'\02'$'\02''g;' >> "$tmp"
 		fi
 	done
+	unset IFS
 
 	if [[ "$3" != true ]]; then # are we recursing?
 		cat "$tmp" | tr '\n' $'\01' | sed -E 's/'$'\02'';'$'\01''/'$'\02'';/g;s/'$'\02''g;'$'\01''/'$'\02''g;/g' > "${tmp}_"

From f5eebc109d3444ee04a208f769fa1d6009e923f3 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 19 Jul 2024 00:58:13 +0200
Subject: [PATCH 007/112] account: added argon2id as a preferred (default)
 password hash

---
 http.sh                   |  3 +++
 src/account.sh            | 32 ++++++++++++++++++++++++++------
 src/dependencies.optional |  1 +
 3 files changed, 30 insertions(+), 6 deletions(-)

diff --git a/http.sh b/http.sh
index ac4333b..7d8f02f 100755
--- a/http.sh
+++ b/http.sh
@@ -46,6 +46,9 @@ cfg[mail_server]=""
 cfg[mail_password]=""
 cfg[mail_ssl]=true
 cfg[mail_ignore_bad_cert]=false
+
+# unset for legacy sha256sum hashing (not recommended)
+cfg[hash]="argon2id"
 EOF
 fi
 
diff --git a/src/account.sh b/src/account.sh
index d423c57..1ba6cb7 100755
--- a/src/account.sh
+++ b/src/account.sh
@@ -1,7 +1,6 @@
 #!/usr/bin/env bash
 # account.sh - account and session mgmt
 
-
 # register(username, password)
 function register() {
 	local username=$(echo -ne $(sed -E "s/ /_/g;s/\:/\-/g;s/\%/\\x/g" <<< "$1"))
@@ -11,9 +10,16 @@ function register() {
 		return 1
 	fi
 	
-	local salt=$(dd if=/dev/urandom bs=256 count=1 | sha1sum | cut -c 1-16)
-	local hash=$(echo -n $2$salt | sha256sum | cut -c 1-64)
-	local token=$(dd if=/dev/urandom bs=32 count=1 | sha1sum | cut -c 1-40)
+	if [[ "${cfg[hash]}" == "argon2id" ]]; then
+		local salt=$(dd if=/dev/urandom bs=256 count=1 | sha1sum | cut -c 1-16)
+		local token=$(dd if=/dev/urandom bs=32 count=1 | sha1sum | cut -c 1-40)
+		local hash="$(echo -n "$2" | argon2 "$salt" -id -e)"
+	else
+		local salt=$(dd if=/dev/urandom bs=256 count=1 | sha1sum | cut -c 1-16)
+		local token=$(dd if=/dev/urandom bs=32 count=1 | sha1sum | cut -c 1-40)
+		local hash=$(echo -n $2$salt | sha256sum | cut -c 1-64)
+	fi
+	
 	set_cookie_permanent "sh_session" $token
 	set_cookie_permanent "username" $username
 	
@@ -26,7 +32,14 @@ function login() {
 	IFS=':'
 	local user=($(grep -P "$username:" secret/users.dat))
 	unset IFS
-	if [[ $(echo -n $2${user[2]} | sha256sum | cut -c 1-64 ) == "${user[1]}" ]]; then
+
+	if [[ "${cfg[hash]}" == "argon2id" ]]; then
+		hash="$(echo -n "$2" | argon2 "${user[2]}" -id -e)"
+	else
+		hash="$(echo -n $2${user[2]} | sha256sum | cut -c 1-64 )"
+	fi
+	
+	if [[ "$hash" == "${user[1]}" ]]; then
 		set_cookie_permanent "sh_session" "${user[3]}"
 		set_cookie_permanent "username" "$username"
 		return 0
@@ -47,7 +60,14 @@ function login_simple() {
 	IFS=':'
 	local user=($(grep "$login:" secret/users.dat))
 	unset IFS
-	if [[ $(echo -n $password${user[2]} | sha256sum | cut -c 1-64 ) == ${user[1]} ]]; then
+
+	if [[ "${cfg[hash]}" == "argon2id" ]]; then
+		hash="$(echo -n "$password" | argon2 "$salt" -id -e)"
+	else
+		hash="$(echo -n $password${user[2]} | sha256sum | cut -c 1-64 )"
+	fi
+	
+	if [[ "$hash" == "${user[1]}" ]]; then
 		r[authorized]=true
 	else 
 		r[authorized]=false
diff --git a/src/dependencies.optional b/src/dependencies.optional
index 62629e1..5b5425d 100644
--- a/src/dependencies.optional
+++ b/src/dependencies.optional
@@ -2,3 +2,4 @@ sha1sum
 sha256sum
 curl
 iconv
+argon2

From 61fea4b849871d12e568a41b065a03fcad6b0c8f Mon Sep 17 00:00:00 2001
From: famfo <famfo@famfo.xyz>
Date: Fri, 19 Jul 2024 02:25:33 +0200
Subject: [PATCH 008/112] Add option to show call trace, basic cli docs

---
 docs/running.md | 10 ++++++++++
 http.sh         | 11 ++++++++---
 src/server.sh   |  6 ++++++
 3 files changed, 24 insertions(+), 3 deletions(-)
 create mode 100644 docs/running.md

diff --git a/docs/running.md b/docs/running.md
new file mode 100644
index 0000000..0f0d1d9
--- /dev/null
+++ b/docs/running.md
@@ -0,0 +1,10 @@
+# Running http.sh 
+
+## cli args
+
+The only args checked are `$1`.
+
+- `init` create an app skeleton
+- `debug` show stderr
+- `debuggier` show stderr and calltrace
+
diff --git a/http.sh b/http.sh
index 7d8f02f..af82dfa 100755
--- a/http.sh
+++ b/http.sh
@@ -6,7 +6,7 @@ if [[ ! -f "config/master.sh" ]]; then
 	cat <<EOF > "config/master.sh"
 declare -A cfg
 
-cfg[ip]=0.0.0.0 # IP address to bind to - use 0.0.0.0 to bind to all
+cfg[ip]=[::] # IP address to bind to - use [::] to bind to all
 
 cfg[http]=true # enables/disables listening on HTTP
 cfg[port]=1337 # HTTP port
@@ -161,6 +161,11 @@ EOF
 if [[ "$1" == "debug" ]]; then
 	cfg[dbg]=true
 	echo "[DEBUG] Activated debug mode - stderr will be shown"
+elif [[ "$1" == "debuggier" ]]; then
+    cfg[dbg]=true
+    cfg[debuggier]=true
+    echo "[DEBUG] Activated debuggier mode - stderr and call trace will be shown"
+    set -x
 fi
 
 source src/worker.sh
@@ -173,7 +178,7 @@ if [[ ${cfg[socat_only]} == true ]]; then
 	echo "[INFO] listening directly via socat, assuming no ncat available"
 	echo "[HTTP] listening on ${cfg[ip]}:${cfg[port]}"
 	if [[ ${cfg[dbg]} == true ]]; then
-		socat tcp-listen:${cfg[port]},bind=${cfg[ip]},fork "exec:bash -c src/server.sh"
+		socat tcp-listen:${cfg[port]},bind=${cfg[ip]},fork "exec:bash -c \'src/server.sh ${cfg[debuggier]}\'"
 	else
 		socat tcp-listen:${cfg[port]},bind=${cfg[ip]},fork "exec:bash -c src/server.sh" 2>> /dev/null
 		if [[ $? != 0 ]]; then
@@ -189,7 +194,7 @@ else
 			# to quit after the first time-outed connection, ignoring the
 			# "broker" (-k) mode. This is a workaround for this. 
 			while true; do
-				ncat -i 600s -l -U "$socket" -c src/server.sh -k
+				ncat -i 600s -l -U "$socket" -c "src/server.sh ${cfg[debuggier]}" -k
 			done &
 		else
 			while true; do
diff --git a/src/server.sh b/src/server.sh
index c82ae7c..cc0f17d 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -1,4 +1,10 @@
 #!/usr/bin/env bash
+
+# If $1 is set to true, enable the call trace
+if [[ "$1" == true ]]; then
+    set -x
+fi
+
 source config/master.sh
 source src/mime.sh
 source src/misc.sh

From b28e1d9fcd9a1f4f648ba6ca03044661b0f27b3d Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 19 Jul 2024 17:23:10 +0200
Subject: [PATCH 009/112] account: fix poor checking that could lead to
 privilege escalation

---
 src/account.sh | 70 +++++++++++++++++++++++++++++++++-----------------
 1 file changed, 47 insertions(+), 23 deletions(-)

diff --git a/src/account.sh b/src/account.sh
index 1ba6cb7..b73cd78 100755
--- a/src/account.sh
+++ b/src/account.sh
@@ -5,10 +5,15 @@
 function register() {
 	local username=$(echo -ne $(sed -E "s/ /_/g;s/\:/\-/g;s/\%/\\x/g" <<< "$1"))
 
-	if [[ $(grep "$username:" secret/users.dat) != '' ]]; then
-		reason="This user already exists!"
-		return 1
-	fi
+	IFS=$'\n'
+	while read user; do
+		IFS=: a=($user)
+		if [[ "${a[0]}" == "$username" ]]; then
+			reason="This user already exists!"
+			return 1
+		fi
+	done < secret/users.dat
+	unset IFS
 	
 	if [[ "${cfg[hash]}" == "argon2id" ]]; then
 		local salt=$(dd if=/dev/urandom bs=256 count=1 | sha1sum | cut -c 1-16)
@@ -29,9 +34,17 @@ function register() {
 # login(username, password) 
 function login() {
 	local username=$(echo -ne $(sed -E 's/%/\\x/g' <<< "$1"))
-	IFS=':'
-	local user=($(grep -P "$username:" secret/users.dat))
-	unset IFS
+	IFS=$'\n'
+	while read a; do
+		IFS=: user=($a)
+		if [[ "${user[0]}" == "$username" ]]; then
+			break
+		fi
+	done < secret/users.dat
+	if [[ "${user[0]}" == '' ]]; then
+		reason="Bad credentials"
+		return 1
+	fi
 
 	if [[ "${cfg[hash]}" == "argon2id" ]]; then
 		hash="$(echo -n "$2" | argon2 "${user[2]}" -id -e)"
@@ -46,7 +59,7 @@ function login() {
 	else
 		remove_cookie "sh_session"
 		remove_cookie "username"
-		reason="Invalid credentials!!11"
+		reason="Bad credentials"
 		return 1
 	fi
 }
@@ -56,13 +69,16 @@ function login_simple() {
 	local data=$(base64 -d <<< "$3")
 	local password=$(sed -E 's/^(.*)\://' <<< "$data")
 	local login=$(sed -E 's/\:(.*)$//' <<< "$data")
-	
-	IFS=':'
-	local user=($(grep "$login:" secret/users.dat))
+
+	IFS=$'\n'
+	while read a; do
+		IFS=':' user=($a)
+		[[ ${user[0]} == "$login" ]] && break
+	done < secret/users.dat
 	unset IFS
 
 	if [[ "${cfg[hash]}" == "argon2id" ]]; then
-		hash="$(echo -n "$password" | argon2 "$salt" -id -e)"
+		hash="$(echo -n "$password" | argon2 "${user[2]}" -id -e)"
 	else
 		hash="$(echo -n $password${user[2]} | sha256sum | cut -c 1-64 )"
 	fi
@@ -82,26 +98,34 @@ function logout() {
 
 # session_verify(session)
 function session_verify() {
-	if [[ $(grep ":$1" secret/users.dat) != '' && $1 != '' ]]; then
-		return 0
-	else
-		return 1
-	fi
+	IFS=$'\n'
+	while read user; do
+		IFS=: a=($user)
+		if [[ "${a[3]}" == "$1" && "$1" != '' ]]; then
+			return 0
+		fi
+	done < secret/users.dat
+	return 1
 }
 
 # session_get_username(session)
 function session_get_username() {
-	[[ "$1" == "" ]] && return
+	[[ "$1" == "" ]] && return 1
 
-	IFS=':'
-	local data=($(grep ":$1$" secret/users.dat))
-	unset IFS
-	echo ${data[0]}
+	IFS=$'\n'
+	while read user; do
+		IFS=':' a=$($user)
+		if [[ "${a[3]}" == "$1" ]]; then
+			echo "${a[0]}"
+			break
+		fi
+	done < secret/users.dat
+	return 1
 }
 
 # THIS FUNCTION IS DANGEROUS
 # delete_account(username)
 function delete_account() {
-  [[ "$1" == "" ]] && return
+  [[ "$1" == "" ]] && return 1
   sed -i "s/^$1:.*//;/^$/d" secret/users.dat
 }

From 1059fcf1774beab6a73bfc434b7c6e93871d139e Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 19 Jul 2024 17:35:11 +0200
Subject: [PATCH 010/112] template: fix edge case with newline splitting sed
 arguments

---
 src/template.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/template.sh b/src/template.sh
index a1164b5..10feacd 100755
--- a/src/template.sh
+++ b/src/template.sh
@@ -69,7 +69,7 @@ function render() {
 			if [[ "$3" != true ]]; then
 				local value="$(html_encode <<< "${ref[$key]}" | sed -E 's/\&/�UwU�/g')"
 			else
-				local value="$(sed -E 's/\\\\/�OwO�/g;s/\\//g;s/�OwO�/\\/g' <<< "${ref[$key]}" | html_encode | sed -E 's/\&/�UwU�/g')"
+				local value="$(echo -n "${ref[$key]}" | tr -d $'\01'$'\02' | tr $'\n' $'\01' | sed -E 's/\\\\/�OwO�/g;s/\\//g;s/�OwO�/\\/g' | html_encode | sed -E 's/\&/�UwU�/g')"
 			fi
 			echo 's'$'\02''\{\{\.'"$key"'\}\}'$'\02'''"$value"''$'\02''g;' >> "$tmp"
 		else

From ccc1ce327338fba75de8bec72ffeff78bd577cc1 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 19 Jul 2024 18:03:27 +0200
Subject: [PATCH 011/112] account: typo fix + minor flow changes

---
 src/account.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/account.sh b/src/account.sh
index b73cd78..4fe8059 100755
--- a/src/account.sh
+++ b/src/account.sh
@@ -98,10 +98,11 @@ function logout() {
 
 # session_verify(session)
 function session_verify() {
+	[[ "$1" == '' ]] && return 1
 	IFS=$'\n'
 	while read user; do
 		IFS=: a=($user)
-		if [[ "${a[3]}" == "$1" && "$1" != '' ]]; then
+		if [[ "${a[3]}" == "$1" ]]; then
 			return 0
 		fi
 	done < secret/users.dat
@@ -114,10 +115,10 @@ function session_get_username() {
 
 	IFS=$'\n'
 	while read user; do
-		IFS=':' a=$($user)
+		IFS=':' a=($user)
 		if [[ "${a[3]}" == "$1" ]]; then
 			echo "${a[0]}"
-			break
+			return 0
 		fi
 	done < secret/users.dat
 	return 1

From ac89f028d07e7eefd3a57d1ee99ef2d6e671a6f7 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 19 Jul 2024 22:24:51 +0200
Subject: [PATCH 012/112] template: fix misrenders due to unsorted key array

---
 src/template.sh | 48 +++++++++++++++++++++++++++---------------------
 1 file changed, 27 insertions(+), 21 deletions(-)

diff --git a/src/template.sh b/src/template.sh
index 10feacd..0f01bda 100755
--- a/src/template.sh
+++ b/src/template.sh
@@ -12,30 +12,10 @@ function render() {
 	local -n ref=$1
 	local tmp=$(mktemp)
 
-	# hack below!
-	# this whole code iterates over an array we control, but I want to add
-	# template includes. Hence, we have to pre-parse the template to
-	# find all of our include statements and add them to the roundup.
-
-	while read elem; do
-		ref[#$elem]=
-	done <<< "$(grep -Poh '{{#.*?}}' <<< "$template" | sed 's/{{#//;s/}}$//')"
-
 	local key
 	IFS=$'\n'
 	for key in ${!ref[@]}; do
-		if [[ "$key" == "#"* ]]; then # include mode
-			local file="${key/\#/}"
-
-			# below check prevents the loop loading itself as a template.
-			# this is possibly not enough to prevent all recursions, but
-			# i see it as a last-ditch measure. so it'll do here.
-			if [[ "$file" == "$2" ]]; then
-				echo 's'$'\02''\{\{'"\\$key"'\}\}'$'\02''I cowardly refuse to endlessly recurse\!'$'\02''g;' >> "$tmp"
-			elif [[ -f "$file" ]]; then
-				echo 's'$'\02''\{\{'"\\$key"'\}\}'$'\02'"$(tr -d $'\01'$'\02' < "$file" | sed 's/\&/�UwU�/g')"$'\02''g;' >> "$tmp"
-			fi
-		elif [[ "$key" == "_"* ]]; then # iter mode
+		if [[ "$key" == "_"* ]]; then # iter mode
 			local subtemplate=$(mktemp)
 			echo "$template" | grep "{{start $key}}" -A99999 | grep "{{end $key}}" -B99999 | tr '\n' $'\01' > "$subtemplate"
 
@@ -61,6 +41,12 @@ function render() {
 
 			local subtemplate=$(mktemp)
 			echo 's'$'\02''\{\{start '"$_key"'\}\}((.*)\{\{else '"$_key"'\}\}.*\{\{end '"$_key"'\}\}|(.*)\{\{end '"$_key"'\}\})'$'\02''\2\3'$'\02'';' >> "$subtemplate"
+
+			# TODO: check if this is needed?
+			# the code below makes sure to resolve the conditional blocks
+			# *before* anything else. I can't think of *why* this is needed
+			# right now, but I definitely had a reason in this. Question is, what reason.
+			
 			cat <<< $(cat "$subtemplate" "$tmp") > "$tmp" # call that cat abuse
 
 			rm "$subtemplate"
@@ -78,6 +64,26 @@ function render() {
 	done
 	unset IFS
 
+	# process file includes;
+	# achtung: even though this is *after* the main loop, it actually executes sed reaplces *before* it;
+	# recursion is currently unsupported here, i feel like it may break things?
+	if [[ "$template" == *'{{#'* && "$3" != true ]]; then
+		local subtemplate=$(mktemp)
+		while read key; do 
+			# below check prevents the loop loading itself as a template.
+			# this is possibly not enough to prevent all recursions, but
+			# i see it as a last-ditch measure. so it'll do here.
+			if [[ "$file" == "$2" ]]; then
+				echo 's'$'\02''\{\{\#'"$key"'\}\}'$'\02''I cowardly refuse to endlessly recurse\!'$'\02''g;' >> "$subtemplate"
+			elif [[ -f "$key" ]]; then
+				echo 's'$'\02''\{\{\#'"$key"'\}\}'$'\02'"$(tr -d $'\01'$'\02' < "$key" | tr $'\n' $'\01' | sed 's/\&/�UwU�/g')"$'\02''g;' >> "$subtemplate"
+			fi
+		done <<< "$(grep -Poh '{{#.*?}}' <<< "$template" | sed 's/{{#//;s/}}$//')"
+
+		cat <<< $(cat "$subtemplate" "$tmp") > "$tmp"
+		rm "$subtemplate"
+	fi
+
 	if [[ "$3" != true ]]; then # are we recursing?
 		cat "$tmp" | tr '\n' $'\01' | sed -E 's/'$'\02'';'$'\01''/'$'\02'';/g;s/'$'\02''g;'$'\01''/'$'\02''g;/g' > "${tmp}_"
 		

From 00f9432b295f9ddee6035682390222d2b2019e77 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 19 Jul 2024 23:11:27 +0200
Subject: [PATCH 013/112] misc: fix decoding spaces in url_decode (oops?)

---
 src/misc.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/misc.sh b/src/misc.sh
index 4da8b06..7f7b1e0 100755
--- a/src/misc.sh
+++ b/src/misc.sh
@@ -53,7 +53,7 @@ function url_encode() {
 
 # url_decode(string)
 function url_decode() {
-	echo -ne "$(sed -E 's/%[0-1][0-9a-f]//g;s/%/\\x/g' <<< "$1")"
+	echo -ne "$(sed -E 's/%[0-1][0-9a-f]//g;s/%/\\x/g;s/\+/ /g' <<< "$1")"
 }
 
 # bogus function!

From efbeca0498ddf8e598b3c5b609f06777967fa080 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Wed, 24 Jul 2024 03:01:43 +0200
Subject: [PATCH 014/112] template: normalize IFS

---
 src/template.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/template.sh b/src/template.sh
index 0f01bda..af38357 100755
--- a/src/template.sh
+++ b/src/template.sh
@@ -140,6 +140,7 @@ function nested_add() {
 	declare -g -A _$nested_id
 	
 	# poor man's array copy
+	IFS=' '
 	for k in ${!nested_ref[@]}; do
 		declare -g -A _$nested_id[$k]="${nested_ref[$k]}"
 	done

From 1df5fb17cada14cac80d79280f1e37d7d34873d0 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 26 Jul 2024 02:51:34 +0200
Subject: [PATCH 015/112] notORM: new generic data I/O interface, currently
 backed by CSV-esque files

---
 src/notORM.sh | 165 ++++++++++++++++++++++++++++++++++++++++++++++++++
 src/server.sh |   1 +
 2 files changed, 166 insertions(+)
 create mode 100755 src/notORM.sh

diff --git a/src/notORM.sh b/src/notORM.sh
new file mode 100755
index 0000000..cc534ad
--- /dev/null
+++ b/src/notORM.sh
@@ -0,0 +1,165 @@
+#!/bin/bash
+## notORM.sh - clearly, not an ORM.
+# basic interface for saving semi-arbitrary data organized in "tables".
+
+## limitations:
+# - only for strings (we trim some bytes; see `reserved values` below)
+# - currently only supports saving to CSV-with-extra-steps
+
+## function return values:
+#
+# 0 - success
+# 1 - general failure
+# 2 - entry not found
+# 3 - locked, try again later
+# 4 - file not found
+
+## data reserved values:
+#
+# \x00 - bash yeets it out of existence
+# \x01 - delimeter
+# \x02 - newline
+# \x03 - control chr for sed
+delim=$'\01'
+newline=$'\02'
+ctrl=$'\03'
+
+repeat() {
+	local IFS=' '
+	printf -- "$2%.0s" $(seq 1 $1)
+}
+
+# adds a flat `array` to the `store`.
+# a store can be any file, as long as we have r/w access to it and the
+# adjacent directory.
+#
+# this function will create some helper files if they don't exist. those
+# shouldn't be removed, as other functions may use them for data mangling.
+#
+# data_add(store, array)
+data_add() {
+	[[ ! -v "$2" ]] && return 1
+	local -n ref="$2"
+	[[ ! -f "$1" ]] && echo "${#ref[@]}" > "${1}.cols"
+	local res=
+	local IFS=$'\n'
+
+	for i in "${ref[@]}"; do
+		res+="$(echo -n "$i" | tr -d '\01\02\03' | tr '\n' '\02')"$delim
+	done
+
+	echo "$res" >> "$1" # TODO: some locking
+}
+
+# get one entry from store, filtering by search. exit after first result.
+# by default uses the 0th column. override with optional `column`.
+# returns the data to $res. override with optional `res`
+#
+# data_get(store, search, [column], [res]) -> $res / ${!4}
+data_get() {
+	[[ ! "$2" ]] && return 1
+	[[ ! -f "$1" ]] && return 4
+	local column=${3:-0}
+	local -n ref=${4:-res}
+	local IFS=$'\n'
+
+	while read line; do
+		local IFS=$delim
+		ref=($(tr '\02' '\n' <<< "$line"))
+		[[ "${ref[$column]}" == "$2" ]] && return 0
+	done < "$1"
+
+	return 2
+}
+
+# run `callback` on all entries from `store` that match `search`.
+# by default uses the 0th column. override with optional `column`
+#
+# data_iter(store, search, callback, [column]) -> $data
+data_iter() {
+	[[ ! "$3" ]] && return 1
+	local column=${4:-0}
+	local IFS=$'\n'
+
+	while read line; do
+		local IFS=$delim
+		data=($(tr '\02' '\n' <<< "$line"))
+		[[ "${data[$column]}" == "$2" || ! "$2" ]] && "$3"
+	done < "$1"
+}
+
+# replace a value in `store` with `array`, filtering by `search`.
+# by default uses the 0th column. override with optional `column`
+#
+# `value` is any string, which will directly replace `search`
+#
+# data_replace(store, search, value, [column])
+data_replace_value() {
+	[[ ! "$3" ]] && return 1
+	[[ ! -f "$1" ]] && return 4
+	local column=${4:-0}
+	local IFS=' '
+	
+	if [[ $column == 0 ]]; then
+		local expr="s$ctrl^$(_sed_sanitize "$2")(${delim}.*)$ctrl$(_sed_sanitize "$3")\1$ctrl"
+	else
+		local expr="s$ctrl^($(repeat $column ".*$delim"))$(_sed_sanitize "$2")($delim$(repeat $(( $(cat "${1}.cols") - column - 1 )) ".*$delim"))"'$'"$ctrl\1$(_sed_sanitize "$3")\2$ctrl"
+	fi
+
+	sed -E -i "$expr" "$1"
+}
+
+# replace an entire entry in `store` with `array`, filtering by `search`.
+# by default uses the 0th column. override with optional `column`
+#
+# pass `array` without expanding (`arr`, not `$arr`).
+#
+# data_replace(store, search, array, [column])
+data_replace() {
+	[[ ! "$3" ]] && return 1
+	[[ ! -f "$1" ]] && return 4
+	local column=${4:-0}
+	local -n ref="$3"
+	local output=
+	local IFS=' '
+	
+	for i in "${ref[@]}"; do
+		output+="$(echo -n "$i" | tr -d '\01\02\03' | tr '\n' '\02')$delim"
+	done
+	
+	if [[ $column == 0 ]]; then
+		local expr="s$ctrl^$(_sed_sanitize "$2")${delim}.*$ctrl$(_sed_sanitize_array "$output")$ctrl"
+	else
+		local expr="s$ctrl^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${1}.cols") - column - 1 )) ".*$delim")"'$'"$ctrl$(_sed_sanitize_array "$output")$ctrl"
+	fi
+
+	sed -E -i "$expr" "$1"
+}
+
+# deletes entries from the `store` using `search`.
+# by default uses the 0th column. override with optional `column`
+#
+# data_yeet(store, search, [column])
+data_yeet() {
+	[[ ! "$2" ]] && return 1
+	[[ ! -f "$1" ]] && return 4
+	local column=${3:-0}
+	local IFS=' '
+
+	if [[ $column == 0 ]]; then
+		local expr="/^$(_sed_sanitize "$2")${delim}.*/d"
+	else
+		local expr="/^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${1}.cols") - column - 1 )) ".*$delim")"'$'"/d"
+	fi
+
+	sed -E -i "$expr" "$1"
+}
+
+_sed_sanitize() {
+	echo -n "$1" | tr -d '\01\02\03' | tr '\n' '\02' | xxd -p | tr -d '\n' | sed -E 's/../\\x&/g'	
+}
+
+_sed_sanitize_array() {
+	echo -n "$1" | xxd -p | tr -d '\n' | sed -E 's/../\\x&/g'	
+}
+
diff --git a/src/server.sh b/src/server.sh
index cc0f17d..1cc25f2 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -12,6 +12,7 @@ source src/account.sh
 source src/mail.sh
 source src/route.sh
 source src/template.sh
+source src/notORM.sh # to be split off HTTP.sh at some point :^)
 [[ -f "${cfg[namespace]}/config.sh" ]] && source "${cfg[namespace]}/config.sh"
 
 declare -A r # current request / response

From bb8526a75228815471a1234e7414d40fef03b46f Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 26 Jul 2024 03:20:50 +0200
Subject: [PATCH 016/112] account: migrate to notORM for data storage

---
 src/account.sh | 65 +++++++++++++++++---------------------------------
 1 file changed, 22 insertions(+), 43 deletions(-)

diff --git a/src/account.sh b/src/account.sh
index 4fe8059..3b29021 100755
--- a/src/account.sh
+++ b/src/account.sh
@@ -3,17 +3,13 @@
 
 # register(username, password)
 function register() {
-	local username=$(echo -ne $(sed -E "s/ /_/g;s/\:/\-/g;s/\%/\\x/g" <<< "$1"))
+	local username=$(url_decode "$1")
 
-	IFS=$'\n'
-	while read user; do
-		IFS=: a=($user)
-		if [[ "${a[0]}" == "$username" ]]; then
-			reason="This user already exists!"
-			return 1
-		fi
-	done < secret/users.dat
-	unset IFS
+	data_get secret/users.dat "$username"
+	if [[ $? != 2 && $? != 4 ]]; then # entry not found / file not found
+		reason="This user already exists!"
+		return 1		
+	fi
 	
 	if [[ "${cfg[hash]}" == "argon2id" ]]; then
 		local salt=$(dd if=/dev/urandom bs=256 count=1 | sha1sum | cut -c 1-16)
@@ -27,21 +23,16 @@ function register() {
 	
 	set_cookie_permanent "sh_session" $token
 	set_cookie_permanent "username" $username
-	
-	echo "$username:$hash:$salt:$token" >> secret/users.dat
+
+	out=("$username" "$hash" "$salt" "$token")
+	data_add secret/users.dat out
 }
 
 # login(username, password) 
 function login() {
-	local username=$(echo -ne $(sed -E 's/%/\\x/g' <<< "$1"))
-	IFS=$'\n'
-	while read a; do
-		IFS=: user=($a)
-		if [[ "${user[0]}" == "$username" ]]; then
-			break
-		fi
-	done < secret/users.dat
-	if [[ "${user[0]}" == '' ]]; then
+	local username=$(url_decode "$1")
+
+	if ! data_get secret/users.dat "$username" 0 user; then
 		reason="Bad credentials"
 		return 1
 	fi
@@ -70,12 +61,7 @@ function login_simple() {
 	local password=$(sed -E 's/^(.*)\://' <<< "$data")
 	local login=$(sed -E 's/\:(.*)$//' <<< "$data")
 
-	IFS=$'\n'
-	while read a; do
-		IFS=':' user=($a)
-		[[ ${user[0]} == "$login" ]] && break
-	done < secret/users.dat
-	unset IFS
+	data_get secret/users.dat "$login" 0 user
 
 	if [[ "${cfg[hash]}" == "argon2id" ]]; then
 		hash="$(echo -n "$password" | argon2 "${user[2]}" -id -e)"
@@ -99,13 +85,10 @@ function logout() {
 # session_verify(session)
 function session_verify() {
 	[[ "$1" == '' ]] && return 1
-	IFS=$'\n'
-	while read user; do
-		IFS=: a=($user)
-		if [[ "${a[3]}" == "$1" ]]; then
-			return 0
-		fi
-	done < secret/users.dat
+
+	if data_get secret/users.dat "$1" 3; then
+		return 0
+	fi
 	return 1
 }
 
@@ -113,14 +96,10 @@ function session_verify() {
 function session_get_username() {
 	[[ "$1" == "" ]] && return 1
 
-	IFS=$'\n'
-	while read user; do
-		IFS=':' a=($user)
-		if [[ "${a[3]}" == "$1" ]]; then
-			echo "${a[0]}"
-			return 0
-		fi
-	done < secret/users.dat
+	if data_get secret/users.dat "$1" 3 user; then
+		echo "${user[0]}"
+		return 0
+	fi
 	return 1
 }
 
@@ -128,5 +107,5 @@ function session_get_username() {
 # delete_account(username)
 function delete_account() {
   [[ "$1" == "" ]] && return 1
-  sed -i "s/^$1:.*//;/^$/d" secret/users.dat
+  data_yeet secret/users.dat "$1"
 }

From 2c1dfa20f171b76e5d06a17abe7acf07ea15972a Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 26 Jul 2024 03:24:14 +0200
Subject: [PATCH 017/112] meta: version bump, since i'm breaking compat anyways

---
 config/master_example.sh | 4 ++--
 http.sh                  | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/config/master_example.sh b/config/master_example.sh
index 17ede6f..e080e14 100644
--- a/config/master_example.sh
+++ b/config/master_example.sh
@@ -21,9 +21,9 @@ cfg[ssl_cert]=''
 cfg[ssl_key]=''
 
 cfg[extension]='shs'
-cfg[extra_headers]='server: HTTP.sh/0.95 (devel)'
+cfg[extra_headers]='server: HTTP.sh/0.96 (devel)'
 
-cfg[title]='HTTP.sh 0.95'
+cfg[title]='HTTP.sh 0.96'
 
 cfg[php_enabled]=false # enable PHP script evalutaion (requires PHP)
 cfg[python_enabled]=false # enable Python script evalutaion (requires Python)
diff --git a/http.sh b/http.sh
index af82dfa..96d8817 100755
--- a/http.sh
+++ b/http.sh
@@ -27,9 +27,9 @@ cfg[ssl_cert]=''
 cfg[ssl_key]=''
 
 cfg[extension]='shs'
-cfg[extra_headers]='server: HTTP.sh/0.95 (devel)'
+cfg[extra_headers]='server: HTTP.sh/0.96 (devel)'
 
-cfg[title]='HTTP.sh 0.95'
+cfg[title]='HTTP.sh 0.96'
 
 cfg[php_enabled]=false # enable PHP script evalutaion (requires PHP)
 cfg[python_enabled]=false # enable Python script evalutaion (requires Python)

From ee1a5401206a5cf812b91b2ee0ad9ab083a6a1b4 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 26 Jul 2024 20:52:42 +0200
Subject: [PATCH 018/112] server: remove some of the parsing crimes

---
 src/server.sh | 43 ++++++++++++++++---------------------------
 1 file changed, 16 insertions(+), 27 deletions(-)

diff --git a/src/server.sh b/src/server.sh
index 1cc25f2..c682011 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -33,6 +33,8 @@ while read -r param; do
 	value=''
 	data=''
 	unset IFS
+
+	# TODO: think about refactoring those ifs; maybe we *don't* need to have a header "allowlist" afterall...
 	
 	if [[ "$param_l" == $'\015' ]]; then
 		break
@@ -84,36 +86,23 @@ while read -r param; do
 	elif [[ "$param_l" == "range: bytes="* ]]; then
 		r[range]="$(sed 's/Range: bytes=//;s/\r//' <<< "$param")"
 		
-	elif [[ "$param" == *"GET "* ]]; then
-		r[url]="$(echo -ne "$(url_decode "$(sed -E 's/GET //;s/HTTP\/[0-9]+\.[0-9]+//;s/ //g;s/\/*\r//g;s/\/\/*/\//g' <<< "$param")")")"
-		data="$(sed -E 's/\?/��Lun4_iS_CuTe�/;s/^(.*)��Lun4_iS_CuTe�//;s/\&/ /g' <<< "${r[url]}")"
-		if [[ "$data" != "${r[url]}" ]]; then
-			data="$(sed -E 's/\?/��Lun4_iS_CuTe�/;s/^(.*)��Lun4_iS_CuTe�//' <<< "${r[url]}")"
-			IFS='&'
-			for i in $data; do
-				name="${i/=*/}"
-				value="${i/*=/}"
-				get_data[$name]="$value"
-			done
-		fi
-		
-	elif [[ "$param" == *"POST "* ]]; then
-		r[url]="$(echo -ne "$(url_decode "$(sed -E 's/POST //;s/HTTP\/[0-9]+\.[0-9]+//;s/ //g;s/\/*\r//g;s/\/\/*/\//g' <<< "$param")")")"
-		r[post]=true
-		# below shamelessly copied from GET, should be moved to a function
-		data="$(sed -E 's/\?/��Lun4_iS_CuTe�/;s/^(.*)��Lun4_iS_CuTe�//;s/\&/ /g' <<< "${r[url]}")"
-		if [[ "$data" != "${r[url]}" ]]; then
-			data="$(sed -E 's/\?/��Lun4_iS_CuTe�/;s/^(.*)��Lun4_iS_CuTe�//' <<< "${r[url]}")"
-			IFS='&'
-			for i in $data; do
-				name="${i/=*/}"
-				value="${i/*=/}"
-				get_data[$name]="$value"
-			done
-		fi		
+	elif [[ "$param" =~ ^(GET|POST|PATCH|PUT|DELETE|MEOW) ]]; then # TODO: OPTIONS, HEAD
+		r[method]="${param%% *}"
+		[[ "${r[meow],,}" != "get" ]] && r[post]=true
+		r[url]="$(sed -E 's/^[a-zA-Z]* //;s/HTTP\/[0-9]+\.[0-9]+//;s/ //g;s/\/*\r//g;s/\/\/*/\//g' <<< "$param")"
+
+		IFS='&'
+		for i in ${r[url]#*\?}; do
+			name="$(url_decode "${i%=*}")"
+			value="$(url_decode "${i#*=}")"
+			get_data[$name]="$value"
+		done
+		unset IFS
 	fi
 done
 
+r[url]="$(url_decode "${r[url]}")" # doing this here for.. reasons
+
 r[uri]="$(realpath "${cfg[namespace]}/${cfg[root]}$(sed -E 's/\?(.*)$//' <<< "${r[url]}")")"
 [[ -d "${r[uri]}/" ]] && pwd="${r[uri]}" || pwd=$(dirname "${r[uri]}")
 

From b0f23c01e53a49a59de507e5a35cb91233fc6e0d Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 26 Jul 2024 20:52:52 +0200
Subject: [PATCH 019/112] notORM: fix typo

---
 src/notORM.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index cc534ad..b30ea0c 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -93,7 +93,7 @@ data_iter() {
 #
 # `value` is any string, which will directly replace `search`
 #
-# data_replace(store, search, value, [column])
+# data_replace_value(store, search, value, [column])
 data_replace_value() {
 	[[ ! "$3" ]] && return 1
 	[[ ! -f "$1" ]] && return 4

From 7a6e6c2f3831a98d685b34de81aa2de048177dba Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 26 Jul 2024 20:56:23 +0200
Subject: [PATCH 020/112] server: fix "typo"

---
 src/server.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/server.sh b/src/server.sh
index c682011..3553235 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -88,7 +88,7 @@ while read -r param; do
 		
 	elif [[ "$param" =~ ^(GET|POST|PATCH|PUT|DELETE|MEOW) ]]; then # TODO: OPTIONS, HEAD
 		r[method]="${param%% *}"
-		[[ "${r[meow],,}" != "get" ]] && r[post]=true
+		[[ "${r[method],,}" != "get" ]] && r[post]=true
 		r[url]="$(sed -E 's/^[a-zA-Z]* //;s/HTTP\/[0-9]+\.[0-9]+//;s/ //g;s/\/*\r//g;s/\/\/*/\//g' <<< "$param")"
 
 		IFS='&'

From 0dbd85f9ecc3fbecdcbf74f03a64655e68ef2b92 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 26 Jul 2024 23:11:49 +0200
Subject: [PATCH 021/112] server: better handle custom statuses, fix some
 string escapes

---
 src/account.sh      |  4 ++--
 src/mime.sh         | 24 ++++++++++++++----------
 src/response/200.sh |  8 ++++++--
 src/server.sh       |  4 ++--
 4 files changed, 24 insertions(+), 16 deletions(-)

diff --git a/src/account.sh b/src/account.sh
index 3b29021..607917b 100755
--- a/src/account.sh
+++ b/src/account.sh
@@ -21,8 +21,8 @@ function register() {
 		local hash=$(echo -n $2$salt | sha256sum | cut -c 1-64)
 	fi
 	
-	set_cookie_permanent "sh_session" $token
-	set_cookie_permanent "username" $username
+	set_cookie_permanent "sh_session" "$token"
+	set_cookie_permanent "username" "$username"
 
 	out=("$username" "$hash" "$salt" "$token")
 	data_add secret/users.dat out
diff --git a/src/mime.sh b/src/mime.sh
index 566706f..6cde775 100755
--- a/src/mime.sh
+++ b/src/mime.sh
@@ -14,16 +14,20 @@
 
 function get_mime() {
 	local file="$@"
-	local mime="$(file --mime-type -b "$file")"
-	if [[ $file == *".htm" || $file == *".html" ]]; then
-		mimetype="text/html"
-	elif [[ $file == *".shs" || $file == *".py" || $file == *".php" ]]; then
-		mimetype=""
-	elif [[ $file == *".css" ]]; then
-		mimetype="text/css"
-	elif [[ $mime == "text/"* && $mime != "text/xml" ]]; then
-		mimetype="text/plain"
+	if [[ -f "$file" ]]; then
+		local mime="$(file --mime-type -b "$file")"
+		if [[ $file == *".htm" || $file == *".html" ]]; then
+			mimetype="text/html"
+		elif [[ $file == *".shs" || $file == *".py" || $file == *".php" ]]; then
+			mimetype=""
+		elif [[ $file == *".css" ]]; then
+			mimetype="text/css"
+		elif [[ $mime == "text/"* && $mime != "text/xml" ]]; then
+			mimetype="text/plain"
+		else
+			mimetype="$mime"
+		fi
 	else
-		mimetype="$mime"
+		mimetype=""
 	fi
 }
diff --git a/src/response/200.sh b/src/response/200.sh
index f3dc8da..4b85f93 100755
--- a/src/response/200.sh
+++ b/src/response/200.sh
@@ -1,9 +1,13 @@
+# TODO: move parts of this into server.sh, or rename the file appropriately
+
 function __headers() {
 	if [[ "${cfg[unbuffered]}" != true ]]; then
-		if [[ "${r[headers]}" == *'Location'* ]]; then
+		if [[ "${r[headers]}" == *'Location'* ]]; then # override for redirects
 			printf "HTTP/1.0 302 aaaaa\r\n"	
-		else
+		elif [[ "${r[status]}" == '200' || "${r[status]}" == '212' ]]; then # normal or router, should just return 200
 			printf "HTTP/1.0 200 OK\r\n"
+		else # changed by the user in the meantime :)
+			printf "HTTP/1.0 ${r[status]} meow\r\n"
 		fi
 		[[ "${r[headers]}" != '' ]] && printf "${r[headers]}"
 		printf "${cfg[extra_headers]}\r\n"
diff --git a/src/server.sh b/src/server.sh
index 3553235..f8d7ff4 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -187,7 +187,7 @@ if [[ "${r[post]}" == true ]] && [[ "${r[status]}" == 200 ||  "${r[status]}" ==
 		for i in $boundaries_list; do
 			tmpout=$(mktemp -p $tmpdir)
 			dd iflag=fullblock if=$tmpfile ibs=$(($i+$delimeter_len)) obs=1M skip=1 | while true; do
-				read line
+				read -r line
 				if [[ $line == $'\015' ]]; then
 					cat - > $tmpout
 					break
@@ -201,7 +201,7 @@ if [[ "${r[post]}" == true ]] && [[ "${r[status]}" == 200 ||  "${r[status]}" ==
 		done
 		rm $tmpfile
 	else
-		read -N "${r[content_length]}" data
+		read -r -N "${r[content_length]}" data
 		
 		IFS='&'
 		for i in $(tr -d '\n' <<< "$data"); do

From eb80d427116735447396def3bb5b2d25fdbbd4aa Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Tue, 30 Jul 2024 16:48:30 +0200
Subject: [PATCH 022/112] server: fix slight parameter decode mangling

---
 src/server.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/server.sh b/src/server.sh
index f8d7ff4..c237dbf 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -86,14 +86,14 @@ while read -r param; do
 	elif [[ "$param_l" == "range: bytes="* ]]; then
 		r[range]="$(sed 's/Range: bytes=//;s/\r//' <<< "$param")"
 		
-	elif [[ "$param" =~ ^(GET|POST|PATCH|PUT|DELETE|MEOW) ]]; then # TODO: OPTIONS, HEAD
+	elif [[ "$param_l" =~ ^(get|post|patch|put|delete|meow) ]]; then # TODO: OPTIONS, HEAD
 		r[method]="${param%% *}"
 		[[ "${r[method],,}" != "get" ]] && r[post]=true
 		r[url]="$(sed -E 's/^[a-zA-Z]* //;s/HTTP\/[0-9]+\.[0-9]+//;s/ //g;s/\/*\r//g;s/\/\/*/\//g' <<< "$param")"
 
 		IFS='&'
 		for i in ${r[url]#*\?}; do
-			name="$(url_decode "${i%=*}")"
+			name="$(url_decode "${i%%=*}")"
 			value="$(url_decode "${i#*=}")"
 			get_data[$name]="$value"
 		done

From 640baa8e7b308c6d26aa045fc27435234b648b89 Mon Sep 17 00:00:00 2001
From: Linus Groh <mail@linusgroh.de>
Date: Sun, 28 Jul 2024 17:40:34 +0100
Subject: [PATCH 023/112] docker: bump to alpine:3.20

---
 Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Dockerfile b/Dockerfile
index 5badeb3..4aab686 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM alpine:3.14
+FROM alpine:3.20
 
 RUN apk update \
  && apk add sed xxd grep findutils file nmap-ncat socat jq bash file curl

From cb2acacc3208df741ee2265f1576c03169c281a8 Mon Sep 17 00:00:00 2001
From: famfo <famfo@famfo.xyz>
Date: Wed, 31 Jul 2024 19:38:54 +0200
Subject: [PATCH 024/112] Set content type when running in buffered mode

---
 src/mime.sh         | 17 +++++++++++++++++
 src/response/200.sh | 10 ++++++++--
 2 files changed, 25 insertions(+), 2 deletions(-)

diff --git a/src/mime.sh b/src/mime.sh
index 6cde775..f9d05c6 100755
--- a/src/mime.sh
+++ b/src/mime.sh
@@ -31,3 +31,20 @@ function get_mime() {
 		mimetype=""
 	fi
 }
+
+# get_mime_contents(path) -> $mimetype
+# Sets an empty mimetype if nothing known is matched
+# Limitations:
+# - CSS doesn't get matched (curse you `file`)
+# TODO: add more types
+function get_mime_contents() {
+    local ftype=$(file "$1")
+    mimetype=""
+    case "$ftype" in
+        *"HTML document"*) mimetype="text/html";;
+        *"SVG Scalable Vector Graphics image"*) mimetype="image/svg+xml";;
+        *"PNG image data"*) mimetype="image/png";;
+        *"JPEG image data"*) mimetype="image/jpeg";;
+    esac
+}
+
diff --git a/src/response/200.sh b/src/response/200.sh
index 4b85f93..fe28ae6 100755
--- a/src/response/200.sh
+++ b/src/response/200.sh
@@ -1,5 +1,7 @@
 # TODO: move parts of this into server.sh, or rename the file appropriately
 
+# __headers(end)
+# Sets the header and terminates the header block if end is NOT set to false
 function __headers() {
 	if [[ "${cfg[unbuffered]}" != true ]]; then
 		if [[ "${r[headers]}" == *'Location'* ]]; then # override for redirects
@@ -19,7 +21,8 @@ function __headers() {
 		get_mime "${r[uri]}"
 		[[ "$mimetype" != '' ]] && printf "content-type: $mimetype\r\n"
 	fi
-	printf "\r\n"
+
+    [[ "$1" != false ]] && printf "\r\n"
 }
 
 if [[ ${r[status]} == 212 ]]; then
@@ -28,7 +31,10 @@ if [[ ${r[status]} == 212 ]]; then
 	else
 		temp=$(mktemp)
 		source "${r[view]}" > $temp
-		__headers
+		__headers false
+        get_mime_contents "$temp"
+        [[ "$mimetype" != '' ]] && printf "content-type: $mimetype\r\n"
+        printf "\r\n"
 		cat $temp
 		rm $temp
 	fi

From 9adc827018f51a5c168f9d3bdf264f483da820db Mon Sep 17 00:00:00 2001
From: famfo <famfo@famfo.xyz>
Date: Wed, 31 Jul 2024 19:51:59 +0200
Subject: [PATCH 025/112] Set content type for 403 and 404 pages

---
 src/response/403.sh | 1 +
 src/response/404.sh | 1 +
 2 files changed, 2 insertions(+)

diff --git a/src/response/403.sh b/src/response/403.sh
index 44a2efb..3b12227 100755
--- a/src/response/403.sh
+++ b/src/response/403.sh
@@ -1,4 +1,5 @@
 printf "HTTP/1.0 403 Forbidden
+content-type: text/html
 ${cfg[extra_headers]}\r\n\r\n"
 source templates/head.sh
 echo "<h1>403: You've been naughty</h1>"
diff --git a/src/response/404.sh b/src/response/404.sh
index b60b500..2dedb34 100755
--- a/src/response/404.sh
+++ b/src/response/404.sh
@@ -1,4 +1,5 @@
 printf "HTTP/1.0 404 Not Found
+content-type: text/html
 ${cfg[extra_headers]}\r\n\r\n"
 source templates/head.sh
 echo "<h1>404 Not Found</h1>"

From 317c827a1dfd6946a57d4e2ce50139c4fa8deef4 Mon Sep 17 00:00:00 2001
From: famfo <famfo@famfo.xyz>
Date: Wed, 31 Jul 2024 19:55:32 +0200
Subject: [PATCH 026/112] Set content type for listing

---
 src/response/listing.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/response/listing.sh b/src/response/listing.sh
index ea7f6a2..b94ff02 100755
--- a/src/response/listing.sh
+++ b/src/response/listing.sh
@@ -1,4 +1,5 @@
 printf "HTTP/1.0 200 OK
+content-type: text/html
 ${cfg[extra_headers]}\r\n\r\n"
 
 source templates/head.sh

From d93323597d719b261c55f5dad464d48e417d5cce Mon Sep 17 00:00:00 2001
From: famfo <famfo@famfo.xyz>
Date: Wed, 31 Jul 2024 20:17:47 +0200
Subject: [PATCH 027/112] Use file diretcly to set mime type

---
 src/mime.sh         | 16 ----------------
 src/response/200.sh |  5 +++--
 2 files changed, 3 insertions(+), 18 deletions(-)

diff --git a/src/mime.sh b/src/mime.sh
index f9d05c6..035ba74 100755
--- a/src/mime.sh
+++ b/src/mime.sh
@@ -32,19 +32,3 @@ function get_mime() {
 	fi
 }
 
-# get_mime_contents(path) -> $mimetype
-# Sets an empty mimetype if nothing known is matched
-# Limitations:
-# - CSS doesn't get matched (curse you `file`)
-# TODO: add more types
-function get_mime_contents() {
-    local ftype=$(file "$1")
-    mimetype=""
-    case "$ftype" in
-        *"HTML document"*) mimetype="text/html";;
-        *"SVG Scalable Vector Graphics image"*) mimetype="image/svg+xml";;
-        *"PNG image data"*) mimetype="image/png";;
-        *"JPEG image data"*) mimetype="image/jpeg";;
-    esac
-}
-
diff --git a/src/response/200.sh b/src/response/200.sh
index fe28ae6..2fdf61b 100755
--- a/src/response/200.sh
+++ b/src/response/200.sh
@@ -32,8 +32,9 @@ if [[ ${r[status]} == 212 ]]; then
 		temp=$(mktemp)
 		source "${r[view]}" > $temp
 		__headers false
-        get_mime_contents "$temp"
-        [[ "$mimetype" != '' ]] && printf "content-type: $mimetype\r\n"
+        mimetype=$(file --mime-type -b "$temp")
+        # Defaults to text/plain for things it doesn't know, eg. CSS
+        [[ "$mimetype" != 'text/plain' ]] && printf "content-type: $mimetype\r\n"
         printf "\r\n"
 		cat $temp
 		rm $temp

From 343da427a1e38f35d1d3fc1075304bee1c451fdb Mon Sep 17 00:00:00 2001
From: famfo <famfo@famfo.xyz>
Date: Wed, 31 Jul 2024 20:32:07 +0200
Subject: [PATCH 028/112] Modify get_mime to allow text/html

---
 src/mime.sh         | 2 +-
 src/response/200.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/mime.sh b/src/mime.sh
index 035ba74..df3377a 100755
--- a/src/mime.sh
+++ b/src/mime.sh
@@ -16,7 +16,7 @@ function get_mime() {
 	local file="$@"
 	if [[ -f "$file" ]]; then
 		local mime="$(file --mime-type -b "$file")"
-		if [[ $file == *".htm" || $file == *".html" ]]; then
+		if [[ $file == *".htm" || $file == *".html" || $mime == "text/html" ]]; then
 			mimetype="text/html"
 		elif [[ $file == *".shs" || $file == *".py" || $file == *".php" ]]; then
 			mimetype=""
diff --git a/src/response/200.sh b/src/response/200.sh
index 2fdf61b..b6ecd99 100755
--- a/src/response/200.sh
+++ b/src/response/200.sh
@@ -32,7 +32,7 @@ if [[ ${r[status]} == 212 ]]; then
 		temp=$(mktemp)
 		source "${r[view]}" > $temp
 		__headers false
-        mimetype=$(file --mime-type -b "$temp")
+        get_mime "$temp"
         # Defaults to text/plain for things it doesn't know, eg. CSS
         [[ "$mimetype" != 'text/plain' ]] && printf "content-type: $mimetype\r\n"
         printf "\r\n"

From 3e50cc873789a223332b9691b8e71f84b1c53db1 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 3 Aug 2024 20:13:27 +0200
Subject: [PATCH 029/112] account: optional extra fields

---
 src/account.sh | 20 ++++++++++++++++----
 1 file changed, 16 insertions(+), 4 deletions(-)

diff --git a/src/account.sh b/src/account.sh
index 607917b..c1da649 100755
--- a/src/account.sh
+++ b/src/account.sh
@@ -1,9 +1,14 @@
 #!/usr/bin/env bash
 # account.sh - account and session mgmt
 
-# register(username, password)
+# registers a new user.
+# first two params are strings; third is a reference to an array with
+# optional extra data (email, OTP...)
+#
+# register(username, password, [extra])
 function register() {
 	local username=$(url_decode "$1")
+	unset IFS
 
 	data_get secret/users.dat "$username"
 	if [[ $? != 2 && $? != 4 ]]; then # entry not found / file not found
@@ -24,13 +29,14 @@ function register() {
 	set_cookie_permanent "sh_session" "$token"
 	set_cookie_permanent "username" "$username"
 
-	out=("$username" "$hash" "$salt" "$token")
+	out=("$username" "$hash" "$salt" "$token" "${extra[@]}")
 	data_add secret/users.dat out
 }
 
-# login(username, password) 
+# login(username, password) -> [res]
 function login() {
 	local username=$(url_decode "$1")
+	unset IFS
 
 	if ! data_get secret/users.dat "$username" 0 user; then
 		reason="Bad credentials"
@@ -46,6 +52,9 @@ function login() {
 	if [[ "$hash" == "${user[1]}" ]]; then
 		set_cookie_permanent "sh_session" "${user[3]}"
 		set_cookie_permanent "username" "$username"
+
+		declare -ga res=("${user[@]:4}")
+		
 		return 0
 	else
 		remove_cookie "sh_session"
@@ -82,11 +91,13 @@ function logout() {
 	remove_cookie "username"
 }
 
-# session_verify(session)
+# session_verify(session) -> [res]
 function session_verify() {
 	[[ "$1" == '' ]] && return 1
+	unset IFS
 
 	if data_get secret/users.dat "$1" 3; then
+		declare -ga res=("${user[@]:4}")
 		return 0
 	fi
 	return 1
@@ -95,6 +106,7 @@ function session_verify() {
 # session_get_username(session)
 function session_get_username() {
 	[[ "$1" == "" ]] && return 1
+	unset IFS
 
 	if data_get secret/users.dat "$1" 3 user; then
 		echo "${user[0]}"

From 5ef931ca9d6d983ebceb2d46137af8ce80615fcf Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 4 Aug 2024 00:19:47 +0200
Subject: [PATCH 030/112] account: finally, proper sessions

---
 src/account.sh | 51 +++++++++++++++++++++++++++++++++++---------------
 1 file changed, 36 insertions(+), 15 deletions(-)

diff --git a/src/account.sh b/src/account.sh
index c1da649..f5af493 100755
--- a/src/account.sh
+++ b/src/account.sh
@@ -17,20 +17,22 @@ function register() {
 	fi
 	
 	if [[ "${cfg[hash]}" == "argon2id" ]]; then
-		local salt=$(dd if=/dev/urandom bs=256 count=1 | sha1sum | cut -c 1-16)
-		local token=$(dd if=/dev/urandom bs=32 count=1 | sha1sum | cut -c 1-40)
+		local salt=$(dd if=/dev/urandom bs=16 count=1 status=none | xxd -p)
+		local token=$(dd if=/dev/urandom bs=20 count=1 status=none | xxd -p) # TODO: fully remove
 		local hash="$(echo -n "$2" | argon2 "$salt" -id -e)"
 	else
-		local salt=$(dd if=/dev/urandom bs=256 count=1 | sha1sum | cut -c 1-16)
-		local token=$(dd if=/dev/urandom bs=32 count=1 | sha1sum | cut -c 1-40)
+		local salt=$(dd if=/dev/urandom bs=16 count=1 status=none | xxd -p)
+		local token=$(dd if=/dev/urandom bs=20 count=1 status=none | xxd -p)
 		local hash=$(echo -n $2$salt | sha256sum | cut -c 1-64)
 	fi
-	
-	set_cookie_permanent "sh_session" "$token"
-	set_cookie_permanent "username" "$username"
 
-	out=("$username" "$hash" "$salt" "$token" "${extra[@]}")
+	local out=("$username" "$hash" "$salt" "$token" "${extra[@]}")
 	data_add secret/users.dat out
+
+	_new_session "$username"
+
+	set_cookie_permanent "sh_session" "${session[2]}"
+	set_cookie_permanent "username" "$username"
 }
 
 # login(username, password) -> [res]
@@ -50,7 +52,9 @@ function login() {
 	fi
 	
 	if [[ "$hash" == "${user[1]}" ]]; then
-		set_cookie_permanent "sh_session" "${user[3]}"
+		_new_session "$username"
+		
+		set_cookie_permanent "sh_session" "${session[2]}"
 		set_cookie_permanent "username" "$username"
 
 		declare -ga res=("${user[@]:4}")
@@ -87,6 +91,10 @@ function login_simple() {
 
 # logout()
 function logout() {
+	log "${cookies[sh_session]}"
+	if [[ "${cookies[sh_session]}" ]]; then
+		data_yeet secret/sessions.dat "${cookies[sh_session]}" 2
+	fi
 	remove_cookie "sh_session"
 	remove_cookie "username"
 }
@@ -95,10 +103,13 @@ function logout() {
 function session_verify() {
 	[[ "$1" == '' ]] && return 1
 	unset IFS
+	local user
 
-	if data_get secret/users.dat "$1" 3; then
-		declare -ga res=("${user[@]:4}")
-		return 0
+	if data_get secret/sessions.dat "$1" 2 session; then
+		if data_get secret/users.dat "${session[0]}" 0 user; then # double-check if tables agree
+			declare -ga res=("${user[@]:4}")
+			return 0
+		fi
 	fi
 	return 1
 }
@@ -107,10 +118,13 @@ function session_verify() {
 function session_get_username() {
 	[[ "$1" == "" ]] && return 1
 	unset IFS
+	local session
 
-	if data_get secret/users.dat "$1" 3 user; then
-		echo "${user[0]}"
-		return 0
+	if data_get secret/sessions.dat "$1" 2 session; then
+		if data_get secret/users.dat "${session[0]}" 0 user; then # double-check if tables agree
+			echo "${user[0]}"
+			return 0
+		fi
 	fi
 	return 1
 }
@@ -121,3 +135,10 @@ function delete_account() {
   [[ "$1" == "" ]] && return 1
   data_yeet secret/users.dat "$1"
 }
+
+# _new_session(username) -> $session
+_new_session() {
+	[[ ! "$1" ]] && return 1
+	session=("$1" "$(date '+%s')" "$(dd if=/dev/urandom bs=24 count=1 status=none | xxd -p)")
+	data_add secret/sessions.dat session
+}

From f16005fa0b8959ecabbfab9483a3b34780a91c95 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 4 Aug 2024 00:20:25 +0200
Subject: [PATCH 031/112] notORM: fix the repeat function

---
 src/notORM.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index b30ea0c..7cf7b8b 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -25,8 +25,8 @@ newline=$'\02'
 ctrl=$'\03'
 
 repeat() {
-	local IFS=' '
-	printf -- "$2%.0s" $(seq 1 $1)
+	local IFS=$'\n'
+	[[ "$1" -gt 0 ]] && printf -- "$2%.0s" $(seq 1 $1)
 }
 
 # adds a flat `array` to the `store`.

From 93d02b4295f810ef5ffc28f0ea4d09a722060a93 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 4 Aug 2024 01:33:10 +0200
Subject: [PATCH 032/112] account: more middleware functions

---
 src/account.sh | 116 ++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 95 insertions(+), 21 deletions(-)

diff --git a/src/account.sh b/src/account.sh
index f5af493..c79f4eb 100755
--- a/src/account.sh
+++ b/src/account.sh
@@ -15,16 +15,11 @@ function register() {
 		reason="This user already exists!"
 		return 1		
 	fi
-	
-	if [[ "${cfg[hash]}" == "argon2id" ]]; then
-		local salt=$(dd if=/dev/urandom bs=16 count=1 status=none | xxd -p)
-		local token=$(dd if=/dev/urandom bs=20 count=1 status=none | xxd -p) # TODO: fully remove
-		local hash="$(echo -n "$2" | argon2 "$salt" -id -e)"
-	else
-		local salt=$(dd if=/dev/urandom bs=16 count=1 status=none | xxd -p)
-		local token=$(dd if=/dev/urandom bs=20 count=1 status=none | xxd -p)
-		local hash=$(echo -n $2$salt | sha256sum | cut -c 1-64)
-	fi
+
+	local salt=$(dd if=/dev/urandom bs=16 count=1 status=none | xxd -p)
+	user_gen_reset_token
+
+	_password_hash "$2" "$salt"
 
 	local out=("$username" "$hash" "$salt" "$token" "${extra[@]}")
 	data_add secret/users.dat out
@@ -33,6 +28,8 @@ function register() {
 
 	set_cookie_permanent "sh_session" "${session[2]}"
 	set_cookie_permanent "username" "$username"
+
+	unset hash
 }
 
 # login(username, password) -> [res]
@@ -45,11 +42,7 @@ function login() {
 		return 1
 	fi
 
-	if [[ "${cfg[hash]}" == "argon2id" ]]; then
-		hash="$(echo -n "$2" | argon2 "${user[2]}" -id -e)"
-	else
-		hash="$(echo -n $2${user[2]} | sha256sum | cut -c 1-64 )"
-	fi
+	_password_hash "$2" "${user[2]}"
 	
 	if [[ "$hash" == "${user[1]}" ]]; then
 		_new_session "$username"
@@ -58,12 +51,15 @@ function login() {
 		set_cookie_permanent "username" "$username"
 
 		declare -ga res=("${user[@]:4}")
-		
+
+		unset hash		
 		return 0
 	else
 		remove_cookie "sh_session"
 		remove_cookie "username"
 		reason="Bad credentials"
+		
+		unset hash
 		return 1
 	fi
 }
@@ -76,17 +72,15 @@ function login_simple() {
 
 	data_get secret/users.dat "$login" 0 user
 
-	if [[ "${cfg[hash]}" == "argon2id" ]]; then
-		hash="$(echo -n "$password" | argon2 "${user[2]}" -id -e)"
-	else
-		hash="$(echo -n $password${user[2]} | sha256sum | cut -c 1-64 )"
-	fi
+	_password_hash "$password" "${user[2]}"
 	
 	if [[ "$hash" == "${user[1]}" ]]; then
 		r[authorized]=true
 	else 
 		r[authorized]=false
 	fi
+
+	unset hash
 }
 
 # logout()
@@ -136,9 +130,89 @@ function delete_account() {
   data_yeet secret/users.dat "$1"
 }
 
+# user_reset_password(username, token, new_password)
+user_reset_password() {
+	[[ ! "$1" ]] && return 1 # sensitive function, so we're checking all three
+	[[ ! "$2" ]] && return 1 # there's probably a better way,
+	[[ ! "$3" ]] && return 1 # but i don't care.
+	if data_get secret/users.dat "$1" 0 user; then
+
+		if [[ "$2" == "${user[3]}" ]]; then
+			_password_hash "$3" "${user[2]}"
+			user[1]="$hash"
+			user[3]=''
+
+			data_replace secret/users.dat "$1" user
+
+			session_purge "$1"
+			
+			unset hash token
+			return 0
+		fi
+	fi
+	return 1
+}
+
+# user_change_password(username, old_password, new_password)
+user_change_password() {
+	[[ ! "$1" ]] && return 1
+	[[ ! "$2" ]] && return 1
+	[[ ! "$3" ]] && return 1
+	if data_get secret/users.dat "$1" 0 user; then
+
+		_password_hash "$2" "${user[2]}"
+
+		if [[ "$hash" == "${user[1]}" ]]; then
+			_password_hash "$3" "${user[2]}"
+			[[ ! "$hash" ]] && return
+			user[1]="$hash"
+			user[3]=''
+			data_replace secret/users.dat "$1" user
+
+			session_purge "$1"
+			
+			unset hash token
+			return 0
+		fi
+	fi
+
+	unset hash
+	return 1
+}
+
+# user_gen_reset_token(username) -> $token
+user_gen_reset_token() {
+	[[ ! "$1" ]] && return 1
+	if data_get secret/users.dat "$1" 0 user; then
+		user[3]="$(dd if=/dev/urandom bs=20 count=1 status=none | xxd -p)"
+		data_replace secret/users.dat "$1" user
+		token="${user[3]}"
+	else
+		return 1
+	fi
+}
+
+# logs out ALL sessions for user
+#
+# session_purge(username)
+session_purge() {
+	data_yeet secret/sessions.dat "$1"
+}
+
 # _new_session(username) -> $session
 _new_session() {
 	[[ ! "$1" ]] && return 1
 	session=("$1" "$(date '+%s')" "$(dd if=/dev/urandom bs=24 count=1 status=none | xxd -p)")
 	data_add secret/sessions.dat session
 }
+
+_password_hash() {
+	[[ ! "$1" ]] && return 1
+	[[ ! "$2" ]] && return 1
+	
+	if [[ "${cfg[hash]}" == "argon2id" ]]; then
+		hash="$(echo -n "$1" | argon2 "$2" -id -e)"
+	else
+		hash=$(echo -n $1$2 | sha256sum | cut -c 1-64)
+	fi
+}

From 5b8d4928987033a96a0499e0918737b8927b5f41 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 4 Aug 2024 01:57:12 +0200
Subject: [PATCH 033/112] account: remember me flag

---
 src/account.sh | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/src/account.sh b/src/account.sh
index c79f4eb..a49aecc 100755
--- a/src/account.sh
+++ b/src/account.sh
@@ -1,11 +1,12 @@
 #!/usr/bin/env bash
 # account.sh - account and session mgmt
+# TODO: add stricter argument checks for all the funcs
 
 # registers a new user.
 # first two params are strings; third is a reference to an array with
 # optional extra data (email, OTP...)
 #
-# register(username, password, [extra])
+# [extra=()] register(username, password)
 function register() {
 	local username=$(url_decode "$1")
 	unset IFS
@@ -17,11 +18,10 @@ function register() {
 	fi
 
 	local salt=$(dd if=/dev/urandom bs=16 count=1 status=none | xxd -p)
-	user_gen_reset_token
 
 	_password_hash "$2" "$salt"
 
-	local out=("$username" "$hash" "$salt" "$token" "${extra[@]}")
+	local out=("$username" "$hash" "$salt" "" "${extra[@]}")
 	data_add secret/users.dat out
 
 	_new_session "$username"
@@ -32,9 +32,10 @@ function register() {
 	unset hash
 }
 
-# login(username, password) -> [res]
+# login(username, password, [forever]) -> [res]
 function login() {
 	local username=$(url_decode "$1")
+	[[ "$3" ]] && local forever=true
 	unset IFS
 
 	if ! data_get secret/users.dat "$username" 0 user; then
@@ -45,14 +46,19 @@ function login() {
 	_password_hash "$2" "${user[2]}"
 	
 	if [[ "$hash" == "${user[1]}" ]]; then
-		_new_session "$username"
-		
-		set_cookie_permanent "sh_session" "${session[2]}"
-		set_cookie_permanent "username" "$username"
+		_new_session "$username" "$forever"
+
+		if [[ "$forever" == true ]]; then
+			set_cookie_permanent "sh_session" "${session[2]}"
+			set_cookie_permanent "username" "$username"
+		else
+			set_cookie "sh_session" "${session[2]}"
+			set_cookie "username" "$username"
+		fi
 
 		declare -ga res=("${user[@]:4}")
 
-		unset hash		
+		unset hash
 		return 0
 	else
 		remove_cookie "sh_session"
@@ -199,10 +205,11 @@ session_purge() {
 	data_yeet secret/sessions.dat "$1"
 }
 
-# _new_session(username) -> $session
+# _new_session(username, forever) -> $session
 _new_session() {
 	[[ ! "$1" ]] && return 1
-	session=("$1" "$(date '+%s')" "$(dd if=/dev/urandom bs=24 count=1 status=none | xxd -p)")
+	[[ "$2" == true ]] && local forever=true || local forever=false
+	session=("$1" "$(date '+%s')" "$(dd if=/dev/urandom bs=24 count=1 status=none | xxd -p)" "$forever")
 	data_add secret/sessions.dat session
 }
 

From 332c256d6c1554ac86a0735ff592018ba6210264 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 4 Aug 2024 21:37:51 +0200
Subject: [PATCH 034/112] tests: crude testing framework

---
 tests/00-prepare.sh    |  17 +++++++
 tests/01-http-basic.sh |  66 ++++++++++++++++++++++++
 tst.sh                 | 111 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 194 insertions(+)
 create mode 100644 tests/00-prepare.sh
 create mode 100644 tests/01-http-basic.sh
 create mode 100755 tst.sh

diff --git a/tests/00-prepare.sh b/tests/00-prepare.sh
new file mode 100644
index 0000000..fcffa7b
--- /dev/null
+++ b/tests/00-prepare.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+prepare() {
+	[[ ! -d app ]] && ./http.sh init
+	./http.sh >/dev/null &
+}
+
+tst() {
+	for i in {1..10}; do
+		if [[ "$(ss -tulnap | grep LISTEN | grep 1337)" ]]; then
+			return 0
+		fi
+		sleep 0.5
+	done
+
+	return 255
+}
diff --git a/tests/01-http-basic.sh b/tests/01-http-basic.sh
new file mode 100644
index 0000000..68a73c0
--- /dev/null
+++ b/tests/01-http-basic.sh
@@ -0,0 +1,66 @@
+#!/bin/bash
+
+test_server_header() {
+	tst() {
+		curl -s -I localhost:1337
+	}
+
+	match_sub="HTTP.sh"
+}
+
+test_server_output() {
+	prepare() {
+		cat <<"EOF" > app/webroot/meow.shs
+#!/bin/bash
+echo meow
+EOF
+	}
+	
+	cleanup() {
+		rm app/webroot/meow.shs
+	}
+
+	tst() {
+		curl -s localhost:1337/meow.shs
+	}
+
+	match="meow"
+}
+
+test_server_get_param() {
+	prepare() {
+		cat <<"EOF" > app/webroot/meow.shs
+#!/bin/bash
+echo "${get_data[meow]}"
+EOF
+	}
+
+	tst() {
+		curl -s "localhost:1337/meow.shs?meow=nyaa"
+	}
+
+	match="nyaa"
+}
+
+test_server_post_param() {
+	prepare() {
+		cat <<"EOF" > app/webroot/meow.shs
+#!/bin/bash
+echo "${post_data[meow]}"
+EOF
+	}
+	
+	tst() {
+		curl -s "localhost:1337/meow.shs" -d 'meow=nyaa'
+	}
+
+	match="nyaa"
+}
+
+
+subtest_list=(
+	test_server_header
+	test_server_output
+	test_server_get_param
+	test_server_post_param
+)
diff --git a/tst.sh b/tst.sh
new file mode 100755
index 0000000..50e7267
--- /dev/null
+++ b/tst.sh
@@ -0,0 +1,111 @@
+#!/bin/bash
+
+tst() {
+	echo "dummy test!"
+}
+
+match=""
+match_begin=""
+match_end=""
+match_sub=""
+
+prepare() {
+	:
+}
+
+cleanup () {
+	:
+}
+
+on_error() {
+	on_error_default
+}
+
+on_success() {
+	on_success_default
+}
+
+on_success_default() {
+	echo "OK: $test_name"
+	(( ok_count++ ))
+	return 0 # surprisingly load-bearing
+}
+
+on_error_default() {
+	echo "FAIL: $test_name"
+	echo "(res: $res)"
+	(( fail_count++ ))
+	return 0
+}
+
+on_fatal() {
+	echo "FATAL: $test_name"
+	_final_cleanup
+	exit 1
+}
+
+if [[ ! -f "$1" ]]; then
+	echo -e "$0 - basic test framework\n\nusage: $0 <test> [test] [...]"
+	exit 1
+fi
+
+ok_count=0
+fail_count=0
+
+_a() {
+	[[ "$res_code" == 255 ]] && on_fatal
+	if [[ "$match" ]]; then
+		[[ "$res" == "$match" ]] && on_success || on_error
+	elif [[ "$match_sub" ]]; then
+		[[ "$res" == *"$match_sub"* ]] && on_success || on_error
+	elif [[ "$match_begin" ]]; then
+		[[ "$res" == "$match_begin"* ]] && on_success || on_error
+	elif [[ "$match_end" ]]; then
+		[[ "$res" == *"$match_end" ]] && on_success || on_error
+	else
+		[[ "$res_code" == 0 ]] && on_success || on_error
+	fi
+	unset match match_sub match_begin match_end
+	prepare() { :; }
+}
+
+_final_cleanup() {
+	# handle spawned processes
+	for i in $(jobs -p); do
+		pkill -P $i
+	done
+	sleep 2
+	for i in $(jobs -p); do
+		pkill -9 -P $i
+	done
+	pkill -P $$
+}
+
+for j in "$@"; do
+	source "$j"
+	if [[ "${#subtest_list[@]}" == 0 ]]; then
+		test_name="$j"
+		prepare
+		res="$(tst)"
+		res_code=$?
+		cleanup
+		_a
+	else
+		echo "--- $j ---"
+		for i in "${subtest_list[@]}"; do
+			test_name="$i"
+			"$i"
+			prepare
+			res="$(tst)"
+			res_code=$?
+			cleanup
+			_a
+		done
+	fi
+done
+
+_final_cleanup
+
+echo -e "\n\nTesting done!
+OK:   $ok_count
+FAIL: $fail_count"

From 1c48d95d414a6f85785ff396dc3553a58a0a9193 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Mon, 5 Aug 2024 18:13:03 +0200
Subject: [PATCH 035/112] docs: wrote some info about tst.sh

---
 docs/tests.md | 147 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 147 insertions(+)
 create mode 100644 docs/tests.md

diff --git a/docs/tests.md b/docs/tests.md
new file mode 100644
index 0000000..6b62aca
--- /dev/null
+++ b/docs/tests.md
@@ -0,0 +1,147 @@
+# the test framework
+
+We have a small test harness! It lives in `./tst.sh` in the root of the HTTP.sh repo. It's inspired
+by some init systems, and a bit influenced by how APKBUILD/PKGBUILDs are structured. A very basic
+test is attached below:
+
+```
+tst() {
+	return 0
+}
+```
+
+A `tst()` function is all you need in a test. Running the test can be done like so:
+
+```
+$ ./tst.sh tests/example.sh
+OK: tests/example.sh
+
+
+Testing done!
+OK:   1
+FAIL: 0
+```
+
+If running multiple tests is desired, I recommend calling `./tst.sh tests/*`, and prepending the
+filenames with numbers to make sure they run in the correct sequence.
+
+You can also contain multiple tests in a file by grouping them into a function, and then adding the
+function names to an array:
+
+```
+a() {
+	tst() {
+		return 0
+	}
+}
+b() {
+	tst() {
+		return 1
+	}
+}
+
+subtest_list=(
+	a
+	b
+)
+```
+
+This will yield the following result *(output subject to change)*:
+
+```
+--- tests/example.sh ---
+OK: a
+FAIL: b
+(res: )
+
+
+Testing done!
+OK:   1
+FAIL: 1
+```
+
+Of note: `tst.sh` is designed in a way where *most* functions will fall through; If you'd like to
+run the same test against a different set of checks (see below) then you *don't* need to redefine
+the `tst()` function, just changing the checks is enough.
+
+---
+
+## return codes
+
+The following return codes are defined:
+
+- 0 as success
+- 1 as error (test execution continues)
+- 255 as fatal error (cleans up and exits immediately)
+
+## determining success / failure 
+
+Besides very simple return-code based matching, `tst.sh` also supports stdout matching with the
+following strings:
+
+- `match` (matches the whole string)
+- `match_sub` (matches a substring)
+- `match_begin` (matches the beginning)
+- `match_end` (matches the end)
+
+If any of those is defined, all except fatal return codes are ignored. If more than one of those
+is defined, it checks the list above top-to-bottom and picks the first one that is set, ignoring
+all others. 
+
+## special functions
+
+The framework defines two special functions, plus a few callbacks that can be overriden:
+
+### prepare
+
+`prepare` runs **once** after definition, right before the test itself. As of now, it's the only
+function that gets cleaned up after each run (by design); With this, one can ensure a consistent
+state for a group of tests.
+
+By default (undefined state), `prepare` does nothing.
+
+```
+prepare() {
+	echo 'echo meow' > app/webroot/test.shs
+}
+
+tst() {
+	curl localhost:1337/test.shs
+}
+
+match="meow"
+```
+
+*(note: this test requires tst.sh to be used with http.sh, and for http.sh to be running)*
+
+### cleanup
+
+`cleanup` runs after every test. The name should be self-explanatory. Define as `cleanup() { :; }`
+to disable behavior from previous tests.
+
+By default (undefined state), `cleanup` does nothing.
+
+```
+prepare() {
+	echo 'echo meow' > app/webroot/test.shs
+}
+
+tst() {
+	curl localhost:1337/test.shs
+}
+
+cleanup() {
+	rm app/webroot/test.shs
+}
+
+match="meow"
+```
+
+*(note: same thing as above)*
+
+### on_success, on_error, on_fatal
+
+Called on every success, failure and fatal error. First two call `on_{success,error}_default`,
+which increments the counter and outputs the OK/FAIL message. The third one just logs the FATAL,
+cleans up and exits. Overloading `on_fatal` is not recommended; While overloading the other two,
+make sure to add a call to the `_default` function, or handle the numbers gracefully by yourself.

From 46530b9f1730468b3b919d4953f33fd03bbf34a6 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Mon, 5 Aug 2024 19:17:45 +0200
Subject: [PATCH 036/112] docs: quick start

---
 docs/directory-structure.md |  49 +++++++++++++++++
 docs/quick-start.md         | 101 ++++++++++++++++++++++++++++++++++++
 2 files changed, 150 insertions(+)
 create mode 100644 docs/directory-structure.md
 create mode 100644 docs/quick-start.md

diff --git a/docs/directory-structure.md b/docs/directory-structure.md
new file mode 100644
index 0000000..ba108f0
--- /dev/null
+++ b/docs/directory-structure.md
@@ -0,0 +1,49 @@
+# File / Directory structure
+
+(alphabetical order; state for 2024-08-05)
+
+- `config` contains per-vhost configuration settings. `config/master.sh` gets loaded by default,
+  `config/<hostname>[:port]` gets loaded based on the `Host` header.
+- `docs` is what you're reading now. Hi!!
+- `secret` is where user data gets stored. think: user accounts and sessions.
+- `src` contains the majority of HTTP.sh's code.
+	- `response/*` are files executed based on computed return code. `response/200.sh` is a bit
+	  special, because it handles the general "success" path. Refactor pending.
+	- `account.sh` is the middleware for user account management
+	- `dependencies.*` store the list of required and optional deps, newline delimetered
+	- `mail.sh` has some crude SMTP code, for sending out mails
+	- `mime.sh` contains a glue function for handling special cases where `file` command doesn't
+	  return the proper mimetype
+	- `misc.sh` consists of functions that didn't really fit anywhere else. Of note, `html_encode`,
+	  `url_encode`, `url_decode`, `header` and various cookie functions all live there for now.
+	- `notORM.sh` is, as I said, not an [ORM](https://en.wikipedia.org/wiki/Object%E2%80%93relational_mapping)
+	- `route.sh` defines a small function for handling adding the routes
+	- `server.sh` is where most of the demons live
+	- `template.sh` is where the rest of the demons live
+	- `worker.sh` is the literal embodiment of "we have cron at home"; workers are just background
+	  jobs that run every n minutes; you can also start and stop them on will! *fancy*
+	- `ws.sh` is an incomplete WebSocket implementation
+- `storage` is like `secret`, but you can generally use it for whatever
+- `templates` will be moved/removed soon (`head.sh` has *nothing* to do with the current templating
+  system; it has some handlers for remaking things you put into `meta[]` array into HTML `<head>`
+  fields. Should not be used, at least not in its current form.)
+- `tests` is where all the tests live!
+
+The actually important files are:
+- `http.sh` - run this and see what happens
+- `tst.sh` - [the test suite](tests.md) 
+
+## suggested skeleton structure in `app/`
+
+FYI: this is merely a suggestion. `./http.sh init` will create some of those directories for you,
+but it's fine to move things around. A lot of it can be changed within `config/master.sh`, even the
+directory name itself!
+
+- `src` for various backend code
+- `templates` for HTML in our special templating language
+- `views` for individual pages / endpoints
+- `webroot` for static files, or .shs scripts that don't use the router
+- `config.sh` has some general, always-included stuff
+- `routes.sh` configures the router; entries should point into `views/`
+- `localcfg.sh` may be sourced from `config.sh` and contain only local config (useful for developing
+  stuff with others through git, for instance; `localcfg.sh` should then be added to `.gitignore`)
diff --git a/docs/quick-start.md b/docs/quick-start.md
new file mode 100644
index 0000000..ad91d2d
--- /dev/null
+++ b/docs/quick-start.md
@@ -0,0 +1,101 @@
+# HTTP.sh: quick start
+
+Welcome to the exciting world of Bash witchery! I'll be your guide on this webdev adventure today.
+
+## about HTTP.sh
+
+HTTP.sh is a very extensive web framework. I use it for quick and dirty hacks, and I "designed" it
+in a way where you don't need to write a lot of code to do some basic stuff. I'm also gradually
+adding middleware that helps you do more advanced stuff. With some regards, there are already
+multiple ways one could implement a web app in HTTP.sh; Thus, I feel like I need this to be heard:
+
+**There are no bad ways to write code here.** You can still write *bad code*, but this is a safe
+space where nobody shall tell you "Y is garbage, you should use X instead!";
+
+This strongly applies to specific features of the framework: You can use the templating engine, or
+you can just `echo` a bunch of stuff directly from your script. You can use the URL router, or you
+could just name your scripts under the webroot in a fancy way. **As long as it works, it's good :3**
+
+## Getting started
+
+First, clone the repository. I'm sure you know how to do that; Afterwards, try running:
+
+```
+./http.sh init
+./http.sh
+```
+
+`init` will lay out some directories, and running it w/o any params will just start the server.
+If you're missing any dependencies, you should now see a list of them.
+
+By default, http.sh starts on port 1337; Try going to http://localhost:1337/ - if you see a welcome
+page, it's working!!
+
+We have a "debug mode" under `./http.sh debug`. Check [running.md](running.md) for more options.
+
+## Basic scripting
+
+By default, your application lives in `app/`. See [directory-structure.md](directory-structure.md)
+for more info on what goes where. For now, go into `app/webroot/` and remove `index.shs`. That
+should bring you to an empty directory listing; Static files can be put as-is into `app/webroot/`
+and they'll be visible within the directory!
+
+To create a script, make a new file with `.shs` extension, and start writing a script like normal.
+All of your `stdout` (aka: everything you `echo`) goes directly to the output. Everything sent to
+`stderr` will be shown in the `./http.sh debug` output. 
+
+## Parameters
+
+There are a few ways of receiving input; The most basic ones are `get_data` and `post_data`, which
+are associative arrays that handle GET params and POST (body) params, respectively. Consider the
+following example:
+
+```
+#!/bin/bash
+echo '<html><head><meta charset="utf-8"></head><body>'
+
+if [[ ! "${get_data[example]}" ]]; then
+	echo '<form>
+			<input type="text" name="example">
+			<input type="submit">
+		</form>'
+else
+	echo "<p>you sent: $(html_encode "${get_data[example]}")</p>"
+fi
+
+echo '</body></html>'
+```
+
+When opened in a browser, this example looks like so:
+
+![screenshot of a simple web page. there's a text box, and a button saying Submit Query](https://f.sakamoto.pl/IwIalnWw.png)
+
+... and after submitting data, it looks like that:
+
+![screenshot of another page. it says "you sent: meow!"](https://f.sakamoto.pl/IwIy0thg.png)
+
+## Security
+
+Remember to use sufficient quotes in your scripts, and escape untrusted data (read: ALL data you
+didn't write/create yourself. This is especially important when parameter splitting may occur;
+For instance, consider:
+
+```
+rm storage/${get_data[file]}
+```
+
+vs
+
+```
+rm -- "storage/$(basename "${get_data[file]}")"
+```
+
+The first one can fail due to:
+- spaces (if `?file=a+b+c+d`, then it will remove `storage/a`, `b`, `c` and `d`). Hence, you get
+  arbitrary file deletion.
+- unescaped filename (param containing `../` leads to path traversal)
+- unterminated parameter expansion (`--` in `rm --` terminates switches; after this point, only
+  file names can occur)
+
+Furthermore, if you're displaying user-controlled data in your app, remember to use `html_encode`
+to prevent cross-site scripting attacks.

From 358a8737ab69a326c8c90f22d74061221ba4d3be Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Tue, 6 Aug 2024 22:50:57 +0200
Subject: [PATCH 037/112] tests: basic template tests

---
 tests/02-template.sh | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 tests/02-template.sh

diff --git a/tests/02-template.sh b/tests/02-template.sh
new file mode 100644
index 0000000..55be91f
--- /dev/null
+++ b/tests/02-template.sh
@@ -0,0 +1,33 @@
+#!/bin/bash
+
+tpl_basic() {
+	prepare() {
+		source src/misc.sh
+		source src/template.sh
+	}
+	tst() {
+		declare -A meow
+		meow[asdf]="$value"
+		
+		render meow <(echo "value: {{.asdf}}")
+	}
+
+	value="A quick brown fox jumped over the lazy dog"
+	match="value: $value"
+}
+
+tpl_basic_specialchars() {
+	value="&#$%^&*() <-- look at me go"
+	match="value: $(html_encode "$value")"
+}
+
+tpl_basic_newline() {
+	value=$'\n'a$'\n'
+	match="value: $(html_encode "$value")"
+}
+
+subtest_list=(
+	tpl_basic
+	tpl_basic_specialchars
+	tpl_basic_newline
+)

From d6f46b949de796fb6af35fcc386834299903a1a0 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Tue, 6 Aug 2024 23:42:44 +0200
Subject: [PATCH 038/112] tests: add match_not; add html/url encode tests

---
 docs/tests.md    |  30 ++++++++++++--
 tests/03-misc.sh | 100 +++++++++++++++++++++++++++++++++++++++++++++++
 tst.sh           |  59 ++++++++++++++++++++++------
 3 files changed, 174 insertions(+), 15 deletions(-)
 create mode 100644 tests/03-misc.sh

diff --git a/docs/tests.md b/docs/tests.md
index 6b62aca..60ec958 100644
--- a/docs/tests.md
+++ b/docs/tests.md
@@ -77,14 +77,15 @@ The following return codes are defined:
 ## determining success / failure 
 
 Besides very simple return-code based matching, `tst.sh` also supports stdout matching with the
-following strings:
+following variables:
 
 - `match` (matches the whole string)
 - `match_sub` (matches a substring)
 - `match_begin` (matches the beginning)
 - `match_end` (matches the end)
+- `match_not` (inverse substring match)
 
-If any of those is defined, all except fatal return codes are ignored. If more than one of those
+If any of those are defined, all except fatal return codes are ignored. If more than one of those
 is defined, it checks the list above top-to-bottom and picks the first one that is set, ignoring
 all others. 
 
@@ -95,8 +96,7 @@ The framework defines two special functions, plus a few callbacks that can be ov
 ### prepare
 
 `prepare` runs **once** after definition, right before the test itself. As of now, it's the only
-function that gets cleaned up after each run (by design); With this, one can ensure a consistent
-state for a group of tests.
+function that gets cleaned up after each run (by design; see section `statefullness` below)
 
 By default (undefined state), `prepare` does nothing.
 
@@ -145,3 +145,25 @@ Called on every success, failure and fatal error. First two call `on_{success,er
 which increments the counter and outputs the OK/FAIL message. The third one just logs the FATAL,
 cleans up and exits. Overloading `on_fatal` is not recommended; While overloading the other two,
 make sure to add a call to the `_default` function, or handle the numbers gracefully by yourself.
+
+## statefullness
+
+This framework is designed in a way where a lot of the state is inherited from previous tests. This
+is by-design, to make sure that there's less repetition in the tests themselves. It is up to the
+author of the tests to remember about cleaning up variables and other state that could affect any
+further tests in the chain.
+
+Currently, state is cleaned up under the following circumstances:
+- all `match` variables get cleaned up after every test
+- `prepare()` function is reset after every test (so, each definition of `prepare` will run
+  exactly *once*)
+- upon switching files, `tst()` and `cleanup()` get reset to initial values. Of note, those two
+  **do** get inherited between subtests in a single file!
+- upon termination of the test harness, it tries to kill all child processes
+
+The following state **is not** cleaned up:
+- `tst()` and `cleanup()` between subtests in a single file
+- `on_error()`, `on_success()` functions
+- any global user-defined variables, also between files
+- any started processes
+- any modified files (we don't have a way to track those atm, although I may look into this)
diff --git a/tests/03-misc.sh b/tests/03-misc.sh
new file mode 100644
index 0000000..4aaaa99
--- /dev/null
+++ b/tests/03-misc.sh
@@ -0,0 +1,100 @@
+#!/bin/bash
+
+misc_html_escape_basic() {
+	prepare() {
+		source src/misc.sh
+	}
+	tst() {
+		html_encode "$value"
+	}
+	value="meow"
+	match="meow"
+}
+
+misc_html_escape_special() {
+	value="<script>"
+	match_not="<"
+}
+
+misc_html_escape_apos() {
+	value="<img src='asdf'>"
+	match_not="'"
+}
+
+misc_html_escape_quot() {
+	value='<img src="meow">'
+	match_not='"'
+}
+
+# ---
+
+misc_url_encode() {
+	tst() {
+		url_encode "$value"
+	}
+	value="nyaa"
+	match="$value"
+}
+
+misc_url_encode_special01() {
+	value="%%"
+	match="%25%25"
+}
+
+misc_url_encode_special02() {
+	value="&"
+	match_not="&"
+}
+
+misc_url_encode_special03() {
+	value="?asdf=meow&nyaa="
+	match_not="?"
+}
+
+misc_url_encode_url() {
+	value="https://example.org/?nyaa=meow"
+	match="https%3A%2F%2Fexample.org%2F%3Fnyaa%3Dmeow" 
+}
+
+# ---
+
+misc_url_decode_encode() {
+	tst() {
+		url_decode "$(url_encode "$value")"
+	}
+	value="https://example.org/?nyaa=meow&as=df"
+	match="$value"
+}
+
+# ---
+
+misc_url_decode01() {
+	tst() {
+		url_decode "$value"
+	}
+	value='%25'
+	match='%'
+}
+
+misc_url_decode02() {
+	value='%2525'
+	match='%25'
+}
+
+subtest_list=(
+	misc_html_escape_basic
+	misc_html_escape_special
+	misc_html_escape_apos
+	misc_html_escape_quot
+
+	misc_url_encode
+	misc_url_encode_special01
+	misc_url_encode_special02
+	misc_url_encode_special03
+	misc_url_encode_url
+
+	misc_url_decode_encode
+
+	misc_url_decode01
+	misc_url_decode02
+)
diff --git a/tst.sh b/tst.sh
index 50e7267..60a84eb 100755
--- a/tst.sh
+++ b/tst.sh
@@ -28,7 +28,7 @@ on_success() {
 on_success_default() {
 	echo "OK: $test_name"
 	(( ok_count++ ))
-	return 0 # surprisingly load-bearing
+	return 0
 }
 
 on_error_default() {
@@ -44,28 +44,65 @@ on_fatal() {
 	exit 1
 }
 
-if [[ ! -f "$1" ]]; then
-	echo -e "$0 - basic test framework\n\nusage: $0 <test> [test] [...]"
-	exit 1
-fi
+IFS=$'\n'
+for i in "$@"; do
+	if [[ ! -f "$i" ]]; then
+		echo -e "$0 - basic test framework\n\nusage: $0 <test> [test] [...]"
+		exit 1
+	fi
+done
+unset IFS
 
 ok_count=0
 fail_count=0
 
 _a() {
 	[[ "$res_code" == 255 ]] && on_fatal
+
+	# Q: why not `[[ ... ]] && a || b`?
+	# A: simple; if `a` returns 1, `b` will get called erroneously.
+	#	 normally one wouldn't care, but those functions are meant to
+	#    be overriden. I don't want to fund anyone a lot of frustration,
+	#	 so splitting the ifs is a saner option here :)
+	
 	if [[ "$match" ]]; then
-		[[ "$res" == "$match" ]] && on_success || on_error
+		if [[ "$res" == "$match" ]]; then
+			on_success
+		else
+			on_error
+		fi
 	elif [[ "$match_sub" ]]; then
-		[[ "$res" == *"$match_sub"* ]] && on_success || on_error
+		if [[ "$res" == *"$match_sub"* ]]; then
+			on_success
+		else
+			on_error
+		fi
 	elif [[ "$match_begin" ]]; then
-		[[ "$res" == "$match_begin"* ]] && on_success || on_error
+		if [[ "$res" == "$match_begin"* ]]; then
+			on_success
+		else
+			on_error
+		fi
 	elif [[ "$match_end" ]]; then
-		[[ "$res" == *"$match_end" ]] && on_success || on_error
+		if [[ "$res" == *"$match_end" ]]; then
+			on_success
+		else
+			on_error
+		fi
+	elif [[ "$match_not" ]]; then
+		if [[ "$res" == *"$match_not"* ]]; then
+			on_error
+		else
+			on_success
+		fi
 	else
-		[[ "$res_code" == 0 ]] && on_success || on_error
+		if [[ "$res_code" == 0 ]]; then
+			on_success
+		else
+			on_error
+		fi
 	fi
-	unset match match_sub match_begin match_end
+	unset match match_sub match_begin match_end match_not
 	prepare() { :; }
 }
 

From 5425a8ff1414266e0255310471f13c9261e7a401 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Wed, 7 Aug 2024 00:02:03 +0200
Subject: [PATCH 039/112] misc: fix url_encode inconsistencies

---
 src/misc.sh      | 2 +-
 tests/03-misc.sh | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/misc.sh b/src/misc.sh
index 7f7b1e0..e5617a7 100755
--- a/src/misc.sh
+++ b/src/misc.sh
@@ -48,7 +48,7 @@ function html_encode() {
 
 # url_encode(string)
 function url_encode() {
-	xxd -ps -u <<< "$1" | tr -d '\n' | sed -E 's/.{2}/%&/g'
+	echo -n "$1" | xxd -p | tr -d '\n' | sed -E 's/.{2}/%&/g'
 }
 
 # url_decode(string)
diff --git a/tests/03-misc.sh b/tests/03-misc.sh
index 4aaaa99..9328307 100644
--- a/tests/03-misc.sh
+++ b/tests/03-misc.sh
@@ -33,7 +33,7 @@ misc_url_encode() {
 		url_encode "$value"
 	}
 	value="nyaa"
-	match="$value"
+	match=""
 }
 
 misc_url_encode_special01() {
@@ -53,7 +53,8 @@ misc_url_encode_special03() {
 
 misc_url_encode_url() {
 	value="https://example.org/?nyaa=meow"
-	match="https%3A%2F%2Fexample.org%2F%3Fnyaa%3Dmeow" 
+	# i promise we'll get a better impl of this at some point xD
+	match="%68%74%74%70%73%3a%2f%2f%65%78%61%6d%70%6c%65%2e%6f%72%67%2f%3f%6e%79%61%61%3d%6d%65%6f%77" 
 }
 
 # ---

From b38860ec9c3d2049713dd3a86bf9a34fc4aaa653 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Wed, 7 Aug 2024 00:02:31 +0200
Subject: [PATCH 040/112] tests: alignn tst.sh with the docs

---
 tst.sh | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/tst.sh b/tst.sh
index 60a84eb..ad08631 100755
--- a/tst.sh
+++ b/tst.sh
@@ -1,21 +1,26 @@
 #!/bin/bash
 
-tst() {
-	echo "dummy test!"
+_defaults() {
+	match=""
+	match_begin=""
+	match_end=""
+	match_sub=""
+
+	tst() {
+		echo "dummy test! please set me up properly" > /dev/stderr
+		exit 1
+	}
+
+	prepare() {
+		:
+	}
+
+	cleanup () {
+		:
+	}
 }
 
-match=""
-match_begin=""
-match_end=""
-match_sub=""
-
-prepare() {
-	:
-}
-
-cleanup () {
-	:
-}
+_defaults
 
 on_error() {
 	on_error_default
@@ -139,6 +144,7 @@ for j in "$@"; do
 			_a
 		done
 	fi
+	_defaults
 done
 
 _final_cleanup

From 30c494c8e912b5e8fdf4ed06ccbd5a549e387e0f Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 10 Aug 2024 23:23:45 +0200
Subject: [PATCH 041/112] notORM: break out of data_iter after first failure

---
 src/notORM.sh | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/notORM.sh b/src/notORM.sh
index 7cf7b8b..ee4b6f6 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -75,17 +75,27 @@ data_get() {
 # run `callback` on all entries from `store` that match `search`.
 # by default uses the 0th column. override with optional `column`
 #
+# immediately exits with 1 if the callback function returned 1
+# if there were no matches, returns 2
+# if the store wasn't found, returns 4
+#
 # data_iter(store, search, callback, [column]) -> $data
 data_iter() {
 	[[ ! "$3" ]] && return 1
+	[[ ! -f "$1" ]] && return 4
 	local column=${4:-0}
 	local IFS=$'\n'
+	local r=1
 
 	while read line; do
 		local IFS=$delim
 		data=($(tr '\02' '\n' <<< "$line"))
 		[[ "${data[$column]}" == "$2" || ! "$2" ]] && "$3"
+		[[ $? == 1 ]] && return 1
+		r=0
 	done < "$1"
+
+	return $r
 }
 
 # replace a value in `store` with `array`, filtering by `search`.

From 0f6233bbd3abe26b5d3d8f24f26f420bcc4a79dc Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 11 Aug 2024 00:39:17 +0200
Subject: [PATCH 042/112] core: better debuggier output, somewhat

---
 http.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/http.sh b/http.sh
index 96d8817..11c2bd1 100755
--- a/http.sh
+++ b/http.sh
@@ -164,6 +164,7 @@ if [[ "$1" == "debug" ]]; then
 elif [[ "$1" == "debuggier" ]]; then
     cfg[dbg]=true
     cfg[debuggier]=true
+    export PS4=' ${BASH_SOURCE}:${LINENO}: ${FUNCNAME[0]:+${FUNCNAME[0]}(): }'
     echo "[DEBUG] Activated debuggier mode - stderr and call trace will be shown"
     set -x
 fi

From 9a8f1dc2e465d9534d31b56898a5dec8625cf619 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 11 Aug 2024 01:03:27 +0200
Subject: [PATCH 043/112] response: migrate from printf to 'echo' and 'echo -e'
 (to prevent % injections)

---
 src/response/101.sh     |  4 ++--
 src/response/200.sh     | 18 +++++++++---------
 src/response/401.sh     |  2 +-
 src/response/403.sh     |  2 +-
 src/response/404.sh     |  2 +-
 src/response/listing.sh | 12 ++++++------
 6 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/src/response/101.sh b/src/response/101.sh
index c3721c8..72cf7e1 100755
--- a/src/response/101.sh
+++ b/src/response/101.sh
@@ -3,10 +3,10 @@ Connection: Upgrade
 Upgrade: WebSocket
 ${cfg[extra_headers]}"
 if [[ ${r[websocket_key]} != '' ]]; then
-	accept=$(echo -ne $(printf "${r[websocket_key]}""258EAFA5-E914-47DA-95CA-C5AB0DC85B11" | sha1sum | sed 's/ //g;s/-//g;s/.\{2\}/\\x&/g') | base64)
+	accept=$(echo -ne $(echo "${r[websocket_key]}""258EAFA5-E914-47DA-95CA-C5AB0DC85B11" | sha1sum | sed 's/ //g;s/-//g;s/.\{2\}/\\x&/g') | base64)
 	echo "Sec-WebSocket-Accept: "$accept
 fi
-printf "\r\n\r\n"
+echo -e "\r\n\r\n"
 
 #echo "Laura is cute <3"
 #WebSocket-Location: ws://localhost:1337/
diff --git a/src/response/200.sh b/src/response/200.sh
index b6ecd99..0ce08fd 100755
--- a/src/response/200.sh
+++ b/src/response/200.sh
@@ -5,24 +5,24 @@
 function __headers() {
 	if [[ "${cfg[unbuffered]}" != true ]]; then
 		if [[ "${r[headers]}" == *'Location'* ]]; then # override for redirects
-			printf "HTTP/1.0 302 aaaaa\r\n"	
+			echo -ne "HTTP/1.0 302 aaaaa\r\n"	
 		elif [[ "${r[status]}" == '200' || "${r[status]}" == '212' ]]; then # normal or router, should just return 200
-			printf "HTTP/1.0 200 OK\r\n"
+			echo -ne "HTTP/1.0 200 OK\r\n"
 		else # changed by the user in the meantime :)
-			printf "HTTP/1.0 ${r[status]} meow\r\n"
+			echo -ne "HTTP/1.0 ${r[status]} meow\r\n"
 		fi
-		[[ "${r[headers]}" != '' ]] && printf "${r[headers]}"
-		printf "${cfg[extra_headers]}\r\n"
+		[[ "${r[headers]}" != '' ]] && echo -ne "${r[headers]}"
+		echo -ne "${cfg[extra_headers]}\r\n"
 	else
 		echo "uh oh - we're running unbuffered" > /dev/stderr
 	fi
 	
 	if [[ ${r[status]} == 200 ]]; then
 		get_mime "${r[uri]}"
-		[[ "$mimetype" != '' ]] && printf "content-type: $mimetype\r\n"
+		[[ "$mimetype" != '' ]] && echo -ne "content-type: $mimetype\r\n"
 	fi
 
-    [[ "$1" != false ]] && printf "\r\n"
+    [[ "$1" != false ]] && echo -ne "\r\n"
 }
 
 if [[ ${r[status]} == 212 ]]; then
@@ -34,8 +34,8 @@ if [[ ${r[status]} == 212 ]]; then
 		__headers false
         get_mime "$temp"
         # Defaults to text/plain for things it doesn't know, eg. CSS
-        [[ "$mimetype" != 'text/plain' ]] && printf "content-type: $mimetype\r\n"
-        printf "\r\n"
+        [[ "$mimetype" != 'text/plain' ]] && echo -ne "content-type: $mimetype\r\n"
+        echo -ne "\r\n"
 		cat $temp
 		rm $temp
 	fi
diff --git a/src/response/401.sh b/src/response/401.sh
index e3bb213..1d32dc7 100755
--- a/src/response/401.sh
+++ b/src/response/401.sh
@@ -1,3 +1,3 @@
-printf "HTTP/1.0 401 Unauthorized
+echo -ne "HTTP/1.0 401 Unauthorized
 WWW-Authenticate: Basic realm=\"${cfg[auth_realm]}\"
 ${cfg[extra_headers]}\r\n"
diff --git a/src/response/403.sh b/src/response/403.sh
index 3b12227..d9ae125 100755
--- a/src/response/403.sh
+++ b/src/response/403.sh
@@ -1,4 +1,4 @@
-printf "HTTP/1.0 403 Forbidden
+echo -ne "HTTP/1.0 403 Forbidden
 content-type: text/html
 ${cfg[extra_headers]}\r\n\r\n"
 source templates/head.sh
diff --git a/src/response/404.sh b/src/response/404.sh
index 2dedb34..028f6ee 100755
--- a/src/response/404.sh
+++ b/src/response/404.sh
@@ -1,4 +1,4 @@
-printf "HTTP/1.0 404 Not Found
+echo -ne "HTTP/1.0 404 Not Found
 content-type: text/html
 ${cfg[extra_headers]}\r\n\r\n"
 source templates/head.sh
diff --git a/src/response/listing.sh b/src/response/listing.sh
index b94ff02..e23352a 100755
--- a/src/response/listing.sh
+++ b/src/response/listing.sh
@@ -1,16 +1,16 @@
-printf "HTTP/1.0 200 OK
+echo -ne "HTTP/1.0 200 OK
 content-type: text/html
 ${cfg[extra_headers]}\r\n\r\n"
 
 source templates/head.sh
 
-printf "<h1>Index of $([[ ${r[url]} == '' ]] && echo '/' || echo $(html_encode ${r[url]}))</h1>"
+echo "<h1>Index of $([[ ${r[url]} == '' ]] && echo '/' || echo $(html_encode ${r[url]}))</h1>"
 
 if [[ ${cookies[username]} != '' ]]; then
 	echo "Logged in as $(html_encode ${cookies[username]})"
 fi
 
-printf "<table>
+echo "<table>
 <tr>
 	<th>File</th>
 	<th>Size</th>
@@ -25,10 +25,10 @@ for i in $(ls ${r[uri]}); do
 	unset IFS
 	stats=($(ls -hld "${r[uri]}/$i")) # -hld stands for Half-Life Dedicated
 	if [[ -d "${r[uri]}"'/'"$i" ]]; then
-		printf "<tr><td><a href='$(html_encode "${r[url]}/$i/")'>$(html_encode "$i")</a></td><td>&lt;DIR&gt;</td><td>${stats[5]} ${stats[6]} ${stats[7]}</td></tr>"
+		echo "<tr><td><a href='$(html_encode "${r[url]}/$i/")'>$(html_encode "$i")</a></td><td>&lt;DIR&gt;</td><td>${stats[5]} ${stats[6]} ${stats[7]}</td></tr>"
 	else
-		printf "<tr><td><a href='$(html_encode "${r[url]}/$i")'>$(html_encode "$i")</a></td><td>${stats[4]}B</td><td>${stats[5]} ${stats[6]} ${stats[7]}</td></tr>"
+		echo "<tr><td><a href='$(html_encode "${r[url]}/$i")'>$(html_encode "$i")</a></td><td>${stats[4]}B</td><td>${stats[5]} ${stats[6]} ${stats[7]}</td></tr>"
 	fi
 done
 			
-printf "</table><p><i>HTTP.sh server on $(html_encode ${r[host]})</i></p><p>laura is cute</p>"
+echo "</table><p><i>HTTP.sh server on $(html_encode ${r[host]})</i></p><p>meow!</p>"

From 8c29f4ad4e7c69fd1f4c1aa49c07c6f6332debea Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 11 Aug 2024 02:17:11 +0200
Subject: [PATCH 044/112] notORM: change iter failure state from 1 to 255 to
 prevent spontaneous fatals

---
 src/notORM.sh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index ee4b6f6..67be30c 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -24,6 +24,9 @@ delim=$'\01'
 newline=$'\02'
 ctrl=$'\03'
 
+# TODO: proper locking
+# TODO: matching more than one column 
+
 repeat() {
 	local IFS=$'\n'
 	[[ "$1" -gt 0 ]] && printf -- "$2%.0s" $(seq 1 $1)
@@ -75,7 +78,7 @@ data_get() {
 # run `callback` on all entries from `store` that match `search`.
 # by default uses the 0th column. override with optional `column`
 #
-# immediately exits with 1 if the callback function returned 1
+# immediately exits with 1 if the callback function returned 255
 # if there were no matches, returns 2
 # if the store wasn't found, returns 4
 #
@@ -91,7 +94,7 @@ data_iter() {
 		local IFS=$delim
 		data=($(tr '\02' '\n' <<< "$line"))
 		[[ "${data[$column]}" == "$2" || ! "$2" ]] && "$3"
-		[[ $? == 1 ]] && return 1
+		[[ $? == 255 ]] && return 1
 		r=0
 	done < "$1"
 
@@ -134,7 +137,7 @@ data_replace() {
 	local IFS=' '
 	
 	for i in "${ref[@]}"; do
-		output+="$(echo -n "$i" | tr -d '\01\02\03' | tr '\n' '\02')$delim"
+		output+="$(echo -n "$i" | tr -d '\01\02\03' | tr '\n' '\02')$delim" # TODO: check if this is arbitrary safe
 	done
 	
 	if [[ $column == 0 ]]; then

From c595acf6b99bb99ddf25d92bdc849ab5f01482b6 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 11 Aug 2024 03:02:14 +0200
Subject: [PATCH 045/112] router: more bashisms, less subshells

---
 src/server.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/server.sh b/src/server.sh
index c237dbf..b3f7e2d 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -119,18 +119,19 @@ echo "$(date) - IP: ${r[ip]}, PROTO: ${r[proto]}, URL: ${r[url]}, GET_data: ${ge
 [[ -f "${cfg[namespace]}/routes.sh" ]] && source "${cfg[namespace]}/routes.sh"
 
 if [[ ${r[status]} != 101 ]]; then
-	clean_url="$(sed -E 's/\?.*//' <<< "${r[url]}")"
+	clean_url="${r[url]%\?*}"
 	for (( i=0; i<${#route[@]}; i=i+3 )); do
 		if [[ "$(grep -Poh "^${route[$((i+1))]}$" <<< "$clean_url")" != "" ]] || [[ "$(grep -Poh "^${route[$((i+1))]}$" <<< "$clean_url/")" != "" ]]; then
 			r[status]=212
 			r[view]="${route[$((i+2))]}"
 			IFS='/'
 			url=(${route[$i]})
-			url_=($(cut -d '?' -f 1 <<< "${r[url]}"))
+			url_=($clean_url)
 			unset IFS
 			for (( j=0; j<${#url[@]}; j++ )); do
+				# TODO: think about the significance of this if really hard when i'm less tired
 				if [[ ${url_[$j]} != '' && ${url[$j]} == ":"* ]]; then
-					params[$(sed 's/://' <<< "${url[$j]}")]="${url_[$j]}"
+					params[${url[$j]/:/}]="${url_[$j]}"
 				fi
 			done
 			break

From ef933dd6030cf4a409fd21a57a587a6c8569bcc6 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 11 Aug 2024 18:39:54 +0200
Subject: [PATCH 046/112] account: more checks

---
 src/account.sh | 35 ++++++++++++++++++++++++-----------
 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/src/account.sh b/src/account.sh
index a49aecc..e511630 100755
--- a/src/account.sh
+++ b/src/account.sh
@@ -8,13 +8,17 @@
 #
 # [extra=()] register(username, password)
 function register() {
+	if [[ ! "$1" || ! "$2" ]]; then
+		reason="User/password empty!"
+		return 1
+	fi
 	local username=$(url_decode "$1")
 	unset IFS
 
 	data_get secret/users.dat "$username"
 	if [[ $? != 2 && $? != 4 ]]; then # entry not found / file not found
 		reason="This user already exists!"
-		return 1		
+		return 1
 	fi
 
 	local salt=$(dd if=/dev/urandom bs=16 count=1 status=none | xxd -p)
@@ -34,6 +38,11 @@ function register() {
 
 # login(username, password, [forever]) -> [res]
 function login() {
+	if [[ ! "$1" || ! "$2" ]]; then
+		reason="User/password empty!"
+		return 1
+	fi
+
 	local username=$(url_decode "$1")
 	[[ "$3" ]] && local forever=true
 	unset IFS
@@ -44,7 +53,7 @@ function login() {
 	fi
 
 	_password_hash "$2" "${user[2]}"
-	
+
 	if [[ "$hash" == "${user[1]}" ]]; then
 		_new_session "$username" "$forever"
 
@@ -64,7 +73,7 @@ function login() {
 		remove_cookie "sh_session"
 		remove_cookie "username"
 		reason="Bad credentials"
-		
+
 		unset hash
 		return 1
 	fi
@@ -72,14 +81,19 @@ function login() {
 
 # login_simple(base64)
 function login_simple() {
+
 	local data=$(base64 -d <<< "$3")
 	local password=$(sed -E 's/^(.*)\://' <<< "$data")
 	local login=$(sed -E 's/\:(.*)$//' <<< "$data")
 
+	if [[ ! "$password" || ! "$login" ]]; then
+		return 1
+	fi
+
 	data_get secret/users.dat "$login" 0 user
 
 	_password_hash "$password" "${user[2]}"
-	
+
 	if [[ "$hash" == "${user[1]}" ]]; then
 		r[authorized]=true
 	else 
@@ -91,7 +105,6 @@ function login_simple() {
 
 # logout()
 function logout() {
-	log "${cookies[sh_session]}"
 	if [[ "${cookies[sh_session]}" ]]; then
 		data_yeet secret/sessions.dat "${cookies[sh_session]}" 2
 	fi
@@ -101,7 +114,7 @@ function logout() {
 
 # session_verify(session) -> [res]
 function session_verify() {
-	[[ "$1" == '' ]] && return 1
+	[[ ! "$1" ]] && return 1
 	unset IFS
 	local user
 
@@ -116,7 +129,7 @@ function session_verify() {
 
 # session_get_username(session)
 function session_get_username() {
-	[[ "$1" == "" ]] && return 1
+	[[ ! "$1" ]] && return 1
 	unset IFS
 	local session
 
@@ -132,7 +145,7 @@ function session_get_username() {
 # THIS FUNCTION IS DANGEROUS
 # delete_account(username)
 function delete_account() {
-  [[ "$1" == "" ]] && return 1
+  [[ ! "$1" ]] && return 1
   data_yeet secret/users.dat "$1"
 }
 
@@ -151,7 +164,7 @@ user_reset_password() {
 			data_replace secret/users.dat "$1" user
 
 			session_purge "$1"
-			
+
 			unset hash token
 			return 0
 		fi
@@ -176,7 +189,7 @@ user_change_password() {
 			data_replace secret/users.dat "$1" user
 
 			session_purge "$1"
-			
+
 			unset hash token
 			return 0
 		fi
@@ -216,7 +229,7 @@ _new_session() {
 _password_hash() {
 	[[ ! "$1" ]] && return 1
 	[[ ! "$2" ]] && return 1
-	
+
 	if [[ "${cfg[hash]}" == "argon2id" ]]; then
 		hash="$(echo -n "$1" | argon2 "$2" -id -e)"
 	else

From 62fb5556f488dbce86cc7545a38c1349e7775d83 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 11 Aug 2024 21:58:34 +0200
Subject: [PATCH 047/112] notORM: iter now returns 255 on loop break

---
 src/notORM.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index 67be30c..6631f9e 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -94,7 +94,7 @@ data_iter() {
 		local IFS=$delim
 		data=($(tr '\02' '\n' <<< "$line"))
 		[[ "${data[$column]}" == "$2" || ! "$2" ]] && "$3"
-		[[ $? == 255 ]] && return 1
+		[[ $? == 255 ]] && return 255
 		r=0
 	done < "$1"
 

From fb247a60928227af05cab77ce9b83a89e83d3796 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Thu, 15 Aug 2024 19:45:56 +0200
Subject: [PATCH 048/112] server: try to drop invalid connections

---
 src/server.sh | 38 ++++++++++++++++++++++++--------------
 1 file changed, 24 insertions(+), 14 deletions(-)

diff --git a/src/server.sh b/src/server.sh
index b3f7e2d..8d2a839 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -26,6 +26,29 @@ r[status]=210 # Mommy always said that I was special
 r[req_headers]=''
 post_length=0
 
+# start reading the stream here instead of the loop below;
+# this way, we can detect if the connection is even valid HTTP.
+# we're reading up to 8 characters and waiting for a space.
+read -d' ' -r -n8 param
+
+if [[ "${param,,}" =~ ^(get|post|patch|put|delete|meow) ]]; then # TODO: OPTIONS, HEAD
+	r[method]="${param%% *}"
+	read -r param
+	[[ "${r[method],,}" != "get" ]] && r[post]=true
+	r[url]="$(sed -E 's/^ *//;s/HTTP\/[0-9]+\.[0-9]+//;s/ //g;s/\/*\r//g;s/\/\/*/\//g' <<< "$param")"
+	IFS='&'
+	for i in ${r[url]#*\?}; do
+		name="$(url_decode "${i%%=*}")"
+		value="$(url_decode "${i#*=}")"
+		get_data[$name]="$value"
+	done
+	unset IFS
+	
+else
+	exit 1 # TODO: throw 400 here
+fi
+
+# continue with reading the headers
 while read -r param; do
 	r[req_headers]+="$param"
 	param_l="${param,,}" # lowercase
@@ -85,20 +108,7 @@ while read -r param; do
 
 	elif [[ "$param_l" == "range: bytes="* ]]; then
 		r[range]="$(sed 's/Range: bytes=//;s/\r//' <<< "$param")"
-		
-	elif [[ "$param_l" =~ ^(get|post|patch|put|delete|meow) ]]; then # TODO: OPTIONS, HEAD
-		r[method]="${param%% *}"
-		[[ "${r[method],,}" != "get" ]] && r[post]=true
-		r[url]="$(sed -E 's/^[a-zA-Z]* //;s/HTTP\/[0-9]+\.[0-9]+//;s/ //g;s/\/*\r//g;s/\/\/*/\//g' <<< "$param")"
-
-		IFS='&'
-		for i in ${r[url]#*\?}; do
-			name="$(url_decode "${i%%=*}")"
-			value="$(url_decode "${i#*=}")"
-			get_data[$name]="$value"
-		done
-		unset IFS
-	fi
+	fi		
 done
 
 r[url]="$(url_decode "${r[url]}")" # doing this here for.. reasons

From 691ff46e7554ef0391795f35533044bdc000de8f Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Thu, 15 Aug 2024 19:50:15 +0200
Subject: [PATCH 049/112] response: fixup the HTTP response code if it got
 emptied by downstream

---
 src/response/200.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/response/200.sh b/src/response/200.sh
index 0ce08fd..d689ed5 100755
--- a/src/response/200.sh
+++ b/src/response/200.sh
@@ -9,6 +9,7 @@ function __headers() {
 		elif [[ "${r[status]}" == '200' || "${r[status]}" == '212' ]]; then # normal or router, should just return 200
 			echo -ne "HTTP/1.0 200 OK\r\n"
 		else # changed by the user in the meantime :)
+			[[ ! "${r[status]}" ]] && r[status]=500 # ... if they left it blank
 			echo -ne "HTTP/1.0 ${r[status]} meow\r\n"
 		fi
 		[[ "${r[headers]}" != '' ]] && echo -ne "${r[headers]}"

From 69751adc5226a0bb5398bebbf0a39d3d79a2cf50 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Thu, 15 Aug 2024 23:44:49 +0200
Subject: [PATCH 050/112] server: fix parameter parsing on very long chains

---
 src/server.sh | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/server.sh b/src/server.sh
index 8d2a839..ef69658 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -213,14 +213,15 @@ if [[ "${r[post]}" == true ]] && [[ "${r[status]}" == 200 ||  "${r[status]}" ==
 		rm $tmpfile
 	else
 		read -r -N "${r[content_length]}" data
-		
-		IFS='&'
-		for i in $(tr -d '\n' <<< "$data"); do
-			name="${i/=*/}"
-			param="${i/*=/}"
-			post_data[$name]="$param"
-		done
+
 		unset IFS
+		while read -d'&' i; do
+			name="${i%%=*}"
+			if [[ "$name" ]]; then
+				param="${i#*=}"
+				post_data[$name]="$param"
+			fi
+		done <<< "$(tr -d '\n' <<< "$data")&"
 	fi
 fi
 

From dabd8bdb0ce2d54f322c3d2692ca1bea39f1cac9 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 17 Aug 2024 02:33:49 +0200
Subject: [PATCH 051/112] main: interactive shell mode

---
 docs/running.md |  1 +
 http.sh         | 44 ++++++++++++++++++++++++++++----------------
 2 files changed, 29 insertions(+), 16 deletions(-)

diff --git a/docs/running.md b/docs/running.md
index 0f0d1d9..c8c8931 100644
--- a/docs/running.md
+++ b/docs/running.md
@@ -7,4 +7,5 @@ The only args checked are `$1`.
 - `init` create an app skeleton
 - `debug` show stderr
 - `debuggier` show stderr and calltrace
+- `shell` drops you into an environment practically equivalent to the runtime
 
diff --git a/http.sh b/http.sh
index 11c2bd1..2d13325 100755
--- a/http.sh
+++ b/http.sh
@@ -1,5 +1,10 @@
 #!/usr/bin/env bash
 trap ctrl_c INT
+ctrl_c() {
+	[[ $socket != '' ]] && rm $socket
+	pkill -P $$
+	echo -e "Cleaned up, exitting.\nHave an awesome day!!"
+}
 
 if [[ ! -f "config/master.sh" ]]; then
 	mkdir -p config
@@ -54,32 +59,39 @@ fi
 
 source config/master.sh
 
-function ctrl_c() {
-	[[ $socket != '' ]] && rm $socket
-	pkill -P $$
-	echo -e "Cleaned up, exitting.\nHave an awesome day!!"
-}
-
-if [[ ! -f "$(pwd)/http.sh" ]]; then
+if [[ ! -f "$PWD/http.sh" ]]; then
 		echo -e "Please run HTTP.sh inside it's designated directory\nRunning the script from arbitrary locations isn't supported."
 		exit 1
 fi	
 
-
-for i in $(cat src/dependencies.required); do
-	which $i > /dev/null 2>&1
-	if [[ $? != 0 ]]; then
+while read i; do
+	if ! which $i > /dev/null 2>&1; then
 		echo "ERROR: can't find $i"
 		error=true
 	fi
-done
-for i in $(cat src/dependencies.optional); do
+done < src/dependencies.required
+
+while read i; do
 	which $i > /dev/null 2>&1
 	[[ $? != 0 ]] && echo "WARNING: can't find $i"
-done
+done < src/dependencies.optional
 
-which ncat > /dev/null 2>&1
-if [[ $? != 0 ]]; then
+if [[ "$1" == 'shell' ]]; then
+	bash --rcfile <(echo '
+	x() { declare -p data;} # for notORM
+	source config/master.sh
+	source src/account.sh
+	source src/mail.sh
+	source src/mime.sh
+	source src/misc.sh
+	source src/notORM.sh
+	source src/template.sh
+	source "${cfg[namespace]}/config.sh"
+	PS1="[HTTP.sh] \[\033[01;34m\]\w\[\033[00m\]\$ "')
+	exit 0
+fi
+
+if ! which ncat > /dev/null 2>&1; then
 	if [[ ${cfg[socat_only]} != true ]]; then
 		echo "ERROR: can't find ncat, and cfg[socat_only] is not set to true"
 		error=true

From 6a22be0b4d4916d7afe8301e9fed8616ba0c00ec Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 17 Aug 2024 02:55:54 +0200
Subject: [PATCH 052/112] server: fix parameter parsing on very long chains (in
 GET)

---
 src/server.sh | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/src/server.sh b/src/server.sh
index ef69658..0c17b1b 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -36,14 +36,15 @@ if [[ "${param,,}" =~ ^(get|post|patch|put|delete|meow) ]]; then # TODO: OPTIONS
 	read -r param
 	[[ "${r[method],,}" != "get" ]] && r[post]=true
 	r[url]="$(sed -E 's/^ *//;s/HTTP\/[0-9]+\.[0-9]+//;s/ //g;s/\/*\r//g;s/\/\/*/\//g' <<< "$param")"
-	IFS='&'
-	for i in ${r[url]#*\?}; do
-		name="$(url_decode "${i%%=*}")"
-		value="$(url_decode "${i#*=}")"
-		get_data[$name]="$value"
-	done
 	unset IFS
-	
+	while read -d'&' i; do
+		name="${i%%=*}"
+		if [[ "$name" ]]; then
+			value="${i#*=}"
+			get_data[$name]="$value"
+		fi
+	done <<< "${r[url]#*\?}&"
+
 else
 	exit 1 # TODO: throw 400 here
 fi

From 5fc46f0f53a8faefd8abdb20d369d9c852ec138a Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 17 Aug 2024 04:14:06 +0200
Subject: [PATCH 053/112] misc: improve url_decode

---
 src/misc.sh | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/src/misc.sh b/src/misc.sh
index e5617a7..b9e9c6b 100755
--- a/src/misc.sh
+++ b/src/misc.sh
@@ -53,7 +53,14 @@ function url_encode() {
 
 # url_decode(string)
 function url_decode() {
-	echo -ne "$(sed -E 's/%[0-1][0-9a-f]//g;s/%/\\x/g;s/\+/ /g' <<< "$1")"
+	# we should probably fail on invalid data here,
+	# but this function is kinda sorta infallible right now
+
+	local t=$'\01'
+	local a="${1//$t}" # strip all of our control chrs for safety
+	a="${1//+/ }" # handle whitespace
+	a="${a//%[A-Fa-f0-9][A-Fa-f0-9]/$t&}" # match '%xx', prepend with token
+	echo -ne "${a//$t%/\\x}" # replace the above with '\\x' and evaluate
 }
 
 # bogus function!

From 4728b1651f38871ac325d25c614e396b5a7a25aa Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 17 Aug 2024 04:51:17 +0200
Subject: [PATCH 054/112] server: rewrite slow sed calls into fast(er) bashisms

---
 http.sh       |  1 +
 src/server.sh | 68 +++++++++++++++++++++++++++++----------------------
 2 files changed, 40 insertions(+), 29 deletions(-)

diff --git a/http.sh b/http.sh
index 2d13325..9ea52e1 100755
--- a/http.sh
+++ b/http.sh
@@ -78,6 +78,7 @@ done < src/dependencies.optional
 
 if [[ "$1" == 'shell' ]]; then
 	bash --rcfile <(echo '
+	shopt -s extglob
 	x() { declare -p data;} # for notORM
 	source config/master.sh
 	source src/account.sh
diff --git a/src/server.sh b/src/server.sh
index 0c17b1b..9011294 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -4,6 +4,7 @@
 if [[ "$1" == true ]]; then
     set -x
 fi
+shopt -s extglob
 
 source config/master.sh
 source src/mime.sh
@@ -31,6 +32,8 @@ post_length=0
 # we're reading up to 8 characters and waiting for a space.
 read -d' ' -r -n8 param
 
+shopt -s nocasematch # only for initial parse; saves us *many* sed calls
+
 if [[ "${param,,}" =~ ^(get|post|patch|put|delete|meow) ]]; then # TODO: OPTIONS, HEAD
 	r[method]="${param%% *}"
 	read -r param
@@ -51,63 +54,68 @@ fi
 
 # continue with reading the headers
 while read -r param; do
+	[[ "$param" == $'\r' ]] && break
 	r[req_headers]+="$param"
-	param_l="${param,,}" # lowercase
+	param="${param##+( )}" # strip beginning whitespace
+	param="${param%%+( )*($'\r')}" # ... and the end whitespace
 	name=''
 	value=''
 	data=''
 	unset IFS
 
 	# TODO: think about refactoring those ifs; maybe we *don't* need to have a header "allowlist" afterall...
-	
-	if [[ "$param_l" == $'\015' ]]; then
-		break
-		
-	elif [[ "$param_l" == "content-length:"* ]]; then
-		r[content_length]="$(sed 's/Content-Length: //i;s/\r//' <<< "$param")"
 
-	elif [[ "$param_l" == "content-type:"* ]]; then
-		r[content_type]="$(sed 's/Content-Type: //i;s/\r//' <<< "$param")"
+	if [[ "$param" == "content-length:"* ]]; then
+		r[content_length]="${param#content-length:*( )}"
+
+	elif [[ "$param" == "content-type:"* ]]; then
+		r[content_type]="${param#content-type:*( )}"
 		if [[ "${r[content_type]}" == *"multipart/form-data"* ]]; then
 			tmpdir=$(mktemp -d)
 		fi
 		if [[ "${r[content_type]}" == *"boundary="* ]]; then
-			r[content_boundary]="$(sed -E 's/(.*)boundary=//i;s/\r//;s/ //' <<< "${r[content_type]}")"
+			r[content_boundary]="${r[content_type]##*boundary=}"
 		fi
 		
-	elif [[ "$param_l" == "host:"* ]]; then
-		r[host]="$(sed 's/Host: //i;s/\r//;s/\\//g' <<< "$param")"
-		r[host_portless]="$(sed -E 's/:(.*)$//' <<< "${r[host]}")"
+	elif [[ "$param" == "host:"* ]]; then
+		r[host]="${param#host:*( )}"
+		r[host_portless]="${r[host]%%:*}"
 		if [[ -f "config/$(basename -- ${r[host]})" ]]; then
 			source "config/$(basename -- ${r[host]})"
 		elif [[ -f "config/$(basename -- ${r[host_portless]})" ]]; then
 			source "config/$(basename -- ${r[host_portless]})"
 		fi
 
-	elif [[ "$param_l" == "user-agent:"* ]]; then
-		r[user_agent]="$(sed 's/User-Agent: //i;s/\r//;s/\\//g' <<< "$param")"
+	elif [[ "$param" == "user-agent:"* ]]; then
+		r[user_agent]="{param/user-agent:*( )}"
 		
-	elif [[ "$param_l" == "upgrade:"* && $(sed 's/Upgrade: //i;s/\r//' <<< "$param") == "websocket" ]]; then
+	elif [[ "$param" == "upgrade:"* && "${param/upgrade:}" == *"websocket"* ]]; then
 		r[status]=101
 		
-	elif [[ "$param_l" == "sec-websocket-key:"* ]]; then
-		r[websocket_key]="$(sed 's/Sec-WebSocket-Key: //i;s/\r//' <<< "$param")"
+	elif [[ "$param" == "sec-websocket-key:"* ]]; then
+		r[websocket_key]="${param#sec-websocket-key:*( )}"
 		
-	elif [[ "$param_l" == "authorization: basic"* ]]; then
+	elif [[ "$param" == "authorization: basic"* ]]; then
 		login_simple "$param"
 		
-	elif [[ "$param_l" == "authorization: bearer"* ]]; then
-		r[authorization]="$(sed 's/Authorization: Bearer //i;s/\r//' <<< "$param")"
+	elif [[ "$param" == "authorization: bearer"* ]]; then
+		r[authorization]="${param#authorization:*( )bearer*( )}"
 
-	elif [[ "$param_l" == "cookie: "* ]]; then
-		IFS=';'
-		for i in $(IFS=' '; echo "$param" | sed -E 's/Cookie: //i;;s/%/\\x/g'); do
-			name="$((grep -Poh "[^ ].*?(?==)" | head -1) <<< $i)"
-			value="$(sed "s/$name=//;s/^ //;s/ $//" <<< $i)"
-			cookies[$name]="$(echo -e $value)"
-		done
+	elif [[ "$param" == "cookie: "* ]]; then
+		while read -d';' i; do
+			i="$(url_decode "$i")"
+			name="${i%%=*}"
 
-	elif [[ "$param_l" == "range: bytes="* ]]; then
+			if [[ "$name" ]]; then
+				# get value, strip potential whitespace
+				value="${i#*=}"
+				value="${value##+( )}"
+				value="${value%%+( )}"
+				cookies[$name]="$value"
+			fi
+		done <<< "${param//cookie:}"
+
+	elif [[ "$param" == "range: bytes="* ]]; then
 		r[range]="$(sed 's/Range: bytes=//;s/\r//' <<< "$param")"
 	fi		
 done
@@ -125,6 +133,8 @@ else
 	r[ip]="$NCAT_REMOTE_ADDR:$NCAT_REMOTE_PORT"
 fi
 
+shopt -u nocasematch
+
 echo "$(date) - IP: ${r[ip]}, PROTO: ${r[proto]}, URL: ${r[url]}, GET_data: ${get_data[@]}, POST_data: ${post_data[@]}, POST_multipart: ${post_multipart[@]}, UA: ${r[user_agent]}" >> "${cfg[namespace]}/${cfg[log]}"
 
 [[ -f "${cfg[namespace]}/routes.sh" ]] && source "${cfg[namespace]}/routes.sh"

From 1059be161822375fe5378433b5f4e7d82b7ff989 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 17 Aug 2024 05:14:53 +0200
Subject: [PATCH 055/112] server: fixup the parameter and cookie parsing

---
 src/server.sh | 71 +++++++++++++++++++++++++++------------------------
 1 file changed, 38 insertions(+), 33 deletions(-)

diff --git a/src/server.sh b/src/server.sh
index 9011294..650724f 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -40,13 +40,16 @@ if [[ "${param,,}" =~ ^(get|post|patch|put|delete|meow) ]]; then # TODO: OPTIONS
 	[[ "${r[method],,}" != "get" ]] && r[post]=true
 	r[url]="$(sed -E 's/^ *//;s/HTTP\/[0-9]+\.[0-9]+//;s/ //g;s/\/*\r//g;s/\/\/*/\//g' <<< "$param")"
 	unset IFS
-	while read -d'&' i; do
-		name="${i%%=*}"
-		if [[ "$name" ]]; then
-			value="${i#*=}"
-			get_data[$name]="$value"
-		fi
-	done <<< "${r[url]#*\?}&"
+
+	if [[ "${r[url]}" == *'?'* ]]; then
+		while read -d'&' i; do
+			name="${i%%=*}"
+			if [[ "$name" ]]; then
+				value="${i#*=}"
+				get_data[$name]="$value"
+			fi
+		done <<< "${r[url]#*\?}&"
+	fi
 
 else
 	exit 1 # TODO: throw 400 here
@@ -56,29 +59,31 @@ fi
 while read -r param; do
 	[[ "$param" == $'\r' ]] && break
 	r[req_headers]+="$param"
-	param="${param##+( )}" # strip beginning whitespace
-	param="${param%%+( )*($'\r')}" # ... and the end whitespace
+	param="${param##*( )}" # strip beginning whitespace
+	param="${param%%*( )*($'\r')}" # ... and the end whitespace
 	name=''
 	value=''
 	data=''
 	unset IFS
 
 	# TODO: think about refactoring those ifs; maybe we *don't* need to have a header "allowlist" afterall...
+	# TODO: some of those options are... iffy wrt case sensitiveness
 
 	if [[ "$param" == "content-length:"* ]]; then
-		r[content_length]="${param#content-length:*( )}"
+		r[content_length]="${param#*:*( )}"
+		declare -p param >/dev/stderr
 
 	elif [[ "$param" == "content-type:"* ]]; then
-		r[content_type]="${param#content-type:*( )}"
+		r[content_type]="${param#*:*( )}"
 		if [[ "${r[content_type]}" == *"multipart/form-data"* ]]; then
 			tmpdir=$(mktemp -d)
 		fi
 		if [[ "${r[content_type]}" == *"boundary="* ]]; then
 			r[content_boundary]="${r[content_type]##*boundary=}"
 		fi
-		
+
 	elif [[ "$param" == "host:"* ]]; then
-		r[host]="${param#host:*( )}"
+		r[host]="${param#*:*( )}"
 		r[host_portless]="${r[host]%%:*}"
 		if [[ -f "config/$(basename -- ${r[host]})" ]]; then
 			source "config/$(basename -- ${r[host]})"
@@ -87,19 +92,19 @@ while read -r param; do
 		fi
 
 	elif [[ "$param" == "user-agent:"* ]]; then
-		r[user_agent]="{param/user-agent:*( )}"
-		
+		r[user_agent]="${param#*:*( )}"
+
 	elif [[ "$param" == "upgrade:"* && "${param/upgrade:}" == *"websocket"* ]]; then
 		r[status]=101
-		
+
 	elif [[ "$param" == "sec-websocket-key:"* ]]; then
-		r[websocket_key]="${param#sec-websocket-key:*( )}"
-		
+		r[websocket_key]="${param#*:*( )}"
+
 	elif [[ "$param" == "authorization: basic"* ]]; then
 		login_simple "$param"
-		
+
 	elif [[ "$param" == "authorization: bearer"* ]]; then
-		r[authorization]="${param#authorization:*( )bearer*( )}"
+		r[authorization]="${param#*:*( )[Bb]earer*( )}"
 
 	elif [[ "$param" == "cookie: "* ]]; then
 		while read -d';' i; do
@@ -109,15 +114,15 @@ while read -r param; do
 			if [[ "$name" ]]; then
 				# get value, strip potential whitespace
 				value="${i#*=}"
-				value="${value##+( )}"
-				value="${value%%+( )}"
+				value="${value##*( )}"
+				value="${value%%*( )}"
 				cookies[$name]="$value"
 			fi
-		done <<< "${param//cookie:}"
+		done <<< "${param//cookie:};"
 
 	elif [[ "$param" == "range: bytes="* ]]; then
-		r[range]="$(sed 's/Range: bytes=//;s/\r//' <<< "$param")"
-	fi		
+		r[range]="${param#*=}"
+	fi
 done
 
 r[url]="$(url_decode "${r[url]}")" # doing this here for.. reasons
@@ -202,10 +207,10 @@ if [[ "${r[post]}" == true ]] && [[ "${r[status]}" == 200 ||  "${r[status]}" ==
 		declare post_multipart
 		tmpfile=$(mktemp -p $tmpdir)
 		dd iflag=fullblock of=$tmpfile ibs=${r[content_length]} count=1 obs=1M
-		
+
 		delimeter_len=$(echo -n "${r[content_boundary]}"$'\015' | wc -c)
 		boundaries_list=$(echo -ne $(grep $tmpfile -ao -e ${r[content_boundary]} --byte-offset | sed -E 's/:(.*)//g') | sed -E 's/ [0-9]+$//')
-		
+
 		for i in $boundaries_list; do
 			tmpout=$(mktemp -p $tmpdir)
 			dd iflag=fullblock if=$tmpfile ibs=$(($i+$delimeter_len)) obs=1M skip=1 | while true; do
@@ -226,13 +231,13 @@ if [[ "${r[post]}" == true ]] && [[ "${r[status]}" == 200 ||  "${r[status]}" ==
 		read -r -N "${r[content_length]}" data
 
 		unset IFS
-		while read -d'&' i; do
+		while read -r -d'&' i; do
 			name="${i%%=*}"
-			if [[ "$name" ]]; then
-				param="${i#*=}"
-				post_data[$name]="$param"
-			fi
-		done <<< "$(tr -d '\n' <<< "$data")&"
+			value="${i#*=}"
+			post_data[$name]="$value"
+			echo post_data[$name]="$value" >/dev/stderr
+
+		done <<< "${data}&"
 	fi
 fi
 

From 11d3c0a8998c187f7230d5da247063cf2e10cc10 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 17 Aug 2024 21:27:32 +0200
Subject: [PATCH 056/112] notORM: replace some tr calls with bashisms

---
 src/notORM.sh | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index 6631f9e..c29df97 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -48,7 +48,8 @@ data_add() {
 	local IFS=$'\n'
 
 	for i in "${ref[@]}"; do
-		res+="$(echo -n "$i" | tr -d '\01\02\03' | tr '\n' '\02')"$delim
+		trim_control "$i"
+		res+="$tr$delim"
 	done
 
 	echo "$res" >> "$1" # TODO: some locking
@@ -68,7 +69,7 @@ data_get() {
 
 	while read line; do
 		local IFS=$delim
-		ref=($(tr '\02' '\n' <<< "$line"))
+		ref=(${line//$'\x02'/$'\n'})
 		[[ "${ref[$column]}" == "$2" ]] && return 0
 	done < "$1"
 
@@ -92,7 +93,7 @@ data_iter() {
 
 	while read line; do
 		local IFS=$delim
-		data=($(tr '\02' '\n' <<< "$line"))
+		data=(${line//$'\x02'/$line})
 		[[ "${data[$column]}" == "$2" || ! "$2" ]] && "$3"
 		[[ $? == 255 ]] && return 255
 		r=0
@@ -134,10 +135,12 @@ data_replace() {
 	local column=${4:-0}
 	local -n ref="$3"
 	local output=
+	local tr
 	local IFS=' '
 	
 	for i in "${ref[@]}"; do
-		output+="$(echo -n "$i" | tr -d '\01\02\03' | tr '\n' '\02')$delim" # TODO: check if this is arbitrary safe
+		trim_control "$i"
+		output+="$tr"
 	done
 	
 	if [[ $column == 0 ]]; then
@@ -169,10 +172,18 @@ data_yeet() {
 }
 
 _sed_sanitize() {
-	echo -n "$1" | tr -d '\01\02\03' | tr '\n' '\02' | xxd -p | tr -d '\n' | sed -E 's/../\\x&/g'	
+	trim_control "$1"
+	echo -n "$tr" | xxd -p | tr -d '\n' | sed -E 's/../\\x&/g'
 }
 
 _sed_sanitize_array() {
-	echo -n "$1" | xxd -p | tr -d '\n' | sed -E 's/../\\x&/g'	
+	echo -n "$1" | xxd -p | tr -d '\n' | sed -E 's/../\\x&/g'
 }
 
+# _trim_control(string) -> $tr
+_trim_control() {
+	tr="${1//$delim}"                # remove 0x01
+	tr="${tr//$newline}"             # remove 0x02
+	tr="${tr//$ctrl}"                # remove 0x03
+	tr="${tr//$'\n'/$newline}$delim" # \n -> 0x02
+}

From 23de1448e047c1cb84b66be9b2ab5b660c8a125d Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 17 Aug 2024 21:28:23 +0200
Subject: [PATCH 057/112] worker: setup the runtime

---
 src/worker.sh | 40 +++++++++++++++++++++++++---------------
 1 file changed, 25 insertions(+), 15 deletions(-)

diff --git a/src/worker.sh b/src/worker.sh
index 3545ddb..021b491 100755
--- a/src/worker.sh
+++ b/src/worker.sh
@@ -1,25 +1,35 @@
 #!/usr/bin/env bash
-
 # worker.sh - setup and control of workers
 
 # worker_add(name, interval)
 function worker_add() {
 	if [[ -x "${cfg[namespace]}/workers/$1/worker.sh" ]]; then
 		echo "[WRKR] adding worker $1"
-		while true; do 
-			source "${cfg[namespace]}/workers/$1/worker.sh"
-			sleep $2
-			if [[ $(cat "${cfg[namespace]}/workers/$1/control") == "die" ]]; then
-				echo "" > ${cfg[namespace]}/workers/$1/control
-				while true; do
-					if [[ $(cat "${cfg[namespace]}/workers/$1/control") == "run" ]]; then
-						echo "" > "${cfg[namespace]}/workers/$1/control"
-						break
-					fi
-					sleep $2
-				done
-			 fi
-		done &
+		{
+			shopt -s extglob
+			x() { declare -p data;} # for notORM
+			source config/master.sh
+			source src/account.sh
+			source src/mail.sh
+			source src/mime.sh
+			source src/misc.sh
+			source src/notORM.sh
+			source src/template.sh
+			while true; do
+				source "${cfg[namespace]}/workers/$1/worker.sh"
+				sleep $2
+				if [[ $(cat "${cfg[namespace]}/workers/$1/control") == "die" ]]; then
+					echo "" > ${cfg[namespace]}/workers/$1/control
+					while true; do
+						if [[ $(cat "${cfg[namespace]}/workers/$1/control") == "run" ]]; then
+							echo "" > "${cfg[namespace]}/workers/$1/control"
+							break
+						fi
+						sleep $2
+					done
+				 fi
+			done
+		} &
 	else
 		echo "[WRKR] Broken config - workers/$1/worker.sh does not exist, or is not executable?"
 	fi

From 3db39c4948e566880e189b70a5275c9dfdaa6be7 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 17 Aug 2024 21:35:57 +0200
Subject: [PATCH 058/112] notORM: fix typo

---
 src/notORM.sh | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index c29df97..eead908 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -48,7 +48,7 @@ data_add() {
 	local IFS=$'\n'
 
 	for i in "${ref[@]}"; do
-		trim_control "$i"
+		_trim_control "$i"
 		res+="$tr$delim"
 	done
 
@@ -92,8 +92,9 @@ data_iter() {
 	local r=1
 
 	while read line; do
-		local IFS=$delim
+		IFS=$delim
 		data=(${line//$'\x02'/$line})
+		IFS=
 		[[ "${data[$column]}" == "$2" || ! "$2" ]] && "$3"
 		[[ $? == 255 ]] && return 255
 		r=0
@@ -139,7 +140,7 @@ data_replace() {
 	local IFS=' '
 	
 	for i in "${ref[@]}"; do
-		trim_control "$i"
+		_trim_control "$i"
 		output+="$tr"
 	done
 	
@@ -172,7 +173,7 @@ data_yeet() {
 }
 
 _sed_sanitize() {
-	trim_control "$1"
+	_trim_control "$1"
 	echo -n "$tr" | xxd -p | tr -d '\n' | sed -E 's/../\\x&/g'
 }
 

From 4b9d4a5fda29d77aa3d382fb4e197e94b4ee2656 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 17 Aug 2024 21:56:53 +0200
Subject: [PATCH 059/112] notORM: fix spurious $delim

---
 src/notORM.sh | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index eead908..76dcb4d 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -183,8 +183,8 @@ _sed_sanitize_array() {
 
 # _trim_control(string) -> $tr
 _trim_control() {
-	tr="${1//$delim}"                # remove 0x01
-	tr="${tr//$newline}"             # remove 0x02
-	tr="${tr//$ctrl}"                # remove 0x03
-	tr="${tr//$'\n'/$newline}$delim" # \n -> 0x02
+	tr="${1//$delim}"          # remove 0x01
+	tr="${tr//$newline}"       # remove 0x02
+	tr="${tr//$ctrl}"          # remove 0x03
+	tr="${tr//$'\n'/$newline}" # \n -> 0x02
 }

From 12011e5991d84dee4bb907db252ac95358c9f9c6 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 17 Aug 2024 22:30:07 +0200
Subject: [PATCH 060/112] notORM: fix not enough delims

---
 src/notORM.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index 76dcb4d..ee2b6ef 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -141,7 +141,7 @@ data_replace() {
 	
 	for i in "${ref[@]}"; do
 		_trim_control "$i"
-		output+="$tr"
+		output+="$tr$delim"
 	done
 	
 	if [[ $column == 0 ]]; then

From 11828198cea0bead549ebdc1d0aab57754fc1486 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 17 Aug 2024 22:36:47 +0200
Subject: [PATCH 061/112] account: fix bug with empty fields getting omitted

---
 src/account.sh | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/account.sh b/src/account.sh
index e511630..0248c3a 100755
--- a/src/account.sh
+++ b/src/account.sh
@@ -25,7 +25,7 @@ function register() {
 
 	_password_hash "$2" "$salt"
 
-	local out=("$username" "$hash" "$salt" "" "${extra[@]}")
+	local out=("$username" "$hash" "$salt" "." "${extra[@]}")
 	data_add secret/users.dat out
 
 	_new_session "$username"
@@ -154,12 +154,15 @@ user_reset_password() {
 	[[ ! "$1" ]] && return 1 # sensitive function, so we're checking all three
 	[[ ! "$2" ]] && return 1 # there's probably a better way,
 	[[ ! "$3" ]] && return 1 # but i don't care.
+
+	[[ "$2" == '.' ]] && return 1
+	local user
 	if data_get secret/users.dat "$1" 0 user; then
 
 		if [[ "$2" == "${user[3]}" ]]; then
 			_password_hash "$3" "${user[2]}"
 			user[1]="$hash"
-			user[3]=''
+			user[3]='.'
 
 			data_replace secret/users.dat "$1" user
 
@@ -172,7 +175,7 @@ user_reset_password() {
 	return 1
 }
 
-# user_change_password(username, old_password, new_password)
+# user_change_password(username, old_password, new_password) -> $?, ${user[@]}
 user_change_password() {
 	[[ ! "$1" ]] && return 1
 	[[ ! "$2" ]] && return 1
@@ -199,9 +202,10 @@ user_change_password() {
 	return 1
 }
 
-# user_gen_reset_token(username) -> $token
+# user_gen_reset_token(username) -> $?, $token, ${user[@]}
 user_gen_reset_token() {
 	[[ ! "$1" ]] && return 1
+	
 	if data_get secret/users.dat "$1" 0 user; then
 		user[3]="$(dd if=/dev/urandom bs=20 count=1 status=none | xxd -p)"
 		data_replace secret/users.dat "$1" user

From d8a475e11b0e22493db8dfb1dd8e9d0c350b13dc Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 17 Aug 2024 23:10:10 +0200
Subject: [PATCH 062/112] notORM, account: revert previous fix and employ a
 workaround for a bash bug

---
 src/account.sh |  6 +++---
 src/notORM.sh  | 16 ++++++++++++----
 2 files changed, 15 insertions(+), 7 deletions(-)

diff --git a/src/account.sh b/src/account.sh
index 0248c3a..74d1778 100755
--- a/src/account.sh
+++ b/src/account.sh
@@ -25,7 +25,7 @@ function register() {
 
 	_password_hash "$2" "$salt"
 
-	local out=("$username" "$hash" "$salt" "." "${extra[@]}")
+	local out=("$username" "$hash" "$salt" "" "${extra[@]}")
 	data_add secret/users.dat out
 
 	_new_session "$username"
@@ -116,6 +116,7 @@ function logout() {
 function session_verify() {
 	[[ ! "$1" ]] && return 1
 	unset IFS
+	local session
 	local user
 
 	if data_get secret/sessions.dat "$1" 2 session; then
@@ -155,14 +156,13 @@ user_reset_password() {
 	[[ ! "$2" ]] && return 1 # there's probably a better way,
 	[[ ! "$3" ]] && return 1 # but i don't care.
 
-	[[ "$2" == '.' ]] && return 1
 	local user
 	if data_get secret/users.dat "$1" 0 user; then
 
 		if [[ "$2" == "${user[3]}" ]]; then
 			_password_hash "$3" "${user[2]}"
 			user[1]="$hash"
-			user[3]='.'
+			user[3]=''
 
 			data_replace secret/users.dat "$1" user
 
diff --git a/src/notORM.sh b/src/notORM.sh
index ee2b6ef..09fd43f 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -68,8 +68,13 @@ data_get() {
 	local IFS=$'\n'
 
 	while read line; do
-		local IFS=$delim
-		ref=(${line//$'\x02'/$'\n'})
+		IFS=$delim
+		
+		# LOAD-BEARING!!
+		# without an intermediate variable, bash trims out empty
+		# objects. expansions be damned
+		local x="${line//$newline/$'\n'}"
+		ref=($x)
 		[[ "${ref[$column]}" == "$2" ]] && return 0
 	done < "$1"
 
@@ -79,7 +84,7 @@ data_get() {
 # run `callback` on all entries from `store` that match `search`.
 # by default uses the 0th column. override with optional `column`
 #
-# immediately exits with 1 if the callback function returned 255
+# immediately exits with 255 if the callback function returned 255
 # if there were no matches, returns 2
 # if the store wasn't found, returns 4
 #
@@ -93,7 +98,10 @@ data_iter() {
 
 	while read line; do
 		IFS=$delim
-		data=(${line//$'\x02'/$line})
+		
+		# LOAD BEARING; see data_get
+		local x="${line//$newline/$'\n'}"
+		data=($x)
 		IFS=
 		[[ "${data[$column]}" == "$2" || ! "$2" ]] && "$3"
 		[[ $? == 255 ]] && return 255

From cd0fe42879a9012dbe5caab5c9a7624def8ef5a5 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 18 Aug 2024 00:05:58 +0200
Subject: [PATCH 063/112] cookie: add Path attribute

---
 http.sh     | 2 ++
 src/misc.sh | 4 ++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/http.sh b/http.sh
index 9ea52e1..82aafd3 100755
--- a/http.sh
+++ b/http.sh
@@ -54,6 +54,8 @@ cfg[mail_ignore_bad_cert]=false
 
 # unset for legacy sha256sum hashing (not recommended)
 cfg[hash]="argon2id"
+
+cfg[cookie_path]="/"
 EOF
 fi
 
diff --git a/src/misc.sh b/src/misc.sh
index b9e9c6b..49d21af 100755
--- a/src/misc.sh
+++ b/src/misc.sh
@@ -3,12 +3,12 @@
 
 # set_cookie(cookie_name, cookie_content)
 function set_cookie() {
-	r[headers]+="Set-Cookie: $1=$2\r\n"
+	r[headers]+="Set-Cookie: $1=$2; Path=${cfg[cookie_path]}\r\n"
 }
 
 # set_cookie_permanent(cookie_name, cookie_content)
 function set_cookie_permanent() {
-	r[headers]+="Set-Cookie: $1=$2; Expires=Mon, 26 Jul 2100 22:45:00 GMT\r\n"
+	r[headers]+="Set-Cookie: $1=$2; Expires=Mon, 26 Jul 2100 22:45:00 GMT; Path=${cfg[cookie_path]}\r\n"
 }
 
 # remove_cookie(cookie_name)

From fb8ae0eabc1fc3a505c65b956da424b8ce9073ee Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Tue, 3 Sep 2024 22:56:34 +0200
Subject: [PATCH 064/112] notORM: fix erroneous row return on no match

---
 src/notORM.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/notORM.sh b/src/notORM.sh
index 09fd43f..5c163b4 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -78,6 +78,7 @@ data_get() {
 		[[ "${ref[$column]}" == "$2" ]] && return 0
 	done < "$1"
 
+	unset ref
 	return 2
 }
 

From 2fd62dbbba59fe9ae06d01a40aa57ebb1becf751 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 6 Sep 2024 00:50:47 +0200
Subject: [PATCH 065/112] server: fixup non-urlencoded post_data parsing

---
 src/server.sh | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/src/server.sh b/src/server.sh
index 650724f..377d580 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -25,6 +25,7 @@ declare -A params # parsed router data
 
 r[status]=210 # Mommy always said that I was special
 r[req_headers]=''
+r[payload_type]=none # placeholder
 post_length=0
 
 # start reading the stream here instead of the loop below;
@@ -71,11 +72,14 @@ while read -r param; do
 
 	if [[ "$param" == "content-length:"* ]]; then
 		r[content_length]="${param#*:*( )}"
-		declare -p param >/dev/stderr
 
 	elif [[ "$param" == "content-type:"* ]]; then
 		r[content_type]="${param#*:*( )}"
-		if [[ "${r[content_type]}" == *"multipart/form-data"* ]]; then
+		if [[ "${r[content_type]}" == *"urlencoded" ]]; then
+			r[payload_type]="urlencoded" # TODO: do we want to have a better indicator for this?
+			
+		elif [[ "${r[content_type]}" == *"multipart/form-data"* ]]; then
+			r[payload_type]="multipart"
 			tmpdir=$(mktemp -d)
 		fi
 		if [[ "${r[content_type]}" == *"boundary="* ]]; then
@@ -230,14 +234,19 @@ if [[ "${r[post]}" == true ]] && [[ "${r[status]}" == 200 ||  "${r[status]}" ==
 	else
 		read -r -N "${r[content_length]}" data
 
-		unset IFS
-		while read -r -d'&' i; do
-			name="${i%%=*}"
-			value="${i#*=}"
-			post_data[$name]="$value"
-			echo post_data[$name]="$value" >/dev/stderr
+		if [[ "${r[payload_type]}" == "urlencoded" ]]; then
+			unset IFS
+			while read -r -d'&' i; do
+				name="${i%%=*}"
+				value="${i#*=}"
+				post_data[$name]="$value"
+				echo post_data[$name]="$value" >/dev/stderr
 
-		done <<< "${data}&"
+			done <<< "${data}&"
+		else
+			# this is fine?
+			post_data[0]="${data%\&}"
+		fi
 	fi
 fi
 

From b4ea5954eceb1b1339f02d04c18636d46bb0a08a Mon Sep 17 00:00:00 2001
From: famfo <famfo@famfo.xyz>
Date: Thu, 26 Sep 2024 14:04:19 +0200
Subject: [PATCH 066/112] mime: fix ico/favicon.ico mimetype

---
 src/mime.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/mime.sh b/src/mime.sh
index df3377a..0660a56 100755
--- a/src/mime.sh
+++ b/src/mime.sh
@@ -24,6 +24,14 @@ function get_mime() {
 			mimetype="text/css"
 		elif [[ $mime == "text/"* && $mime != "text/xml" ]]; then
 			mimetype="text/plain"
+        # Technically image/x-icon isn't correct for all images (image/ico also exists) but 
+        # it's what browser (firefox (sample size: 1)) seem to have the least problems with.
+        # image/vnd.microsoft.icon was standardized by the IANA but no microsoft software
+        # understands it, they use image/ico instead. What a mess.
+        elif [[ $file == *"favicon.ico" ]]; then
+            mimetype="image/x-icon"
+        elif [[ $file == *".ico" || $mime == "image/vnd.microsoft.icon" ]]; then
+            mimetype="image/ico"
 		else
 			mimetype="$mime"
 		fi

From 9adbf34fce82811ad4b68c2b489d1436cec2e0a7 Mon Sep 17 00:00:00 2001
From: TheresNoTime <sam@theresnotime.co.uk>
Date: Fri, 30 Aug 2024 20:42:18 +0100
Subject: [PATCH 067/112] Add xxd as a required dependency

---
 src/dependencies.required | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/dependencies.required b/src/dependencies.required
index bd7bebc..0d4e69c 100644
--- a/src/dependencies.required
+++ b/src/dependencies.required
@@ -6,3 +6,4 @@ mktemp
 date
 dd
 file
+xxd

From a1323dc07e45db1d6b5e88858d5046ffda580d2a Mon Sep 17 00:00:00 2001
From: famfo <famfo@famfo.xyz>
Date: Fri, 4 Oct 2024 12:05:38 +0200
Subject: [PATCH 068/112] Test: fix bash path

---
 tst.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tst.sh b/tst.sh
index ad08631..bb50350 100755
--- a/tst.sh
+++ b/tst.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 _defaults() {
 	match=""

From 2cc067fc93954accac454e1e2d8ae4b6b31a7036 Mon Sep 17 00:00:00 2001
From: famfo <famfo@famfo.xyz>
Date: Fri, 4 Oct 2024 11:20:04 +0200
Subject: [PATCH 069/112] server: simplify header parsing code

---
 src/server.sh | 148 +++++++++++++++++++++++++++-----------------------
 1 file changed, 81 insertions(+), 67 deletions(-)

diff --git a/src/server.sh b/src/server.sh
index 377d580..41c8019 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -56,79 +56,93 @@ else
 	exit 1 # TODO: throw 400 here
 fi
 
+declare -A headers
+
+IFS=$'\n'
 # continue with reading the headers
 while read -r param; do
 	[[ "$param" == $'\r' ]] && break
-	r[req_headers]+="$param"
-	param="${param##*( )}" # strip beginning whitespace
-	param="${param%%*( )*($'\r')}" # ... and the end whitespace
-	name=''
-	value=''
-	data=''
+
+    IFS=':'
+    read -ra header_pair <<< "$param"
+    header_key="${header_pair[0],,}" # To lowercase...
+    header_key="${header_key##*( )}" # ...trim leading whitespace...
+    header_key="${header_key%%*( )}" # ...and trailing whitespaces
+
+    header_value="${header_pair[@]:1}"
+    header_value="${header_value##*( )}" # Trim leading whitespace...
+    headers["${header_key}"]="${header_value%%*( )*($'\r')}" # ...and trailing whitespace and \r
+
 	unset IFS
-
-	# TODO: think about refactoring those ifs; maybe we *don't* need to have a header "allowlist" afterall...
-	# TODO: some of those options are... iffy wrt case sensitiveness
-
-	if [[ "$param" == "content-length:"* ]]; then
-		r[content_length]="${param#*:*( )}"
-
-	elif [[ "$param" == "content-type:"* ]]; then
-		r[content_type]="${param#*:*( )}"
-		if [[ "${r[content_type]}" == *"urlencoded" ]]; then
-			r[payload_type]="urlencoded" # TODO: do we want to have a better indicator for this?
-			
-		elif [[ "${r[content_type]}" == *"multipart/form-data"* ]]; then
-			r[payload_type]="multipart"
-			tmpdir=$(mktemp -d)
-		fi
-		if [[ "${r[content_type]}" == *"boundary="* ]]; then
-			r[content_boundary]="${r[content_type]##*boundary=}"
-		fi
-
-	elif [[ "$param" == "host:"* ]]; then
-		r[host]="${param#*:*( )}"
-		r[host_portless]="${r[host]%%:*}"
-		if [[ -f "config/$(basename -- ${r[host]})" ]]; then
-			source "config/$(basename -- ${r[host]})"
-		elif [[ -f "config/$(basename -- ${r[host_portless]})" ]]; then
-			source "config/$(basename -- ${r[host_portless]})"
-		fi
-
-	elif [[ "$param" == "user-agent:"* ]]; then
-		r[user_agent]="${param#*:*( )}"
-
-	elif [[ "$param" == "upgrade:"* && "${param/upgrade:}" == *"websocket"* ]]; then
-		r[status]=101
-
-	elif [[ "$param" == "sec-websocket-key:"* ]]; then
-		r[websocket_key]="${param#*:*( )}"
-
-	elif [[ "$param" == "authorization: basic"* ]]; then
-		login_simple "$param"
-
-	elif [[ "$param" == "authorization: bearer"* ]]; then
-		r[authorization]="${param#*:*( )[Bb]earer*( )}"
-
-	elif [[ "$param" == "cookie: "* ]]; then
-		while read -d';' i; do
-			i="$(url_decode "$i")"
-			name="${i%%=*}"
-
-			if [[ "$name" ]]; then
-				# get value, strip potential whitespace
-				value="${i#*=}"
-				value="${value##*( )}"
-				value="${value%%*( )}"
-				cookies[$name]="$value"
-			fi
-		done <<< "${param//cookie:};"
-
-	elif [[ "$param" == "range: bytes="* ]]; then
-		r[range]="${param#*=}"
-	fi
 done
 
+r[content_length]="${headers["content-length"]}"
+r[user_agent]="${headers["user-agent"]}"
+r[websocket_key]="${headers["sec-websocket-key"]}"
+
+if [[ -n "${headers["content-type"]}" ]]; then
+    IFS=';'
+    read -ra content_type <<< "${headers["content-type"]}"
+    r[content_type]="${content_type[0]}"
+
+    if [[ "${r[content_type]}" == "application/x-www-form-urlencoded" ]]; then
+		r[payload_type]="urlencoded" # TODO: do we want to have a better indicator for this?
+	elif [[ "${r[content_type]}" == "multipart/form-data" ]]; then
+		r[payload_type]="multipart"
+		tmpdir=$(mktemp -d)
+
+        if [[ "${r[content_type]}" == "boundary="* ]]; then
+            boundary="${content_type[@]:1}"
+		    r[content_boundary]="${boundary##*boundary=}"
+	    fi
+	fi
+fi
+
+if [[ -n "${headers["host"]}" ]]; then
+    r[host]="${headers["host"]}"
+    r[host_portless]="${headers["host"]%%:*}"
+
+    if [[ -f "config/$(basename -- ${r[host]})" ]]; then
+	    source "config/$(basename -- ${r[host]})"
+	elif [[ -f "config/$(basename -- ${r[host_portless]})" ]]; then
+		source "config/$(basename -- ${r[host_portless]})"
+	fi
+fi
+
+if [[ "${headers["connection"]}" == "upgrade" && "${headers["upgrade"]}" == "websocket" ]]; then
+    r[status]=101
+fi
+
+if [[ -n "${headers["authorization"]}" ]]; then
+    if [[ "${headers["authorization"],,}" == "basic"* ]]; then
+        base64="${headers["authorization"]#[Bb]asic*( )}"
+        login_simple "${base64##*( )}"
+    elif [[ "${headers["authorization"],,}" == "bearer"* ]]; then
+        bearer="${headers["authorization"]#[Bb]earer*( )}"
+        r[authorization]="${bearer##*( )}"
+    fi
+fi
+
+if [[ -n "${headers["cookie"]}" ]]; then
+    while read -r -d';' cookie_pair; do
+        cookie_pair="$(url_decode "$cookie_pair")"
+		name="${cookie_pair%%=*}"
+		if [[ -n "$name" ]]; then
+            # get value, strip potential whitespace
+            value="${cookie_pair##*=}"
+            value="${value##*( )}"
+            value="${value%%*( )}"
+            cookies[$name]="$value"
+        fi
+    done <<< "${headers["cookie"]};" # This hack is beyond me, just trust the process
+fi
+
+if [[ "${headers["range"]}" == "bytes"* ]]; then
+    r[range]="${headers["range"]#*=}"
+fi
+
+r[req_headers]="$headers"
+
 r[url]="$(url_decode "${r[url]}")" # doing this here for.. reasons
 
 r[uri]="$(realpath "${cfg[namespace]}/${cfg[root]}$(sed -E 's/\?(.*)$//' <<< "${r[url]}")")"

From 510c372f1dbcf741631fbdb0bfc499b07bad60df Mon Sep 17 00:00:00 2001
From: famfo <famfo@famfo.xyz>
Date: Fri, 4 Oct 2024 11:20:19 +0200
Subject: [PATCH 070/112] server: add support for getting IP address behind a
 proxy

---
 src/server.sh | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/server.sh b/src/server.sh
index 41c8019..10ee0ef 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -148,7 +148,10 @@ r[url]="$(url_decode "${r[url]}")" # doing this here for.. reasons
 r[uri]="$(realpath "${cfg[namespace]}/${cfg[root]}$(sed -E 's/\?(.*)$//' <<< "${r[url]}")")"
 [[ -d "${r[uri]}/" ]] && pwd="${r[uri]}" || pwd=$(dirname "${r[uri]}")
 
-if [[ $NCAT_LOCAL_PORT == '' ]]; then
+if [[ ${headers["x-forwarded-for"]} ]]; then
+    r[proto]='http'
+    r[ip]="${headers["x-forwarded-for"]}"
+elif [[ -z "$NCAT_LOCAL_PORT" ]]; then
 	r[proto]='http'
 	r[ip]="NCAT_IS_BORK"
 else

From 3c8f848a9a445c0ec467f6ec691840660f741453 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 5 Oct 2024 03:15:58 +0200
Subject: [PATCH 071/112] proxy: remove

While a proxy function is useful, this implementation was unsalvageable.
---
 config/master_example.sh |  4 ----
 http.sh                  |  4 ----
 src/response/proxy.sh    | 22 ----------------------
 src/server.sh            |  6 ------
 4 files changed, 36 deletions(-)
 delete mode 100755 src/response/proxy.sh

diff --git a/config/master_example.sh b/config/master_example.sh
index e080e14..82e2e57 100644
--- a/config/master_example.sh
+++ b/config/master_example.sh
@@ -30,10 +30,6 @@ cfg[python_enabled]=false # enable Python script evalutaion (requires Python)
 
 cfg[log]='log' # filename
 
-# proxy functionality is very WiP
-cfg[proxy]=false
-cfg[proxy_url]='http://example.com/'
-
 # mail handler config
 cfg[mail]=""
 cfg[mail_server]=""
diff --git a/http.sh b/http.sh
index 82aafd3..24034bc 100755
--- a/http.sh
+++ b/http.sh
@@ -41,10 +41,6 @@ cfg[python_enabled]=false # enable Python script evalutaion (requires Python)
 
 cfg[log]='log' # filename
 
-cfg[proxy]=false # you probably want to configure this per-url
-cfg[proxy_url]='' # regexp matching valid URLs to proxy
-cfg[proxy_param]='url' # /proxy?url=...
-
 # mail handler config
 cfg[mail]=""
 cfg[mail_server]=""
diff --git a/src/response/proxy.sh b/src/response/proxy.sh
deleted file mode 100755
index 1ee601b..0000000
--- a/src/response/proxy.sh
+++ /dev/null
@@ -1,22 +0,0 @@
-#!/usr/bin/env bash
-url="$(url_decode "$(url_decode "$(sed -E 's/\?/��Lun4_iS_CuTe�/;s/^(.*)��Lun4_iS_CuTe�//;s/'"${cfg[proxy_param]}"'=//g' <<< "${r[url]}")")")"
-
-if [[ $(grep -Poh "${cfg[proxy_url]}" <<< "$url") == '' ]]; then
-	exit 1
-fi
-
-host="$(sed -E 's@http(s|)://@@;s@/.*@@' <<< "$url")"
-proxy_url="$(sed -E 's/\?.*//g' <<< "${r[url]}")"
-headers="$(tr '\r' '\n' <<< "${r[req_headers]}")"
-headers+=$'\n'
-#params=()
-
-while read line; do
-	if [[ "$line" != "GET"* && "$line" != "Host:"* && "$line" != '' ]]; then
-		args+=('-H')
-		args+=("$line")
-	fi
-done <<< "$headers"
-
-curl --http1.1 "$url" "${args[@]}" -D /dev/stdout | grep -aiv "Transfer-Encoding: chunked" | sed -E '/Location/s/\?/%3f/g;/Location/s/\&/%26/g;/Location/s/\:/%3a/g;/Location/s@/@%2f@g;s@Location%3a @Location: '"$proxy_url"'?'"${cfg[proxy_param]}"'=@'
-
diff --git a/src/server.sh b/src/server.sh
index 10ee0ef..17c76a9 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -215,10 +215,6 @@ if [[ "${cfg[auth_required]}" == true && "${r[authorized]}" != true ]]; then
 	r[status]=401
 fi
 
-if [[ "${cfg[proxy]}" == true ]]; then
-	r[status]=211
-fi
-
 if [[ "${r[post]}" == true ]] && [[ "${r[status]}" == 200 ||  "${r[status]}" == 212 ]]; then
 	# This whole ordeal is here to prevent passing binary data as a variable.
 	# I could have done it as an array, but this solution works, and it's
@@ -269,8 +265,6 @@ fi
 
 if [[ ${r[status]} == 210 && ${cfg[autoindex]} == true ]]; then
 	source "src/response/listing.sh"
-elif [[ ${r[status]} == 211 ]]; then
-	source "src/response/proxy.sh"
 elif [[ ${r[status]} == 200 || ${r[status]} == 212 ]]; then
 	source "src/response/200.sh"
 elif [[ ${r[status]} == 401 ]]; then

From 56d2af2cd82bf7f5e4a1725ad1d222dad940c7a0 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sat, 5 Oct 2024 04:30:19 +0200
Subject: [PATCH 072/112] tests: more header parsing tests

---
 src/server.sh          |   4 +-
 tests/01-http-basic.sh | 146 +++++++++++++++++++++++++++++++++++------
 2 files changed, 129 insertions(+), 21 deletions(-)

diff --git a/src/server.sh b/src/server.sh
index 17c76a9..8216ef0 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -62,6 +62,7 @@ IFS=$'\n'
 # continue with reading the headers
 while read -r param; do
 	[[ "$param" == $'\r' ]] && break
+	[[ "$param" != *":"* ]] && exit 1 # TODO: throw 400
 
     IFS=':'
     read -ra header_pair <<< "$param"
@@ -72,9 +73,8 @@ while read -r param; do
     header_value="${header_pair[@]:1}"
     header_value="${header_value##*( )}" # Trim leading whitespace...
     headers["${header_key}"]="${header_value%%*( )*($'\r')}" # ...and trailing whitespace and \r
-
-	unset IFS
 done
+unset IFS
 
 r[content_length]="${headers["content-length"]}"
 r[user_agent]="${headers["user-agent"]}"
diff --git a/tests/01-http-basic.sh b/tests/01-http-basic.sh
index 68a73c0..04722bf 100644
--- a/tests/01-http-basic.sh
+++ b/tests/01-http-basic.sh
@@ -1,24 +1,12 @@
 #!/bin/bash
 
-test_server_header() {
-	tst() {
-		curl -s -I localhost:1337
-	}
-
-	match_sub="HTTP.sh"
-}
-
-test_server_output() {
+server_output() {
 	prepare() {
 		cat <<"EOF" > app/webroot/meow.shs
 #!/bin/bash
 echo meow
 EOF
 	}
-	
-	cleanup() {
-		rm app/webroot/meow.shs
-	}
 
 	tst() {
 		curl -s localhost:1337/meow.shs
@@ -27,7 +15,7 @@ EOF
 	match="meow"
 }
 
-test_server_get_param() {
+server_get_param() {
 	prepare() {
 		cat <<"EOF" > app/webroot/meow.shs
 #!/bin/bash
@@ -42,7 +30,22 @@ EOF
 	match="nyaa"
 }
 
-test_server_post_param() {
+server_get_random() {
+	prepare() {
+		cat <<"EOF" > app/webroot/meow.shs
+#!/bin/bash
+echo "${get_data[meow]}"
+EOF
+	}
+
+	tst() {
+		curl -s "localhost:1337/meow.shs?meow=nyaa"
+	}
+
+	match="nyaa"
+}
+
+server_post_param() {
 	prepare() {
 		cat <<"EOF" > app/webroot/meow.shs
 #!/bin/bash
@@ -57,10 +60,115 @@ EOF
 	match="nyaa"
 }
 
+server_res_header() {
+	tst() {
+		curl -s -I localhost:1337
+	}
+
+	match_sub="HTTP.sh"
+}
+
+server_res_header_custom() {
+	prepare() {
+		cat <<"EOF" > app/webroot/meow.shs
+#!/bin/bash
+header "meow: a custom header!"
+EOF
+	}
+
+	tst() {
+		curl -s -v localhost:1337/meow.shs 2>&1
+	}
+
+	match_sub="a custom header!"
+}
+
+server_req_header() {
+	prepare() {
+		cat <<"EOF" > app/webroot/meow.shs
+#!/bin/bash
+echo "${headers[meow]}"
+EOF
+	}
+	
+	tst() {
+		curl -s "localhost:1337/meow.shs" -H 'meow: nyaa'
+	}
+
+	match="nyaa"
+}
+
+server_req_header_case() {
+	tst() {
+		curl -s "localhost:1337/meow.shs" -H 'Meow: nyaa'
+	}
+
+	match="nyaa"
+}
+
+server_req_header_dup() {
+	tst() {
+		curl -s "localhost:1337/meow.shs" -H 'Meow: nyaa' -H 'mEow: asdf'
+	}
+	# TODO: maybe we should return 400 when we detect sth like this?
+
+	match="asdf"
+}
+
+server_req_header_invalid() {
+	tst() {
+		# we have to trick curl into sending an invalid header for us
+		curl -s "localhost:1337/meow.shs" -H $'a:\nasdf asdf asdf asdf' -H "meow: asdf"
+	}
+
+	match_not="asdf"
+}
+
+server_req_header_special_value() {
+	rand="$(cat /dev/urandom | cut -c 1-10 | head -n1 | sed -E 's/[\r\0]//')"
+
+	tst() {
+		# this needs some more polish, we sometimes confuse curl xD
+		curl -s "localhost:1337/meow.shs" -H "meow: $rand"
+	}
+
+	match="$rand"
+}
+
+server_req_header_special_name() {
+	rand="$(cat /dev/urandom | cut -c 1-10 | head -n1 | sed -E 's/[\r\0]//')"
+	prepare() {
+		cat <<EOF > app/webroot/meow.shs
+#!/bin/bash
+rand="\$(xxd -p -r <<< "$(echo "$rand" | xxd -p)")"
+echo "\${headers["\${rand,,}"]}" # normalize to lowercase
+EOF
+	}
+	
+	tst() {
+		curl -s "localhost:1337/meow.shs" -H "$rand: nyaa"
+	}
+
+	cleanup() {
+		# *sigh* we need a better way to do this tbh
+		rm app/webroot/meow.shs
+	}
+
+	match="nyaa"
+}
 
 subtest_list=(
-	test_server_header
-	test_server_output
-	test_server_get_param
-	test_server_post_param
+	server_output
+	server_get_param
+	server_post_param
+
+	server_res_header
+	server_res_header_custom
+
+	server_req_header
+	server_req_header_case
+	server_req_header_dup
+	server_req_header_invalid
+	server_req_header_special_value
+	server_req_header_special_name
 )

From 951517b30ddd6be5b2b3282c251d74fd94d1e804 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Mon, 7 Oct 2024 17:58:15 +0200
Subject: [PATCH 073/112] *: better versioning, split off various resources
 into .resources/

---
 .resources/README.md                          |   5 +
 .resources/config.sh                          |   5 +
 .resources/example_webroot/index.shs          |  15 ++
 .resources/example_worker/worker.sh           |   2 +
 .../primary_config.sh                         |  13 +-
 .resources/routes.sh                          |  14 ++
 config/localhost                              |   1 -
 docs/running.md                               |  10 +-
 http.sh                                       | 173 ++++++------------
 src/server.sh                                 |   1 +
 src/version.sh                                |   2 +
 11 files changed, 109 insertions(+), 132 deletions(-)
 create mode 100644 .resources/README.md
 create mode 100644 .resources/config.sh
 create mode 100644 .resources/example_webroot/index.shs
 create mode 100755 .resources/example_worker/worker.sh
 rename config/master_example.sh => .resources/primary_config.sh (70%)
 create mode 100644 .resources/routes.sh
 delete mode 100644 config/localhost
 create mode 100644 src/version.sh

diff --git a/.resources/README.md b/.resources/README.md
new file mode 100644
index 0000000..9b4e27e
--- /dev/null
+++ b/.resources/README.md
@@ -0,0 +1,5 @@
+# .resources
+
+this directory contains internal "template" files, copied by HTTP.sh during first run/init.
+
+editing them directly here won't do much :p
diff --git a/.resources/config.sh b/.resources/config.sh
new file mode 100644
index 0000000..ac7d28d
--- /dev/null
+++ b/.resources/config.sh
@@ -0,0 +1,5 @@
+## app config
+## your application-specific config goes here!
+
+# worker_add example 5
+cfg[enable_multipart]=false # by default, uploading files is disabled
diff --git a/.resources/example_webroot/index.shs b/.resources/example_webroot/index.shs
new file mode 100644
index 0000000..86f6829
--- /dev/null
+++ b/.resources/example_webroot/index.shs
@@ -0,0 +1,15 @@
+#!/usr/bin/env bash
+source templates/head.sh
+echo "<h1>Hello from HTTP.sh!</h1><br>To get started with your app, check out $(pwd)/${cfg[namespace]}/
+	 <ul><li>$(pwd)/${cfg[namespace]}/${cfg[root]} - your (public) files go here</li>
+	 <li>$(pwd)/${cfg[namespace]}/workers/ - worker directory, with an example one ready to go</li>
+	 <li>$(pwd)/${cfg[namespace]}/views/ - individual views can be stored there, to be later referenced by routes.sh</li>
+	 <li>$(pwd)/${cfg[namespace]}/templates/ - template files live over there</li>
+	 <li>$(pwd)/${cfg[namespace]}/config.sh - config for everything specific to your app AND workers</li>
+	 <li>$(pwd)/${cfg[namespace]}/routes.sh - config for the HTTP.sh router</li></ul>
+	 Fun things outside of the app directory:
+	 <ul><li>$(pwd)/config/master.sh - master server config</li>
+	 <li>$(pwd)/config/<hostname> - config loaded if a request is made to a specific hostname</li>
+	 <li>$(pwd)/storage/ - directory for storing all and any data your app may produce</li>
+	 <li>$(pwd)/secret/ - user accounts and other secret tokens live here</li>
+	 <li>$(pwd)/src/ - HTTP.sh src, feel free to poke around ;P</li></ul>"
diff --git a/.resources/example_worker/worker.sh b/.resources/example_worker/worker.sh
new file mode 100755
index 0000000..adfdc37
--- /dev/null
+++ b/.resources/example_worker/worker.sh
@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+date
diff --git a/config/master_example.sh b/.resources/primary_config.sh
similarity index 70%
rename from config/master_example.sh
rename to .resources/primary_config.sh
index 82e2e57..932db29 100644
--- a/config/master_example.sh
+++ b/.resources/primary_config.sh
@@ -1,6 +1,6 @@
 declare -A cfg
 
-cfg[ip]=127.0.0.1 # IP address to bind to - use 0.0.0.0 to bind to all
+cfg[ip]=[::] # IP address to bind to - use [::] to bind to all
 
 cfg[http]=true # enables/disables listening on HTTP
 cfg[port]=1337 # HTTP port
@@ -13,7 +13,7 @@ cfg[index]='index.shs'
 cfg[autoindex]=true
 
 cfg[auth_required]=false
-cfg[auth_realm]="Laura is cute <3"
+cfg[auth_realm]="asdf"
 
 cfg[ssl]=false # enables/disables listening on HTTPS
 cfg[ssl_port]=8443
@@ -21,9 +21,9 @@ cfg[ssl_cert]=''
 cfg[ssl_key]=''
 
 cfg[extension]='shs'
-cfg[extra_headers]='server: HTTP.sh/0.96 (devel)'
+cfg[extra_headers]="server: HTTP.sh/$HTTPSH_VERSION (devel)"
 
-cfg[title]='HTTP.sh 0.96'
+cfg[title]="HTTP.sh $HTTPSH_VERSION"
 
 cfg[php_enabled]=false # enable PHP script evalutaion (requires PHP)
 cfg[python_enabled]=false # enable Python script evalutaion (requires Python)
@@ -36,3 +36,8 @@ cfg[mail_server]=""
 cfg[mail_password]=""
 cfg[mail_ssl]=true
 cfg[mail_ignore_bad_cert]=false
+
+# unset for legacy sha256sum hashing (not recommended)
+cfg[hash]="argon2id"
+
+cfg[cookie_path]="/"
diff --git a/.resources/routes.sh b/.resources/routes.sh
new file mode 100644
index 0000000..0805d0e
--- /dev/null
+++ b/.resources/routes.sh
@@ -0,0 +1,14 @@
+## routes - application-specific routes
+##
+## HTTP.sh supports both serving files using a directory structure (webroot),
+## and using routes. The latter may come in handy if you want to create nicer
+## paths, e.g.
+##
+## (webroot) https://example.com/profile.shs?name=asdf
+## ... may become ...
+## (routes)  https://example.com/profile/asdf
+##
+## To set up routes, define rules in this file (see below for examples)
+
+# router "/test" "app/views/test.shs"
+# router "/profile/:user" "app/views/user.shs"
diff --git a/config/localhost b/config/localhost
deleted file mode 100644
index 9aa52e1..0000000
--- a/config/localhost
+++ /dev/null
@@ -1 +0,0 @@
-cfg[title]='Laura is cute :3'
diff --git a/docs/running.md b/docs/running.md
index c8c8931..f6df44b 100644
--- a/docs/running.md
+++ b/docs/running.md
@@ -2,10 +2,10 @@
 
 ## cli args
 
-The only args checked are `$1`.
+The arg parsing is a bit rudimentary atm. Assume only one option supported per invocation.
 
-- `init` create an app skeleton
-- `debug` show stderr
-- `debuggier` show stderr and calltrace
+- `init` creates an app skeleton and writes example config. Optional second parameter sets the
+  namespace (app directory) name.
+- `debug` shows stderr (useful for debugging)
+- `debuggier` shows stderr and calltrace 
 - `shell` drops you into an environment practically equivalent to the runtime
-
diff --git a/http.sh b/http.sh
index 24034bc..40ec629 100755
--- a/http.sh
+++ b/http.sh
@@ -6,60 +6,47 @@ ctrl_c() {
 	echo -e "Cleaned up, exitting.\nHave an awesome day!!"
 }
 
-if [[ ! -f "config/master.sh" ]]; then
-	mkdir -p config
-	cat <<EOF > "config/master.sh"
-declare -A cfg
-
-cfg[ip]=[::] # IP address to bind to - use [::] to bind to all
-
-cfg[http]=true # enables/disables listening on HTTP
-cfg[port]=1337 # HTTP port
-cfg[socat_only]=false
-
-cfg[namespace]='app'
-
-cfg[root]='webroot/' 
-cfg[index]='index.shs'
-cfg[autoindex]=true
-
-cfg[auth_required]=false
-cfg[auth_realm]="asdf"
-
-cfg[ssl]=false # enables/disables listening on HTTPS
-cfg[ssl_port]=8443
-cfg[ssl_cert]=''
-cfg[ssl_key]=''
-
-cfg[extension]='shs'
-cfg[extra_headers]='server: HTTP.sh/0.96 (devel)'
-
-cfg[title]='HTTP.sh 0.96'
-
-cfg[php_enabled]=false # enable PHP script evalutaion (requires PHP)
-cfg[python_enabled]=false # enable Python script evalutaion (requires Python)
-
-cfg[log]='log' # filename
-
-# mail handler config
-cfg[mail]=""
-cfg[mail_server]=""
-cfg[mail_password]=""
-cfg[mail_ssl]=true
-cfg[mail_ignore_bad_cert]=false
-
-# unset for legacy sha256sum hashing (not recommended)
-cfg[hash]="argon2id"
-
-cfg[cookie_path]="/"
-EOF
+if [[ ! -f "$PWD/http.sh" ]]; then
+		echo -e "Please run HTTP.sh inside its designated directory\nRunning the script from arbitrary locations isn't supported."
+		exit 1
 fi
+source src/version.sh
 
+if [[ "$1" == "init" ]]; then # will get replaced with proper parameter parsing in 1.0
+	[[ ! "$2" ]] && namespace=app || namespace="$2"
+
+	if [[ ! -f "config/master.sh" ]]; then
+		mkdir -p config
+		cp ".resources/primary_config.sh" "config/master.sh"
+		echo "cfg[namespace]=$namespace # default namespace" >> "config/master.sh"
+		echo "cfg[init_version]=$HTTPSH_VERSION" >> "config/master.sh"
+	elif [[ -d "$namespace" ]]; then
+		echo -e "ERR: HTTP.sh has been initialized before.\nSpecify a new namespace directory, or perish (remove '$namespace'?)"
+		exit 1
+	else
+		echo "WARN: HTTP.sh has been initialized before. Continuing w/o recreating config."
+	fi
+	source config/master.sh
+	
+	mkdir -p "${cfg[namespace]}/${cfg[root]}" "${cfg[namespace]}/workers/example" "${cfg[namespace]}/views" "${cfg[namespace]}/templates"
+	touch "${cfg[namespace]}/config.sh" "${cfg[namespace]}/workers/example/control"
+	cp ".resources/config.sh" "${cfg[namespace]}/config.sh"
+	cp ".resources/routes.sh" "${cfg[namespace]}/routes.sh"
+
+	cp .resources/example_worker/* "${cfg[namespace]}/workers/example/"
+	cp .resources/example_webroot/* "${cfg[namespace]}/${cfg[root]}/index.shs"
+	
+	echo -e "Success..?\nTry running \`./http.sh\` now"
+	exit 0
+
+elif [[ ! -f "config/master.sh" ]]; then
+	echo "ERR: Initialize HTTP.sh first! run './http.sh init'"
+	exit 1
+fi
 source config/master.sh
 
-if [[ ! -f "$PWD/http.sh" ]]; then
-		echo -e "Please run HTTP.sh inside it's designated directory\nRunning the script from arbitrary locations isn't supported."
-		exit 1
+if [[ "$HTTPSH_VERSION" != "${cfg[init_version]}" ]]; then
+	echo "WARN: HTTP.sh was updated since this instance was initialized (config v${cfg[init_version]:-(none)}, runtime v$HTTPSH_VERSION). There may be breaking changes. Edit cfg[init_version] in config/master.sh to remove this warning."
 fi	
 
 while read i; do
@@ -74,6 +61,18 @@ while read i; do
 	[[ $? != 0 ]] && echo "WARNING: can't find $i"
 done < src/dependencies.optional
 
+if ! which ncat > /dev/null 2>&1; then
+	if [[ ${cfg[socat_only]} != true ]]; then
+		echo "ERR: can't find ncat, and cfg[socat_only] is not set to true"
+		error=true
+	fi
+fi
+
+if [[ $error == true ]]; then
+	echo "Fix above dependencies, and I might just let you pass."
+	exit 1
+fi
+
 if [[ "$1" == 'shell' ]]; then
 	bash --rcfile <(echo '
 	shopt -s extglob
@@ -90,83 +89,13 @@ if [[ "$1" == 'shell' ]]; then
 	exit 0
 fi
 
-if ! which ncat > /dev/null 2>&1; then
-	if [[ ${cfg[socat_only]} != true ]]; then
-		echo "ERROR: can't find ncat, and cfg[socat_only] is not set to true"
-		error=true
-	fi
-fi
-
-if [[ $error == true ]]; then
-	echo "Fix above dependencies, and I might just let you pass."
-	exit 0
-fi
-
-if [[ $1 == "init" ]]; then # will get replaced with proper parameter parsing in 1.0
-	#set -e
-	
-	mkdir -p "${cfg[namespace]}/${cfg[root]}" "${cfg[namespace]}/workers/example" "${cfg[namespace]}/views" "${cfg[namespace]}/templates"
-	touch "${cfg[namespace]}/config.sh" "${cfg[namespace]}/workers/example/control"
-	cat <<EOF > "${cfg[namespace]}/config.sh"
-## app config
-## your application-specific config goes here!
-
-# worker_add example 5
-cfg[enable_multipart]=false # by default, uploading files is disabled
-EOF
-
-	cat <<EOF > "${cfg[namespace]}/workers/example/worker.sh"
-#!/usr/bin/env bash
-date
-EOF
-
-	cat <<EOF > "${cfg[namespace]}/${cfg[root]}/index.shs"
-#!/usr/bin/env bash
-source templates/head.sh
-echo "<h1>Hello from HTTP.sh!</h1><br>To get started with your app, check out $(pwd)/${cfg[namespace]}/
-	 <ul><li>$(pwd)/${cfg[namespace]}/${cfg[root]} - your (public) files go here</li>
-	 <li>$(pwd)/${cfg[namespace]}/workers/ - worker directory, with an example one ready to go</li>
-	 <li>$(pwd)/${cfg[namespace]}/views/ - individual views can be stored there, to be later referenced by routes.sh</li>
-	 <li>$(pwd)/${cfg[namespace]}/templates/ - template files (.t) live over there</li>
-	 <li>$(pwd)/${cfg[namespace]}/config.sh - config for everything specific to your app AND workers</li>
-	 <li>$(pwd)/${cfg[namespace]}/routes.sh - config for the HTTP.sh router</li></ul>
-	 Fun things outside of the app directory:
-	 <ul><li>$(pwd)/config/master.sh - master server config</li>
-	 <li>$(pwd)/config/<hostname> - config loaded if a request is made to a specific hostname</li>
-	 <li>$(pwd)/storage/ - directory for storing all and any data your app may produce</li>
-	 <li>$(pwd)/secret/ - user accounts and other secret tokens live here</li>
-	 <li>$(pwd)/src/ - HTTP.sh src, feel free to poke around ;P</li></ul>"
-EOF
-	cat <<EOF > "${cfg[namespace]}/routes.sh"
-## routes - application-specific routes
-##
-## HTTP.sh supports both serving files using a directory structure (webroot),
-## and using routes. The latter may come in handy if you want to create nicer
-## paths, e.g.
-##
-## (webroot) https://example.com/profile.shs?name=asdf
-## ... may become ...
-## (routes)  https://example.com/profile/asdf
-##
-## To set up routes, define rules in this file (see below for examples)
-
-# router "/test" "app/views/test.shs"
-# router "/profile/:user" "app/views/user.shs"
-EOF
-
-	chmod +x "${cfg[namespace]}/workers/example/worker.sh"
-	
-	echo -e "Success..?\nTry running \`./http.sh\` now"
-	exit 0
-fi
-
 cat <<EOF >&2
  _    _ _______ _______ _____  ______ _    _ 
 | |  | |_______|_______|  _  \/  ___/| |  | |
 | |__| |  | |     | |  | |_| | |___  | |__| |
 | |__| |  | |     | |  |  ___/\___ \ | |__| |
 | |  | |  | |     | |  | |     ___\ \| |  | |
-|_|  |_|  |_|     |_|  |_|  □ /_____/|_|  |_|
+|_|  |_|  |_|     |_|  |_|  □ /_____/|_|  |_| v$HTTPSH_VERSION
 EOF
 
 if [[ "$1" == "debug" ]]; then
@@ -194,7 +123,7 @@ if [[ ${cfg[socat_only]} == true ]]; then
 	else
 		socat tcp-listen:${cfg[port]},bind=${cfg[ip]},fork "exec:bash -c src/server.sh" 2>> /dev/null
 		if [[ $? != 0 ]]; then
-			echo "[WARN] socat exitted with a non-zero status; Maybe the port is in use?"
+			echo "[WARN] socat quit with a non-zero status; Maybe the port is in use?"
 		fi
 	fi
 else
diff --git a/src/server.sh b/src/server.sh
index 8216ef0..b42f469 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -6,6 +6,7 @@ if [[ "$1" == true ]]; then
 fi
 shopt -s extglob
 
+source src/version.sh
 source config/master.sh
 source src/mime.sh
 source src/misc.sh
diff --git a/src/version.sh b/src/version.sh
new file mode 100644
index 0000000..fb5aaae
--- /dev/null
+++ b/src/version.sh
@@ -0,0 +1,2 @@
+#!/usr/bin/env bash
+HTTPSH_VERSION=0.97

From da54143a3f15afe59b1eced8645e323a5ca29ee9 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Mon, 7 Oct 2024 18:09:17 +0200
Subject: [PATCH 074/112] server: remove PHP/Python execution handlers, to be
 replaced with CGI

---
 .resources/primary_config.sh |  4 +---
 src/response/200.sh          | 16 +---------------
 2 files changed, 2 insertions(+), 18 deletions(-)

diff --git a/.resources/primary_config.sh b/.resources/primary_config.sh
index 932db29..e477c71 100644
--- a/.resources/primary_config.sh
+++ b/.resources/primary_config.sh
@@ -21,13 +21,11 @@ cfg[ssl_cert]=''
 cfg[ssl_key]=''
 
 cfg[extension]='shs'
+#cfg[encoding]='UTF-8' # UTF-8 by default, used by iconv
 cfg[extra_headers]="server: HTTP.sh/$HTTPSH_VERSION (devel)"
 
 cfg[title]="HTTP.sh $HTTPSH_VERSION"
 
-cfg[php_enabled]=false # enable PHP script evalutaion (requires PHP)
-cfg[python_enabled]=false # enable Python script evalutaion (requires Python)
-
 cfg[log]='log' # filename
 
 # mail handler config
diff --git a/src/response/200.sh b/src/response/200.sh
index d689ed5..ccdebae 100755
--- a/src/response/200.sh
+++ b/src/response/200.sh
@@ -40,26 +40,12 @@ if [[ ${r[status]} == 212 ]]; then
 		cat $temp
 		rm $temp
 	fi
-	
-elif [[ "${cfg[php_enabled]}" == true && "${r[uri]}" =~ ".php" ]]; then
-	temp=$(mktemp)
-	php "${r[uri]}" "$(get_dump)" "$(post_dump)" > $temp
-	__headers
-	cat $temp
-	rm $temp
-
-elif [[ "${cfg[python_enabled]}" == true && "${r[uri]}" =~ ".py" ]]; then
-	temp=$(mktemp)
-	python "${r[uri]}" "$(get_dump)" "$(post_dump)" > $temp
-	__headers
-	cat $temp
-	rm $temp
 
 elif [[ "${r[uri]}" =~ \.${cfg[extension]}$ ]]; then
 	temp=$(mktemp)
 	source "${r[uri]}" > $temp
 	__headers
-	if [[ "${cfg[encoding]}" != '' ]]; then
+	if [[ "${cfg[encoding]}" ]]; then
 		iconv $temp -f UTF-8 -t "${cfg[encoding]}"
 	else
 		cat $temp

From 126de1e39698611f5cdda680dfea9daa6aef938b Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 11 Oct 2024 20:41:37 +0200
Subject: [PATCH 075/112] main: fix edge case with cloned app repo

---
 http.sh | 22 ++++++++++++++++------
 1 file changed, 16 insertions(+), 6 deletions(-)

diff --git a/http.sh b/http.sh
index 40ec629..83f7ef5 100755
--- a/http.sh
+++ b/http.sh
@@ -6,6 +6,15 @@ ctrl_c() {
 	echo -e "Cleaned up, exitting.\nHave an awesome day!!"
 }
 
+setup_config() {
+	[[ ! "$1" ]] && namespace=app || namespace="$1"
+
+	mkdir -p config
+	cp ".resources/primary_config.sh" "config/master.sh"
+	echo "cfg[namespace]=$namespace # default namespace" >> "config/master.sh"
+	echo "cfg[init_version]=$HTTPSH_VERSION" >> "config/master.sh"
+}
+
 if [[ ! -f "$PWD/http.sh" ]]; then
 		echo -e "Please run HTTP.sh inside its designated directory\nRunning the script from arbitrary locations isn't supported."
 		exit 1
@@ -16,10 +25,7 @@ if [[ "$1" == "init" ]]; then # will get replaced with proper parameter parsing
 	[[ ! "$2" ]] && namespace=app || namespace="$2"
 
 	if [[ ! -f "config/master.sh" ]]; then
-		mkdir -p config
-		cp ".resources/primary_config.sh" "config/master.sh"
-		echo "cfg[namespace]=$namespace # default namespace" >> "config/master.sh"
-		echo "cfg[init_version]=$HTTPSH_VERSION" >> "config/master.sh"
+		setup_config
 	elif [[ -d "$namespace" ]]; then
 		echo -e "ERR: HTTP.sh has been initialized before.\nSpecify a new namespace directory, or perish (remove '$namespace'?)"
 		exit 1
@@ -40,8 +46,12 @@ if [[ "$1" == "init" ]]; then # will get replaced with proper parameter parsing
 	exit 0
 
 elif [[ ! -f "config/master.sh" ]]; then
-	echo "ERR: Initialize HTTP.sh first! run './http.sh init'"
-	exit 1
+	if [[ -d "app" ]]; then # if the de-facto default app dir already exists, copy the cfg
+		setup_config
+	else
+		echo "ERR: Initialize HTTP.sh first! run './http.sh init'"
+		exit 1
+	fi
 fi
 source config/master.sh
 

From 3d8dd9879e7fca7c9c0fe85843358302f1a117c6 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Tue, 22 Oct 2024 16:33:02 +0100
Subject: [PATCH 076/112] server: url_decode all GET params, (we don't care
 about binary data there)

---
 src/server.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/server.sh b/src/server.sh
index b42f469..68013d1 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -48,7 +48,7 @@ if [[ "${param,,}" =~ ^(get|post|patch|put|delete|meow) ]]; then # TODO: OPTIONS
 			name="${i%%=*}"
 			if [[ "$name" ]]; then
 				value="${i#*=}"
-				get_data[$name]="$value"
+				get_data[$name]="$(url_decode "$value")"
 			fi
 		done <<< "${r[url]#*\?}&"
 	fi

From c943b7897eaec1c195bbd69a0e4ae9d27580e137 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 1 Dec 2024 22:39:30 +0100
Subject: [PATCH 077/112] template: prevent expansion on keys (which shouldn't
 happen anyways)

---
 src/template.sh | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/template.sh b/src/template.sh
index af38357..80702cc 100755
--- a/src/template.sh
+++ b/src/template.sh
@@ -21,7 +21,7 @@ function render() {
 
 			echo 's'$'\02''\{\{start '"$key"'\}\}.*\{\{end '"$key"'\}\}'$'\02''\{\{'"$key"'\}\}'$'\02'';' >> "$tmp"
 
-			local -n asdf=${ref[$key]}
+			local -n asdf=${ref["$key"]}
 			local j
 			local value=''
 			for j in ${!asdf[@]}; do
@@ -33,8 +33,8 @@ function render() {
 
 			echo 's'$'\02''\{\{'"$key"'\}\}'$'\02'''"$value"''$'\02'';' >> "$tmp"
 			rm "$subtemplate"
-		elif [[ "$key" == "@"* && "${ref[$key]}" != '' ]]; then
-			local value="$(sed -E 's/\&/�UwU�/g' <<< "${ref[$key]}")"
+		elif [[ "$key" == "@"* && "${ref["$key"]}" != '' ]]; then
+			local value="$(sed -E 's/\&/�UwU�/g' <<< "${ref["$key"]}")"
 			echo 's'$'\02''\{\{\'"$key"'\}\}'$'\02'''"$value"''$'\02''g;' >> "$tmp" #'
 		elif [[ "$key" == '?'* ]]; then
 			local _key="\\?${key/?/}"
@@ -50,12 +50,12 @@ function render() {
 			cat <<< $(cat "$subtemplate" "$tmp") > "$tmp" # call that cat abuse
 
 			rm "$subtemplate"
-		elif [[ "${ref[$key]}" != "" ]]; then
-			echo "VALUE: ${ref[$key]}" > /dev/stderr
+		elif [[ "${ref["$key"]}" != "" ]]; then
+			echo "VALUE: ${ref["$key"]}" > /dev/stderr
 			if [[ "$3" != true ]]; then
-				local value="$(html_encode <<< "${ref[$key]}" | sed -E 's/\&/�UwU�/g')"
+				local value="$(html_encode <<< "${ref["$key"]}" | sed -E 's/\&/�UwU�/g')"
 			else
-				local value="$(echo -n "${ref[$key]}" | tr -d $'\01'$'\02' | tr $'\n' $'\01' | sed -E 's/\\\\/�OwO�/g;s/\\//g;s/�OwO�/\\/g' | html_encode | sed -E 's/\&/�UwU�/g')"
+				local value="$(echo -n "${ref["$key"]}" | tr -d $'\01'$'\02' | tr $'\n' $'\01' | sed -E 's/\\\\/�OwO�/g;s/\\//g;s/�OwO�/\\/g' | html_encode | sed -E 's/\&/�UwU�/g')"
 			fi
 			echo 's'$'\02''\{\{\.'"$key"'\}\}'$'\02'''"$value"''$'\02''g;' >> "$tmp"
 		else
@@ -105,14 +105,14 @@ function render_unsafe() {
 	for key in ${!ref[@]}; do
 		if [[ "$key" == "_"* ]]; then # iter mode
 			# grep "start _test" -A99999 | grep "end _test" -B99999
-			local -n item_array=${ref[$key]}
+			local -n item_array=${ref["$key"]}
 			local value
 			for ((_i = 0; _i < ${#item_array[@]}; _i++)); do
 				value+="$(xxd -p <<< "${item_array[$_i]}" | tr -d '\n' | sed -E 's/../\\x&/g')"
 			done
 			echo 's/\{\{'"$key"'\}\}/'"$value"'/g' >> "$tmp"
 		else
-			local value="$(xxd -p <<< "${ref[$key]}" | tr -d '\n' | sed -E 's/../\\x&/g')"
+			local value="$(xxd -p <<< "${ref["$key"]}" | tr -d '\n' | sed -E 's/../\\x&/g')"
 			echo 's/\{\{\.'"$key"'\}\}/'"$value"'/g' >> "$tmp"
 		fi
 	done
@@ -136,13 +136,13 @@ function nested_declare() {
 # nested_add(ref, array)
 function nested_add() {
 	local nested_id=$(_nested_random)
-	declare -n nested_ref=$2
+	declare -n nested_ref="$2"
 	declare -g -A _$nested_id
 	
 	# poor man's array copy
 	IFS=' '
 	for k in ${!nested_ref[@]}; do
-		declare -g -A _$nested_id[$k]="${nested_ref[$k]}"
+		declare -g -A _$nested_id["$k"]="${nested_ref["$k"]}"
 	done
 	
 	local -n ref=$1
@@ -152,5 +152,5 @@ function nested_add() {
 # nested_get(ref, i)
 function nested_get() {
 	local -n ref=$1
-	declare -g -n res=_${ref[$2]}
+	declare -g -n res=_${ref["$2"]}
 }

From 403ef2b4eed97fb3124b864ac440e786f30dac32 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 1 Dec 2024 22:51:56 +0100
Subject: [PATCH 078/112] server: normalize a few other things

---
 src/server.sh | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/src/server.sh b/src/server.sh
index 68013d1..2ce9e52 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -77,9 +77,15 @@ while read -r param; do
 done
 unset IFS
 
+# TODO: remove deprecated fields below
+
 r[content_length]="${headers["content-length"]}"
 r[user_agent]="${headers["user-agent"]}"
 r[websocket_key]="${headers["sec-websocket-key"]}"
+r[req_headers]="$headers"
+r[url]="$(url_decode "${r[url]}")" # doing this here for.. reasons
+r[uri]="$(realpath "${cfg[namespace]}/${cfg[root]}$(sed -E 's/\?(.*)$//' <<< "${r[url]}")")"
+[[ -d "${r[uri]}/" ]] && pwd="${r[uri]}" || pwd=$(dirname "${r[uri]}") # dead code
 
 if [[ -n "${headers["content-type"]}" ]]; then
     IFS=';'
@@ -114,6 +120,8 @@ if [[ "${headers["connection"]}" == "upgrade" && "${headers["upgrade"]}" == "web
     r[status]=101
 fi
 
+shopt -u nocasematch
+
 if [[ -n "${headers["authorization"]}" ]]; then
     if [[ "${headers["authorization"],,}" == "basic"* ]]; then
         base64="${headers["authorization"]#[Bb]asic*( )}"
@@ -133,7 +141,7 @@ if [[ -n "${headers["cookie"]}" ]]; then
             value="${cookie_pair##*=}"
             value="${value##*( )}"
             value="${value%%*( )}"
-            cookies[$name]="$value"
+            cookies["$name"]="$value"
         fi
     done <<< "${headers["cookie"]};" # This hack is beyond me, just trust the process
 fi
@@ -142,13 +150,6 @@ if [[ "${headers["range"]}" == "bytes"* ]]; then
     r[range]="${headers["range"]#*=}"
 fi
 
-r[req_headers]="$headers"
-
-r[url]="$(url_decode "${r[url]}")" # doing this here for.. reasons
-
-r[uri]="$(realpath "${cfg[namespace]}/${cfg[root]}$(sed -E 's/\?(.*)$//' <<< "${r[url]}")")"
-[[ -d "${r[uri]}/" ]] && pwd="${r[uri]}" || pwd=$(dirname "${r[uri]}")
-
 if [[ ${headers["x-forwarded-for"]} ]]; then
     r[proto]='http'
     r[ip]="${headers["x-forwarded-for"]}"
@@ -160,8 +161,6 @@ else
 	r[ip]="$NCAT_REMOTE_ADDR:$NCAT_REMOTE_PORT"
 fi
 
-shopt -u nocasematch
-
 echo "$(date) - IP: ${r[ip]}, PROTO: ${r[proto]}, URL: ${r[url]}, GET_data: ${get_data[@]}, POST_data: ${post_data[@]}, POST_multipart: ${post_multipart[@]}, UA: ${r[user_agent]}" >> "${cfg[namespace]}/${cfg[log]}"
 
 [[ -f "${cfg[namespace]}/routes.sh" ]] && source "${cfg[namespace]}/routes.sh"
@@ -189,7 +188,7 @@ if [[ ${r[status]} != 101 ]]; then
 	if [[ ${r[status]} != 212 ]]; then
 		if [[ -a "${r[uri]}" && ! -r "${r[uri]}" ]]; then
 			r[status]=403
-		elif [[ "$(echo -n "${r[uri]}")" != "$(realpath "${cfg[namespace]}/${cfg[root]}")"* ]]; then
+		elif [[ "${r[uri]}" != "$(realpath "${cfg[namespace]}/${cfg[root]}")"* ]]; then
 			r[status]=403
 		elif [[ -f "${r[uri]}" ]]; then
 			r[status]=200
@@ -253,9 +252,8 @@ if [[ "${r[post]}" == true ]] && [[ "${r[status]}" == 200 ||  "${r[status]}" ==
 			while read -r -d'&' i; do
 				name="${i%%=*}"
 				value="${i#*=}"
-				post_data[$name]="$value"
+				post_data[$name]="$(url_decode "$value")"
 				echo post_data[$name]="$value" >/dev/stderr
-
 			done <<< "${data}&"
 		else
 			# this is fine?

From 5ee00c6ead80c2a80a7b14830647584bf74561c7 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 1 Dec 2024 22:52:11 +0100
Subject: [PATCH 079/112] server: fix directory traversal

In select cases, if the attacker asked for an URL not starting with a slash (/),
a directory traversal bug could have been triggered. The attack is limited to
directories within `${cfg[namespace]}` (default: `app`) which begin with
`${cfg[root]}` (default: `webroot`).

This means that an adversary could traverse to `app/webroot*`. We never
encouraged / suggested keeping multiple webroots in one namespace, thus it's
doubtful whether any HTTP.sh deployment met the criteria.
---
 src/server.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/server.sh b/src/server.sh
index 2ce9e52..be68e50 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -84,7 +84,7 @@ r[user_agent]="${headers["user-agent"]}"
 r[websocket_key]="${headers["sec-websocket-key"]}"
 r[req_headers]="$headers"
 r[url]="$(url_decode "${r[url]}")" # doing this here for.. reasons
-r[uri]="$(realpath "${cfg[namespace]}/${cfg[root]}$(sed -E 's/\?(.*)$//' <<< "${r[url]}")")"
+r[uri]="$(realpath "${cfg[namespace]}/${cfg[root]}/$(sed -E 's/\?(.*)$//' <<< "${r[url]}")")"
 [[ -d "${r[uri]}/" ]] && pwd="${r[uri]}" || pwd=$(dirname "${r[uri]}") # dead code
 
 if [[ -n "${headers["content-type"]}" ]]; then

From 60b40019aa2b4129ae7d717fe1bb7a97e4e62482 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Tue, 3 Dec 2024 20:29:10 +0100
Subject: [PATCH 080/112] docs: add info about the router

---
 docs/router.md | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)
 create mode 100644 docs/router.md

diff --git a/docs/router.md b/docs/router.md
new file mode 100644
index 0000000..265e8bd
--- /dev/null
+++ b/docs/router.md
@@ -0,0 +1,36 @@
+# HTTP.sh: URL router
+
+After running `./http.sh init`, your `app` directory should include a file called `routes.sh` - this
+is where you define custom routes. The syntax is as follows:
+
+```
+router "/uri/path" "${cfg[namespace]}/views/file.shs"
+```
+
+This can be used to remap files that are already in `webroot`, but to prevent confusion, it is
+recommended to make a separate directory for routed files. In other HTTP.sh projects, it's usually
+`views`.
+
+The router also can be used to pass parameters:
+
+```
+router "/user/:username" "${cfg[namespace]}/views/profile.shs"
+router "/user/:username/:postid" "${cfg[namespace]}/views/post.shs"
+```
+
+All router parameters are available at runtime through `${params[]}` associative array.
+A sample `profile.shs` could look like this:
+
+```
+#!/bin/bash
+
+echo "$(html_encode "${params[username]}")'s profile"
+```
+
+## Limitations
+
+- The param name can only contain the following characters: `[A-Za-z0-9]`
+- Currently, the param itself can only contain the following characters: `[A-Za-z0-9.,%:\\-_]`;
+  Otherwise, the route won't match, and you'll likely get a 404. Support for other special chars
+  will be added somewhere down the line.
+- Router takes precedence over normal file matching; This could allow one to override a file.

From 1c144612deac515f1fdc98d1b6c45936bdef36e7 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Tue, 3 Dec 2024 23:48:05 +0100
Subject: [PATCH 081/112] server: normalize x-forwarded-for (somewhat)

---
 src/server.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/server.sh b/src/server.sh
index be68e50..beee921 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -152,7 +152,7 @@ fi
 
 if [[ ${headers["x-forwarded-for"]} ]]; then
     r[proto]='http'
-    r[ip]="${headers["x-forwarded-for"]}"
+    r[ip]="${headers["x-forwarded-for"]%%[, ]*}"
 elif [[ -z "$NCAT_LOCAL_PORT" ]]; then
 	r[proto]='http'
 	r[ip]="NCAT_IS_BORK"

From 45dc4285760f7972b3d0cd0439a0e0ba85a459e7 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Thu, 5 Dec 2024 23:50:25 +0100
Subject: [PATCH 082/112] notORM: impl searching for more than one constraint
 in data_get

---
 src/notORM.sh | 54 ++++++++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 49 insertions(+), 5 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index 5c163b4..01a096c 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -59,14 +59,52 @@ data_add() {
 # by default uses the 0th column. override with optional `column`.
 # returns the data to $res. override with optional `res`
 #
-# data_get(store, search, [column], [res]) -> $res / ${!4}
+# 2nd and 3rd arguments can be repeated, given you enclose each pair
+# in curly braces. (e.g. `{ search } { search2 column2 }`)
+#
+# also can be used as `data_get store { } meow` to match all records 
+#
+# data_get(store, {search, [column]}, [res]) -> $res / ${!4}
 data_get() {
 	[[ ! "$2" ]] && return 1
 	[[ ! -f "$1" ]] && return 4
-	local column=${3:-0}
-	local -n ref=${4:-res}
 	local IFS=$'\n'
 
+	local store="$1"
+	local search=()
+	local column=()
+	if [[ "$2" == '{' ]]; then
+		while shift; do # "shebang reference?" ~ mei
+			[[ "$1" != '{' ]] && break # yes, we need to match this twice
+			if [[ "$2" != '}' ]]; then
+				search+=("$2")
+			else # empty search - just match ANY record
+				search+=('')
+				column+=(0)
+				shift 2
+				break
+			fi
+			if [[ "$3" != '}' ]]; then
+				column+=("$3")
+				[[ "$4" != '}' ]] && return 1 # we accept only values in pairs
+				shift 3
+			else
+				column+=(0)
+				shift 2
+				if [[ "$2" != '{' ]]; then
+					shift
+					break
+				fi
+			fi
+		done
+		local -n ref="${1:-res}"
+	else # compat
+		search+=("$2")
+		column+=("${3:-0}")
+		local -n ref=${4:-res}
+	fi
+
+	local line
 	while read line; do
 		IFS=$delim
 		
@@ -75,8 +113,14 @@ data_get() {
 		# objects. expansions be damned
 		local x="${line//$newline/$'\n'}"
 		ref=($x)
-		[[ "${ref[$column]}" == "$2" ]] && return 0
-	done < "$1"
+		local i
+		for (( i=0; i<${#search[@]}; i++ )); do
+			if [[ "${ref[column[i]]}" != "${search[i]}" ]]; then
+				continue 2
+			fi
+		done
+		return 0 # only reached if an entry matched all constraints
+	done < "$store"
 
 	unset ref
 	return 2

From a2daafe89ad58899097067437d96d134a90dbe03 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 6 Dec 2024 01:37:15 +0100
Subject: [PATCH 083/112] notORM: split argv parsing code into an alias

---
 src/notORM.sh | 53 +++++++++++++++++++++++++++++----------------------
 1 file changed, 30 insertions(+), 23 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index 01a096c..20a8d05 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -74,29 +74,7 @@ data_get() {
 	local search=()
 	local column=()
 	if [[ "$2" == '{' ]]; then
-		while shift; do # "shebang reference?" ~ mei
-			[[ "$1" != '{' ]] && break # yes, we need to match this twice
-			if [[ "$2" != '}' ]]; then
-				search+=("$2")
-			else # empty search - just match ANY record
-				search+=('')
-				column+=(0)
-				shift 2
-				break
-			fi
-			if [[ "$3" != '}' ]]; then
-				column+=("$3")
-				[[ "$4" != '}' ]] && return 1 # we accept only values in pairs
-				shift 3
-			else
-				column+=(0)
-				shift 2
-				if [[ "$2" != '{' ]]; then
-					shift
-					break
-				fi
-			fi
-		done
+		_data_parse_pairs
 		local -n ref="${1:-res}"
 	else # compat
 		search+=("$2")
@@ -241,3 +219,32 @@ _trim_control() {
 	tr="${tr//$ctrl}"          # remove 0x03
 	tr="${tr//$'\n'/$newline}" # \n -> 0x02
 }
+
+# internal. parses the `{ }` syntax, starting with 2nd arg.
+# alias, not a function, because we want to modify the argv of the parent
+# _data_parse_pairs(_, { search, column }, [{ search2, column2 }], ...) -> ${search[@]}, ${column[@]}
+alias _data_parse_pairs='
+	while shift; do # "shebang reference?" ~ mei
+		[[ "$1" != "{"" ]] && break # yes, we need to match this twice
+		if [[ "$2" != "}" ]]; then
+			search+=("$2")
+		else # empty search - just match ANY record
+			search+=("")
+			column+=(0)
+			shift 2
+			break
+		fi
+		if [[ "$3" != "}" ]]; then
+			column+=("$3")
+			[[ "$4" != "}" ]] && return 1 # we accept only values in pairs
+			shift 3
+		else
+			column+=(0)
+			shift 2
+			if [[ "$2" != "{" ]]; then
+				shift
+				break
+			fi
+		fi
+	done
+'

From 6d91d057e8d65ddbb17efdcdd5b31102df982f1b Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 6 Dec 2024 03:00:25 +0100
Subject: [PATCH 084/112] notORM: implement new syntax for data_iter + some
 fixes

---
 src/notORM.sh | 99 +++++++++++++++++++++++++++++++--------------------
 1 file changed, 60 insertions(+), 39 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index 20a8d05..f16a511 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -32,6 +32,39 @@ repeat() {
 	[[ "$1" -gt 0 ]] && printf -- "$2%.0s" $(seq 1 $1)
 }
 
+shopt -s expand_aliases
+# internal. parses the `{ }` syntax, starting with 2nd arg.
+# alias, not a function, because we want to modify the argv of the parent
+# _data_parse_pairs(_, { search, column }, [{ search2, column2 }], ...) -> ${search[@]}, ${column[@]}
+alias _data_parse_pairs='
+	local search=()
+	local column=()
+
+	while shift; do # "shebang reference?" ~ mei
+		[[ "$1" != "{" ]] && break # yes, we need to match this twice
+		if [[ "$2" != "}" ]]; then
+			search+=("$2")
+		else # empty search - just match ANY record
+			search+=("")
+			column+=(0)
+			shift 2
+			break
+		fi
+		if [[ "$3" != "}" ]]; then
+			column+=("$3")
+			[[ "$4" != "}" ]] && return 1 # we accept only values in pairs
+			shift 3
+		else
+			column+=(0)
+			shift 2
+			if [[ "$2" != "{" ]]; then
+				shift
+				break
+			fi
+		fi
+	done
+'
+
 # adds a flat `array` to the `store`.
 # a store can be any file, as long as we have r/w access to it and the
 # adjacent directory.
@@ -64,21 +97,20 @@ data_add() {
 #
 # also can be used as `data_get store { } meow` to match all records 
 #
-# data_get(store, {search, [column]}, [res]) -> $res / ${!4}
+# data_get(store, {search, [column]} [{search, [column]}], ... [res]]) -> $res / ${!-1}
+# data_get(store, search, [column], [res]) -> $res / ${!4}
 data_get() {
 	[[ ! "$2" ]] && return 1
 	[[ ! -f "$1" ]] && return 4
 	local IFS=$'\n'
-
 	local store="$1"
-	local search=()
-	local column=()
+
 	if [[ "$2" == '{' ]]; then
 		_data_parse_pairs
 		local -n ref="${1:-res}"
 	else # compat
-		search+=("$2")
-		column+=("${3:-0}")
+		local search=("$2")
+		local column=("${3:-0}")
 		local -n ref=${4:-res}
 	fi
 
@@ -93,7 +125,7 @@ data_get() {
 		ref=($x)
 		local i
 		for (( i=0; i<${#search[@]}; i++ )); do
-			if [[ "${ref[column[i]]}" != "${search[i]}" ]]; then
+			if [[ "${ref[column[i]]}" != "${search[i]}" && "${search[i]}" ]]; then
 				continue 2
 			fi
 		done
@@ -111,13 +143,23 @@ data_get() {
 # if there were no matches, returns 2
 # if the store wasn't found, returns 4
 #
+# data_iter(store, {search, [column]}, ... callback) -> $data
 # data_iter(store, search, callback, [column]) -> $data
 data_iter() {
 	[[ ! "$3" ]] && return 1
 	[[ ! -f "$1" ]] && return 4
-	local column=${4:-0}
+	local store="$1"
 	local IFS=$'\n'
-	local r=1
+	local r=2
+
+	if [[ "$2" == '{' ]]; then
+		_data_parse_pairs
+		local callback="$2"
+	else # compat
+		local callback="$3"
+		local search=("$2")
+		local column=("${4:-0}")
+	fi
 
 	while read line; do
 		IFS=$delim
@@ -126,10 +168,16 @@ data_iter() {
 		local x="${line//$newline/$'\n'}"
 		data=($x)
 		IFS=
-		[[ "${data[$column]}" == "$2" || ! "$2" ]] && "$3"
+		local i
+		for (( i=0; i<${#search[@]}; i++ )); do
+			if [[ "${data[column[i]]}" != "${search[i]}" && "${search[i]}" ]]; then
+				continue 2
+			fi
+		done
+		"$callback" # only reached if an entry matched all constraints
 		[[ $? == 255 ]] && return 255
 		r=0
-	done < "$1"
+	done < "$store"
 
 	return $r
 }
@@ -220,31 +268,4 @@ _trim_control() {
 	tr="${tr//$'\n'/$newline}" # \n -> 0x02
 }
 
-# internal. parses the `{ }` syntax, starting with 2nd arg.
-# alias, not a function, because we want to modify the argv of the parent
-# _data_parse_pairs(_, { search, column }, [{ search2, column2 }], ...) -> ${search[@]}, ${column[@]}
-alias _data_parse_pairs='
-	while shift; do # "shebang reference?" ~ mei
-		[[ "$1" != "{"" ]] && break # yes, we need to match this twice
-		if [[ "$2" != "}" ]]; then
-			search+=("$2")
-		else # empty search - just match ANY record
-			search+=("")
-			column+=(0)
-			shift 2
-			break
-		fi
-		if [[ "$3" != "}" ]]; then
-			column+=("$3")
-			[[ "$4" != "}" ]] && return 1 # we accept only values in pairs
-			shift 3
-		else
-			column+=(0)
-			shift 2
-			if [[ "$2" != "{" ]]; then
-				shift
-				break
-			fi
-		fi
-	done
-'
+shopt -u expand_aliases # back to the default

From 62e7a9edd98ae5cf6d970d21cec7ca7b8f2df8a9 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 6 Dec 2024 04:04:54 +0100
Subject: [PATCH 085/112] notORM: implement new syntax for data_yeet + more
 fixes

---
 src/notORM.sh | 40 ++++++++++++++++++++++++++++++++--------
 1 file changed, 32 insertions(+), 8 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index f16a511..6bc1d6b 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -154,7 +154,7 @@ data_iter() {
 
 	if [[ "$2" == '{' ]]; then
 		_data_parse_pairs
-		local callback="$2"
+		local callback="$1"
 	else # compat
 		local callback="$3"
 		local search=("$2")
@@ -239,16 +239,40 @@ data_replace() {
 data_yeet() {
 	[[ ! "$2" ]] && return 1
 	[[ ! -f "$1" ]] && return 4
-	local column=${3:-0}
-	local IFS=' '
+	local store="$1"
 
-	if [[ $column == 0 ]]; then
-		local expr="/^$(_sed_sanitize "$2")${delim}.*/d"
-	else
-		local expr="/^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${1}.cols") - column - 1 )) ".*$delim")"'$'"/d"
+	if [[ "$2" == '{' ]]; then
+		_data_parse_pairs
+
+		# we need the pairs sorted due to how the sed expr generation works
+		local IFS=$'\01\n'
+		sorted=($(for (( i=0; i<${#search[@]}; i++ )); do
+			echo "${column[i]}"$'\01'"${search[i]}"
+		done | sort -n -t$'\01'))
+
+		local expr
+		local last=0
+		for (( i=0; i<${#sorted[@]}; i=i+2 )); do
+			if [[ $((sorted[i] - last)) -le 1 ]]; then
+				expr+="$(_sed_sanitize "${sorted[i+1]}")${delim}"
+			else
+				expr+="$(repeat $((sorted[i] - last - 1)) ".*$delim")$(_sed_sanitize "${sorted[i+1]}")${delim}"
+			fi
+			last="${sorted[i]}"
+		done
+		expr="/^${expr}.*/d"
+	else # compat
+		local search="$2"
+		local column="${3:-0}"
+		local IFS=' '
+		if [[ $column == 0 ]]; then
+			local expr="/^$(_sed_sanitize "$2")${delim}.*/d"
+		else
+			local expr="/^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${store}.cols") - column - 1 )) ".*$delim")"'$'"/d"
+		fi
 	fi
 
-	sed -E -i "$expr" "$1"
+	sed -E -i "$expr" "$store"
 }
 
 _sed_sanitize() {

From 4ca9c99b145564345b1abc3859494496de97ec4a Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 6 Dec 2024 05:19:07 +0100
Subject: [PATCH 086/112] tests: add a few notORM tests

---
 tests/04-notORM.sh | 100 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 100 insertions(+)
 create mode 100644 tests/04-notORM.sh

diff --git a/tests/04-notORM.sh b/tests/04-notORM.sh
new file mode 100644
index 0000000..995f6ba
--- /dev/null
+++ b/tests/04-notORM.sh
@@ -0,0 +1,100 @@
+#!/bin/bash
+store="storage/notORM-test.dat"
+
+notORM_add_get() {
+	prepare() {
+		source src/notORM.sh
+		rm "$store"
+		
+		a=("$value" 1 "$value_")
+		data_add "$store" a
+		for i in {2..16}; do
+			a[1]=$i
+			data_add "$store" a
+		done
+	}
+	tst() {
+		data_get "$store" { } || return $?
+		echo "${res[0]}"
+	}
+
+	value="A quick brown fox jumped over the lazy dog"
+	value_=$'meow?\n:3c'
+	match="$value"
+}
+
+notORM_get_multiline() {
+	tst() {
+		data_get "$store" { }
+		echo "${res[2]}"
+	}
+	match="$value_"
+}
+
+notORM_get_filter() {
+	tst() {
+		data_get "$store" { "2" 1 }
+		return $?
+	}
+}
+
+notORM_get_oldsyntax() {
+	tst() {
+		data_get "$store" 2 1 meow || return $?
+		[[ "${meow[0]}" == "$value" ]] && return 0 || return 1
+	}
+}
+
+notORM_yeet_oldsyntax() {
+	tst() {
+		data_yeet "$store" 1 1
+		data_get "$store" 1 1
+		if [[ $? == 2 ]]; then
+			return 0
+		fi
+		return 1
+	}
+}
+
+notORM_yeet() {
+	tst() {
+		data_yeet "$store" { 2 1 }
+		data_get "$store" { 2 1 }
+		if [[ $? == 2 ]]; then
+			return 0
+		fi
+		return 1
+	}
+}
+
+notORM_yeet_multiple_filters() {
+	tst() {
+		data_yeet "$store" { 3 1 } { "$value" }
+		data_get "$store" { 3 1 }
+		if [[ $? == 2 ]]; then
+			return 0
+		fi
+		return 1
+	}
+}
+
+notORM_replace_oldsyntax() {
+	tst() {
+		data_get "$store" { } out
+		out[2]='meow!'
+		data_replace "$store" 4 out 1 || return $?
+		data_get "$store" 4 || return $?
+		[[ "${res[@]}" == "${out[@]}" ]] && return 0 || return 1
+	}
+}
+
+subtest_list=(
+	notORM_add_get
+	notORM_get_multiline
+	notORM_get_filter
+	notORM_get_oldsyntax
+	notORM_yeet_oldsyntax
+	notORM_yeet
+	notORM_yeet_multiple_filters
+	notORM_replace_oldsyntax
+)

From b0d76ecc9a0d56cd702038680958c6ea4beeb59a Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 6 Dec 2024 05:19:45 +0100
Subject: [PATCH 087/112] notORM: split expr generation into _data_gen_expr

---
 src/notORM.sh | 78 +++++++++++++++++++++++++++++++++------------------
 1 file changed, 51 insertions(+), 27 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index 6bc1d6b..b32eb22 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -65,6 +65,26 @@ alias _data_parse_pairs='
 	done
 '
 
+# internal function. take search and column, generate a sed matching expr from them
+# data_gen_expr() -> $expr
+_data_gen_expr() {
+	# we need the pairs sorted due to how the sed expr generation works
+	local IFS=$'\01\n'
+	sorted=($(for (( i=0; i<${#search[@]}; i++ )); do
+		echo "${column[i]}"$'\01'"${search[i]}"
+	done | sort -n -t$'\01'))
+
+	local last=0
+	for (( i=0; i<${#sorted[@]}; i=i+2 )); do
+		if [[ $((sorted[i] - last)) -lt 1 ]]; then
+			expr+="$(_sed_sanitize "${sorted[i+1]}")${delim}"
+		else
+			expr+="$(repeat $((sorted[i] - last)) ".*$delim")$(_sed_sanitize "${sorted[i+1]}")${delim}"
+		fi
+		last="${sorted[i]}"
+	done
+}
+
 # adds a flat `array` to the `store`.
 # a store can be any file, as long as we have r/w access to it and the
 # adjacent directory.
@@ -97,7 +117,7 @@ data_add() {
 #
 # also can be used as `data_get store { } meow` to match all records 
 #
-# data_get(store, {search, [column]} [{search, [column]}], ... [res]]) -> $res / ${!-1}
+# data_get(store, { search, [column] }, ... [res]]) -> $res / ${!-1}
 # data_get(store, search, [column], [res]) -> $res / ${!4}
 data_get() {
 	[[ ! "$2" ]] && return 1
@@ -143,7 +163,7 @@ data_get() {
 # if there were no matches, returns 2
 # if the store wasn't found, returns 4
 #
-# data_iter(store, {search, [column]}, ... callback) -> $data
+# data_iter(store, { search, [column] }, ... callback) -> $data
 # data_iter(store, search, callback, [column]) -> $data
 data_iter() {
 	[[ ! "$3" ]] && return 1
@@ -212,30 +232,48 @@ data_replace_value() {
 data_replace() {
 	[[ ! "$3" ]] && return 1
 	[[ ! -f "$1" ]] && return 4
-	local column=${4:-0}
-	local -n ref="$3"
+	local store="$1"
 	local output=
 	local tr
-	local IFS=' '
+
+	if [[ "$2" == '{' ]]; then
+		_data_parse_pairs
+
+		local -n ref="$1"
+
+		local expr
+		_data_gen_expr
+		expr="s$ctrl^${expr}.*$ctrl"
+	else
+		local column=${4:-0}
+		local -n ref="$3"
+		local IFS=' '
+
+		if [[ $column == 0 ]]; then
+			local expr="s$ctrl^$(_sed_sanitize "$2")${delim}.*$ctrl"
+		else
+			local expr="s$ctrl^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${store}.cols") - column - 1 )) ".*$delim")"'$'"$ctrl"
+		fi
+
+	fi
 	
 	for i in "${ref[@]}"; do
 		_trim_control "$i"
 		output+="$tr$delim"
 	done
-	
-	if [[ $column == 0 ]]; then
-		local expr="s$ctrl^$(_sed_sanitize "$2")${delim}.*$ctrl$(_sed_sanitize_array "$output")$ctrl"
-	else
-		local expr="s$ctrl^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${1}.cols") - column - 1 )) ".*$delim")"'$'"$ctrl$(_sed_sanitize_array "$output")$ctrl"
-	fi
 
-	sed -E -i "$expr" "$1"
+	expr+="$(_sed_sanitize_array "$output")$ctrl"
+
+	echo "$expr"
+
+	sed -E -i "$expr" "$store"
 }
 
 # deletes entries from the `store` using `search`.
 # by default uses the 0th column. override with optional `column`
 #
 # data_yeet(store, search, [column])
+# data_yeet(store, { search, [column] }, ...)
 data_yeet() {
 	[[ ! "$2" ]] && return 1
 	[[ ! -f "$1" ]] && return 4
@@ -244,22 +282,8 @@ data_yeet() {
 	if [[ "$2" == '{' ]]; then
 		_data_parse_pairs
 
-		# we need the pairs sorted due to how the sed expr generation works
-		local IFS=$'\01\n'
-		sorted=($(for (( i=0; i<${#search[@]}; i++ )); do
-			echo "${column[i]}"$'\01'"${search[i]}"
-		done | sort -n -t$'\01'))
-
 		local expr
-		local last=0
-		for (( i=0; i<${#sorted[@]}; i=i+2 )); do
-			if [[ $((sorted[i] - last)) -le 1 ]]; then
-				expr+="$(_sed_sanitize "${sorted[i+1]}")${delim}"
-			else
-				expr+="$(repeat $((sorted[i] - last - 1)) ".*$delim")$(_sed_sanitize "${sorted[i+1]}")${delim}"
-			fi
-			last="${sorted[i]}"
-		done
+		_data_gen_expr
 		expr="/^${expr}.*/d"
 	else # compat
 		local search="$2"

From e64bdbb0d9dedf5a565a42bb67f51d75013af4ae Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Tue, 10 Dec 2024 03:19:50 +0100
Subject: [PATCH 088/112] notORM: temporarily disable new parameter parsing on
 data_replace

---
 src/notORM.sh | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index b32eb22..c755f81 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -76,7 +76,7 @@ _data_gen_expr() {
 
 	local last=0
 	for (( i=0; i<${#sorted[@]}; i=i+2 )); do
-		if [[ $((sorted[i] - last)) -lt 1 ]]; then
+		if [[ $((sorted[i] - last)) -le 1 ]]; then
 			expr+="$(_sed_sanitize "${sorted[i+1]}")${delim}"
 		else
 			expr+="$(repeat $((sorted[i] - last)) ".*$delim")$(_sed_sanitize "${sorted[i+1]}")${delim}"
@@ -235,16 +235,16 @@ data_replace() {
 	local store="$1"
 	local output=
 	local tr
-
-	if [[ "$2" == '{' ]]; then
-		_data_parse_pairs
-
-		local -n ref="$1"
-
-		local expr
-		_data_gen_expr
-		expr="s$ctrl^${expr}.*$ctrl"
-	else
+## currently broken
+# 	if [[ "$2" == '{' ]]; then
+# 		_data_parse_pairs
+# 
+# 		local -n ref="$1"
+# 
+# 		local expr
+# 		_data_gen_expr
+# 		expr="s$ctrl^${expr}.*$ctrl"
+# 	else
 		local column=${4:-0}
 		local -n ref="$3"
 		local IFS=' '
@@ -255,7 +255,7 @@ data_replace() {
 			local expr="s$ctrl^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${store}.cols") - column - 1 )) ".*$delim")"'$'"$ctrl"
 		fi
 
-	fi
+	# fi
 	
 	for i in "${ref[@]}"; do
 		_trim_control "$i"

From a00b1b00ee64215dfdd575cf3c51e2f7c387761f Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 15 Dec 2024 15:57:44 +0100
Subject: [PATCH 089/112] notORM: secfix for sed inconsistently parsing escaped
 characters

---
 src/notORM.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index c755f81..6f9ed80 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -220,7 +220,7 @@ data_replace_value() {
 		local expr="s$ctrl^($(repeat $column ".*$delim"))$(_sed_sanitize "$2")($delim$(repeat $(( $(cat "${1}.cols") - column - 1 )) ".*$delim"))"'$'"$ctrl\1$(_sed_sanitize "$3")\2$ctrl"
 	fi
 
-	sed -E -i "$expr" "$1"
+	sed -i "$expr" "$1"
 }
 
 # replace an entire entry in `store` with `array`, filtering by `search`.
@@ -266,7 +266,7 @@ data_replace() {
 
 	echo "$expr"
 
-	sed -E -i "$expr" "$store"
+	sed -i "$expr" "$store"
 }
 
 # deletes entries from the `store` using `search`.
@@ -296,16 +296,16 @@ data_yeet() {
 		fi
 	fi
 
-	sed -E -i "$expr" "$store"
+	sed -i "$expr" "$store"
 }
 
 _sed_sanitize() {
 	_trim_control "$1"
-	echo -n "$tr" | xxd -p | tr -d '\n' | sed -E 's/../\\x&/g'
+	echo -n "$tr" | xxd -p | tr -d '\n' | sed 's/../\\x&/g'
 }
 
 _sed_sanitize_array() {
-	echo -n "$1" | xxd -p | tr -d '\n' | sed -E 's/../\\x&/g'
+	echo -n "$1" | xxd -p | tr -d '\n' | sed 's/../\\x&/g'
 }
 
 # _trim_control(string) -> $tr

From 5c099c14721bea358d324ea3f80828504aee7e63 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 15 Dec 2024 16:28:24 +0100
Subject: [PATCH 090/112] sec-fixes: add information about the notORM bug

---
 README.md                           | 3 +++
 docs/sec-fixes/2024-12-15_notORM.md | 9 +++++++++
 2 files changed, 12 insertions(+)
 create mode 100644 docs/sec-fixes/2024-12-15_notORM.md

diff --git a/README.md b/README.md
index 939c020..d1725ae 100644
--- a/README.md
+++ b/README.md
@@ -3,6 +3,9 @@ Node.js, but `| sed 's/Node/HTTP/;s/js/sh/'`.
 
 HTTP.sh is (by far) the most extensible attempt at creating a web framework in Bash, and (AFAIK) the only one that's actively maintained. Although I strive for code quality, this is still rather experimental and may contain bugs.
 
+- (WiP) [Documentation](docs/)
+- [List of security fixes](docs/sec-fixes/)
+
 Originally made for Junction Stupidhack 2020; Created by [sdomi](https://sakamoto.pl/), [ptrcnull](https://ptrcnull.me/) and [selfisekai](https://selfisekai.rocks/).
 
 ## Quick Start
diff --git a/docs/sec-fixes/2024-12-15_notORM.md b/docs/sec-fixes/2024-12-15_notORM.md
new file mode 100644
index 0000000..05f19c3
--- /dev/null
+++ b/docs/sec-fixes/2024-12-15_notORM.md
@@ -0,0 +1,9 @@
+# 2024-12-15 Possible pattern injection in notORM
+
+Prior to commit a00b1b00ee64215dfdd575cf3c51e2f7c387761f, notORM was vulnerable to a pattern
+injection attack, which could potentially lead to privilege escalation through the account system.
+
+The vulnerability arose due to an inconsistency with how certain versions of sed handle escaped
+hex characters (`\xNN`). GNU sed expands the escaped characters and treats them as a raw part of
+the pattern as long as Extended Regex (`-E`) mode is used. This behavior is not present within
+busybox sed, which is why it hasn't been caught before.

From a2413d7062d0f822314cd32d4402b01245f8d4fe Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Mon, 16 Dec 2024 17:57:56 +0100
Subject: [PATCH 091/112] notORM: remove debug echo

---
 src/notORM.sh | 2 --
 1 file changed, 2 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index 6f9ed80..b87e52d 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -264,8 +264,6 @@ data_replace() {
 
 	expr+="$(_sed_sanitize_array "$output")$ctrl"
 
-	echo "$expr"
-
 	sed -i "$expr" "$store"
 }
 

From b251e2736c29dd7bf2ec02491a4949d934d437c2 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Mon, 16 Dec 2024 19:34:23 +0100
Subject: [PATCH 092/112] notORM: fix data_replace_value due to sed quirk

---
 src/notORM.sh | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index b87e52d..6b57b3f 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -213,11 +213,12 @@ data_replace_value() {
 	[[ ! -f "$1" ]] && return 4
 	local column=${4:-0}
 	local IFS=' '
-	
+
+	# NOTE: sed in normal (not extended -E mode) requires `\(asdf\)` to make a match!
 	if [[ $column == 0 ]]; then
-		local expr="s$ctrl^$(_sed_sanitize "$2")(${delim}.*)$ctrl$(_sed_sanitize "$3")\1$ctrl"
+		local expr="s$ctrl^$(_sed_sanitize "$2")\(${delim}.*\)$ctrl$(_sed_sanitize "$3")\1$ctrl"
 	else
-		local expr="s$ctrl^($(repeat $column ".*$delim"))$(_sed_sanitize "$2")($delim$(repeat $(( $(cat "${1}.cols") - column - 1 )) ".*$delim"))"'$'"$ctrl\1$(_sed_sanitize "$3")\2$ctrl"
+		local expr="s$ctrl^\($(repeat $column ".*$delim")\)$(_sed_sanitize "$2")\($delim$(repeat $(( $(cat "${1}.cols") - column - 1 )) ".*$delim")\)"'$'"$ctrl\1$(_sed_sanitize "$3")\2$ctrl"
 	fi
 
 	sed -i "$expr" "$1"

From 9d62173cfe84a547a75247fbe38658fac370b824 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Mon, 16 Dec 2024 19:34:42 +0100
Subject: [PATCH 093/112] misc: fix striping garbage from url_decode

---
 src/misc.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/misc.sh b/src/misc.sh
index 49d21af..0c110ec 100755
--- a/src/misc.sh
+++ b/src/misc.sh
@@ -58,7 +58,7 @@ function url_decode() {
 
 	local t=$'\01'
 	local a="${1//$t}" # strip all of our control chrs for safety
-	a="${1//+/ }" # handle whitespace
+	a="${a//+/ }" # handle whitespace
 	a="${a//%[A-Fa-f0-9][A-Fa-f0-9]/$t&}" # match '%xx', prepend with token
 	echo -ne "${a//$t%/\\x}" # replace the above with '\\x' and evaluate
 }

From cc1619e797afdf69f4cf9fefcca064e63bace6ad Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Mon, 16 Dec 2024 20:06:14 +0100
Subject: [PATCH 094/112] notORM: fix an off-by-one affecting ops on the
 second-last column

---
 src/notORM.sh | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index 6b57b3f..3ed325e 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -218,7 +218,7 @@ data_replace_value() {
 	if [[ $column == 0 ]]; then
 		local expr="s$ctrl^$(_sed_sanitize "$2")\(${delim}.*\)$ctrl$(_sed_sanitize "$3")\1$ctrl"
 	else
-		local expr="s$ctrl^\($(repeat $column ".*$delim")\)$(_sed_sanitize "$2")\($delim$(repeat $(( $(cat "${1}.cols") - column - 1 )) ".*$delim")\)"'$'"$ctrl\1$(_sed_sanitize "$3")\2$ctrl"
+		local expr="s$ctrl^\($(repeat $column ".*$delim")\)$(_sed_sanitize "$2")\($delim$(repeat $(( $(cat "${1}.cols") - column )) ".*$delim")\)"'$'"$ctrl\1$(_sed_sanitize "$3")\2$ctrl"
 	fi
 
 	sed -i "$expr" "$1"
@@ -253,7 +253,7 @@ data_replace() {
 		if [[ $column == 0 ]]; then
 			local expr="s$ctrl^$(_sed_sanitize "$2")${delim}.*$ctrl"
 		else
-			local expr="s$ctrl^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${store}.cols") - column - 1 )) ".*$delim")"'$'"$ctrl"
+			local expr="s$ctrl^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${store}.cols") - column )) ".*$delim")"'$'"$ctrl"
 		fi
 
 	# fi
@@ -264,7 +264,6 @@ data_replace() {
 	done
 
 	expr+="$(_sed_sanitize_array "$output")$ctrl"
-
 	sed -i "$expr" "$store"
 }
 
@@ -291,7 +290,7 @@ data_yeet() {
 		if [[ $column == 0 ]]; then
 			local expr="/^$(_sed_sanitize "$2")${delim}.*/d"
 		else
-			local expr="/^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${store}.cols") - column - 1 )) ".*$delim")"'$'"/d"
+			local expr="/^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${store}.cols") - column )) ".*$delim")"'$'"/d"
 		fi
 	fi
 

From bd445181eedee99f161d2d2c81edb473dc8fd725 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Mon, 16 Dec 2024 21:19:47 +0100
Subject: [PATCH 095/112] mail: propagate errors on mailsend

---
 src/mail.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/src/mail.sh b/src/mail.sh
index 95b6bbe..0435897 100755
--- a/src/mail.sh
+++ b/src/mail.sh
@@ -28,5 +28,7 @@ function mailsend() {
 		--upload-file "$tmp" \
 		--user "${cfg[mail]}:${cfg[mail_password]}"
 
+	res=$?
 	rm "$tmp"
+	return $res
 }

From fbcdd76b14cf0ff6d8fb1d19b2d2c753aebad57d Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Sun, 22 Dec 2024 05:13:45 +0100
Subject: [PATCH 096/112] account: propagate user from user_reset_password

---
 src/account.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/src/account.sh b/src/account.sh
index 74d1778..4c2332f 100755
--- a/src/account.sh
+++ b/src/account.sh
@@ -150,13 +150,12 @@ function delete_account() {
   data_yeet secret/users.dat "$1"
 }
 
-# user_reset_password(username, token, new_password)
+# user_reset_password(username, token, new_password) -> $?, ${user[@]}
 user_reset_password() {
 	[[ ! "$1" ]] && return 1 # sensitive function, so we're checking all three
 	[[ ! "$2" ]] && return 1 # there's probably a better way,
 	[[ ! "$3" ]] && return 1 # but i don't care.
 
-	local user
 	if data_get secret/users.dat "$1" 0 user; then
 
 		if [[ "$2" == "${user[3]}" ]]; then

From b5b44aa4ca0e4c62af163aadb051b7864fdad948 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Mon, 23 Dec 2024 19:14:23 +0100
Subject: [PATCH 097/112] dockerfile: revert f938165518

---
 Dockerfile | 15 ---------------
 1 file changed, 15 deletions(-)
 delete mode 100644 Dockerfile

diff --git a/Dockerfile b/Dockerfile
deleted file mode 100644
index 4aab686..0000000
--- a/Dockerfile
+++ /dev/null
@@ -1,15 +0,0 @@
-FROM alpine:3.20
-
-RUN apk update \
- && apk add sed xxd grep findutils file nmap-ncat socat jq bash file curl
-
-WORKDIR /httpsh
-COPY . .
-
-EXPOSE 1337
-VOLUME /httpsh/config
-VOLUME /httpsh/app
-VOLUME /httpsh/storage
-VOLUME /httpsh/secret
-
-CMD ["/httpsh/http.sh"]

From 53dbaadc6c707384988e785275983b459ac12fce Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Mon, 23 Dec 2024 19:35:02 +0100
Subject: [PATCH 098/112] docker: rewrite

---
 Dockerfile | 14 ++++++++++++++
 1 file changed, 14 insertions(+)
 create mode 100644 Dockerfile

diff --git a/Dockerfile b/Dockerfile
new file mode 100644
index 0000000..4ce2fe1
--- /dev/null
+++ b/Dockerfile
@@ -0,0 +1,14 @@
+FROM alpine:3.21
+
+RUN apk upgrade -U && apk add bash sed grep nmap-ncat socat file findutils jq curl argon2
+
+WORKDIR /app
+COPY . .
+
+EXPOSE 1337
+VOLUME /app/app
+VOLUME /app/config
+VOLUME /app/storage
+VOLUME /app/secret
+
+CMD ["/app/http.sh"]

From 284e1c0e70984c6d6ddcb73425ef481794450ebe Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Mon, 23 Dec 2024 19:36:03 +0100
Subject: [PATCH 099/112] relicense to BSD 3-Clause

---
 LICENSE.md | 158 ++---------------------------------------------------
 1 file changed, 6 insertions(+), 152 deletions(-)

diff --git a/LICENSE.md b/LICENSE.md
index 0927556..79a7e02 100644
--- a/LICENSE.md
+++ b/LICENSE.md
@@ -1,157 +1,11 @@
-### GNU LESSER GENERAL PUBLIC LICENSE
+Copyright 2020-2024, sdomi et al.
 
-Version 3, 29 June 2007
+Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met:
 
-Copyright (C) 2007 Free Software Foundation, Inc.
-<https://fsf.org/>
+1. Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer.
 
-Everyone is permitted to copy and distribute verbatim copies of this
-license document, but changing it is not allowed.
+2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution.
 
-This version of the GNU Lesser General Public License incorporates the
-terms and conditions of version 3 of the GNU General Public License,
-supplemented by the additional permissions listed below.
+3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.
 
-#### 0. Additional Definitions.
-
-As used herein, "this License" refers to version 3 of the GNU Lesser
-General Public License, and the "GNU GPL" refers to version 3 of the
-GNU General Public License.
-
-"The Library" refers to a covered work governed by this License, other
-than an Application or a Combined Work as defined below.
-
-An "Application" is any work that makes use of an interface provided
-by the Library, but which is not otherwise based on the Library.
-Defining a subclass of a class defined by the Library is deemed a mode
-of using an interface provided by the Library.
-
-A "Combined Work" is a work produced by combining or linking an
-Application with the Library. The particular version of the Library
-with which the Combined Work was made is also called the "Linked
-Version".
-
-The "Minimal Corresponding Source" for a Combined Work means the
-Corresponding Source for the Combined Work, excluding any source code
-for portions of the Combined Work that, considered in isolation, are
-based on the Application, and not on the Linked Version.
-
-The "Corresponding Application Code" for a Combined Work means the
-object code and/or source code for the Application, including any data
-and utility programs needed for reproducing the Combined Work from the
-Application, but excluding the System Libraries of the Combined Work.
-
-#### 1. Exception to Section 3 of the GNU GPL.
-
-You may convey a covered work under sections 3 and 4 of this License
-without being bound by section 3 of the GNU GPL.
-
-#### 2. Conveying Modified Versions.
-
-If you modify a copy of the Library, and, in your modifications, a
-facility refers to a function or data to be supplied by an Application
-that uses the facility (other than as an argument passed when the
-facility is invoked), then you may convey a copy of the modified
-version:
-
--   a) under this License, provided that you make a good faith effort
-    to ensure that, in the event an Application does not supply the
-    function or data, the facility still operates, and performs
-    whatever part of its purpose remains meaningful, or
--   b) under the GNU GPL, with none of the additional permissions of
-    this License applicable to that copy.
-
-#### 3. Object Code Incorporating Material from Library Header Files.
-
-The object code form of an Application may incorporate material from a
-header file that is part of the Library. You may convey such object
-code under terms of your choice, provided that, if the incorporated
-material is not limited to numerical parameters, data structure
-layouts and accessors, or small macros, inline functions and templates
-(ten or fewer lines in length), you do both of the following:
-
--   a) Give prominent notice with each copy of the object code that
-    the Library is used in it and that the Library and its use are
-    covered by this License.
--   b) Accompany the object code with a copy of the GNU GPL and this
-    license document.
-
-#### 4. Combined Works.
-
-You may convey a Combined Work under terms of your choice that, taken
-together, effectively do not restrict modification of the portions of
-the Library contained in the Combined Work and reverse engineering for
-debugging such modifications, if you also do each of the following:
-
--   a) Give prominent notice with each copy of the Combined Work that
-    the Library is used in it and that the Library and its use are
-    covered by this License.
--   b) Accompany the Combined Work with a copy of the GNU GPL and this
-    license document.
--   c) For a Combined Work that displays copyright notices during
-    execution, include the copyright notice for the Library among
-    these notices, as well as a reference directing the user to the
-    copies of the GNU GPL and this license document.
--   d) Do one of the following:
-    -   0) Convey the Minimal Corresponding Source under the terms of
-        this License, and the Corresponding Application Code in a form
-        suitable for, and under terms that permit, the user to
-        recombine or relink the Application with a modified version of
-        the Linked Version to produce a modified Combined Work, in the
-        manner specified by section 6 of the GNU GPL for conveying
-        Corresponding Source.
-    -   1) Use a suitable shared library mechanism for linking with
-        the Library. A suitable mechanism is one that (a) uses at run
-        time a copy of the Library already present on the user's
-        computer system, and (b) will operate properly with a modified
-        version of the Library that is interface-compatible with the
-        Linked Version.
--   e) Provide Installation Information, but only if you would
-    otherwise be required to provide such information under section 6
-    of the GNU GPL, and only to the extent that such information is
-    necessary to install and execute a modified version of the
-    Combined Work produced by recombining or relinking the Application
-    with a modified version of the Linked Version. (If you use option
-    4d0, the Installation Information must accompany the Minimal
-    Corresponding Source and Corresponding Application Code. If you
-    use option 4d1, you must provide the Installation Information in
-    the manner specified by section 6 of the GNU GPL for conveying
-    Corresponding Source.)
-
-#### 5. Combined Libraries.
-
-You may place library facilities that are a work based on the Library
-side by side in a single library together with other library
-facilities that are not Applications and are not covered by this
-License, and convey such a combined library under terms of your
-choice, if you do both of the following:
-
--   a) Accompany the combined library with a copy of the same work
-    based on the Library, uncombined with any other library
-    facilities, conveyed under the terms of this License.
--   b) Give prominent notice with the combined library that part of it
-    is a work based on the Library, and explaining where to find the
-    accompanying uncombined form of the same work.
-
-#### 6. Revised Versions of the GNU Lesser General Public License.
-
-The Free Software Foundation may publish revised and/or new versions
-of the GNU Lesser General Public License from time to time. Such new
-versions will be similar in spirit to the present version, but may
-differ in detail to address new problems or concerns.
-
-Each version is given a distinguishing version number. If the Library
-as you received it specifies that a certain numbered version of the
-GNU Lesser General Public License "or any later version" applies to
-it, you have the option of following the terms and conditions either
-of that published version or of any later version published by the
-Free Software Foundation. If the Library as you received it does not
-specify a version number of the GNU Lesser General Public License, you
-may choose any version of the GNU Lesser General Public License ever
-published by the Free Software Foundation.
-
-If the Library as you received it specifies that a proxy can decide
-whether future versions of the GNU Lesser General Public License shall
-apply, that proxy's public statement of acceptance of any version is
-permanent authorization for you to choose that version for the
-Library.
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS “AS IS” AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

From a66a74208ec7c8aae9c491940f79485a3e481cd5 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Thu, 26 Dec 2024 12:54:07 +0100
Subject: [PATCH 100/112] account: add a config toggle for register behavior

---
 .resources/primary_config.sh | 4 ++++
 src/account.sh               | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.resources/primary_config.sh b/.resources/primary_config.sh
index e477c71..8c5d43f 100644
--- a/.resources/primary_config.sh
+++ b/.resources/primary_config.sh
@@ -39,3 +39,7 @@ cfg[mail_ignore_bad_cert]=false
 cfg[hash]="argon2id"
 
 cfg[cookie_path]="/"
+
+# should registering automatically login the user?
+# useful for flows involving a confirmation e-mail
+cfg[register_should_login]=true
diff --git a/src/account.sh b/src/account.sh
index 4c2332f..f85e811 100755
--- a/src/account.sh
+++ b/src/account.sh
@@ -28,7 +28,7 @@ function register() {
 	local out=("$username" "$hash" "$salt" "" "${extra[@]}")
 	data_add secret/users.dat out
 
-	_new_session "$username"
+	[[ "${cfg[register_should_login]}" == true ]] && _new_session "$username"
 
 	set_cookie_permanent "sh_session" "${session[2]}"
 	set_cookie_permanent "username" "$username"

From eaabcc0da25b3f3522f11a415b2351bdcb992303 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Wed, 1 Jan 2025 01:37:00 +0100
Subject: [PATCH 101/112] notORM: fix matching }

---
 src/notORM.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index 3ed325e..a5b6d98 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -42,7 +42,7 @@ alias _data_parse_pairs='
 
 	while shift; do # "shebang reference?" ~ mei
 		[[ "$1" != "{" ]] && break # yes, we need to match this twice
-		if [[ "$2" != "}" ]]; then
+		if [[ "$2" != "}" || "$3" == "}" || "$4" == "}" ]]; then # make sure we dont want to match the bracket
 			search+=("$2")
 		else # empty search - just match ANY record
 			search+=("")

From 1b085fbbdb6d229d7912f0aa5a020ed80841f1e9 Mon Sep 17 00:00:00 2001
From: Merlin Scholz <merlin@scholz.ruhr>
Date: Sun, 5 Jan 2025 19:37:18 +0100
Subject: [PATCH 102/112] Fix accidental session_cookie loss caused by missing
 IFS unset

---
 src/server.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/src/server.sh b/src/server.sh
index beee921..545f926 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -103,6 +103,7 @@ if [[ -n "${headers["content-type"]}" ]]; then
 		    r[content_boundary]="${boundary##*boundary=}"
 	    fi
 	fi
+	unset IFS
 fi
 
 if [[ -n "${headers["host"]}" ]]; then

From d39956b81555d1ea49463d529e8654fccbe417b1 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Mon, 6 Jan 2025 00:33:20 +0100
Subject: [PATCH 103/112] readme: update

---
 README.md | 76 ++++++++++++++++++-------------------------------------
 1 file changed, 24 insertions(+), 52 deletions(-)

diff --git a/README.md b/README.md
index d1725ae..a5359c1 100644
--- a/README.md
+++ b/README.md
@@ -1,71 +1,43 @@
 # HTTP.sh
-Node.js, but `| sed 's/Node/HTTP/;s/js/sh/'`.
 
-HTTP.sh is (by far) the most extensible attempt at creating a web framework in Bash, and (AFAIK) the only one that's actively maintained. Although I strive for code quality, this is still rather experimental and may contain bugs.
+the *coolest* web framework (in Bash) to date.
 
-- (WiP) [Documentation](docs/)
+We now have an IRC channel! Join #http.sh @ irc.libera.chat
+
+## Documentation
+
+We have some guides and general documentation in the [docs](docs/) directory. Among them:
+
+- A [quick start](docs/quick-start.md) guide
+- General [directory structure](docs/directory-structure.md)
+- [CLI usage](docs/running.md)
+- [Tests](docs/tests.md)
+- [HTTP Router](docs/router.md)
 - [List of security fixes](docs/sec-fixes/)
 
-Originally made for Junction Stupidhack 2020; Created by [sdomi](https://sakamoto.pl/), [ptrcnull](https://ptrcnull.me/) and [selfisekai](https://selfisekai.rocks/).
-
-## Quick Start
-
-If you want to build a new webapp from scratch:
-
-```
-./http.sh init
-./http.sh
-```
-
-If you're setting up HTTP.sh for an existing application:
-
-```
-git clone https://git.sakamoto.pl/laudom/ocw/ app # example repo :P
-./http.sh
-```
-
-We also support Docker! Both a Dockerfile and an example docker-compose.yml are included for your convenience. Containerizing your webapp is as easy as `docker-compose up -d`
-
 ## Dependencies
 
-- Bash (4.x should work, but we'll need 5.0 soon)
-- [Ncat](https://nmap.org/ncat), not openbsd-nc, not netcat, not nc
-- socat (because the above is slightly broken)
-- pkill
-- mktemp
-- jq (probably not needed just yet, but it will be in 1.0)
-- dd (for accounts, multipart/form-data and websockets)
-- sha1sum, sha256sum, base64 (for accounts and simple auth)
-- curl (for some demos)
+Absolutely necessary:
+
+- Bash (5.x, not interested in backwards compat)
+- either [Ncat](https://nmap.org/ncat) (not openbsd-nc, not netcat, not nc) or socat, or a combo of both
+- GNU grep/sed
+
+Full list of dependencies: [required](src/dependencies.required), [optional](src/dependencies.optional).
 
 ## Known faults
 
-- can't change the HTTP status code from Shell Server scripts. This could theoretically be done with custom vhost configs and some `if` statements, but this would be a rather nasty solution to that problem.
+- if ncat fails to bind to `[::]`, change the bind to `127.0.0.1` or `0` in `config/master.sh`
 - `$post_multipart` doesn't keep original names - could be fixed by parsing individual headers from the multipart request instead of skipping them all
-- it won't ever throw a 500, thus it fails silently
-
-## Directory structure
-- ${cfg[namespace]} (`app` by default)
-	- ${cfg[root]} (`webroot` by default) - public application root
-	- workers/ - scripts that execute periodically live there (see examples)
-	- views/ - for use with HTTP.sh router
-	- config.sh - application-level config file
-- config
-	- master.sh - main server config file - loaded on boot and with every request
-	- host:port - if a file matching the Host header is found, HTTP.sh will load it request-wide
-- src
-	- server source files and modules
-	- response
-		- files corresponding to specific HTTP status codes
-		- listing.sh (code 210) is actually HTTP 200, but triggered in a directory with autoindex turned on and without a valid `index.shs` file
-- templates - section templates go here
-- secret - users, passwords and other Seecret data should be stored here
-- storage - random data storage for your webapp
+- websocket impl isn't properly finished
+- fails with an empty response, instead of throwing 400/500
 
 ## Variables that we think are cool!
 
 ![](https://f.sakamoto.pl/d6584c01-1c48-42b9-935b-d9a89af4e071file_101.jpg)
 
+(this data may be slightly outdated. Full docs TODO.)
+
 - get_data - holds data from GET parameters
 	- /?test=asdf -> `${get_data[test]}` == `"asdf"`
 - params - holds parsed data from URL router

From 55814d44272092dbcbc4d0489df96b80fdfa5924 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Wed, 8 Jan 2025 21:32:34 +0100
Subject: [PATCH 104/112] server: generic r[url_clean] for just getting the
 current URL w/o params

---
 src/server.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/server.sh b/src/server.sh
index 545f926..54a7b96 100755
--- a/src/server.sh
+++ b/src/server.sh
@@ -85,6 +85,7 @@ r[websocket_key]="${headers["sec-websocket-key"]}"
 r[req_headers]="$headers"
 r[url]="$(url_decode "${r[url]}")" # doing this here for.. reasons
 r[uri]="$(realpath "${cfg[namespace]}/${cfg[root]}/$(sed -E 's/\?(.*)$//' <<< "${r[url]}")")"
+r[url_clean]="${r[url]%\?*}"
 [[ -d "${r[uri]}/" ]] && pwd="${r[uri]}" || pwd=$(dirname "${r[uri]}") # dead code
 
 if [[ -n "${headers["content-type"]}" ]]; then
@@ -167,14 +168,13 @@ echo "$(date) - IP: ${r[ip]}, PROTO: ${r[proto]}, URL: ${r[url]}, GET_data: ${ge
 [[ -f "${cfg[namespace]}/routes.sh" ]] && source "${cfg[namespace]}/routes.sh"
 
 if [[ ${r[status]} != 101 ]]; then
-	clean_url="${r[url]%\?*}"
 	for (( i=0; i<${#route[@]}; i=i+3 )); do
-		if [[ "$(grep -Poh "^${route[$((i+1))]}$" <<< "$clean_url")" != "" ]] || [[ "$(grep -Poh "^${route[$((i+1))]}$" <<< "$clean_url/")" != "" ]]; then
+		if [[ "$(grep -Poh "^${route[$((i+1))]}$" <<< "${r[url_clean]}")" != "" ]] || [[ "$(grep -Poh "^${route[$((i+1))]}$" <<< "${r[url_clean]}/")" != "" ]]; then
 			r[status]=212
 			r[view]="${route[$((i+2))]}"
 			IFS='/'
 			url=(${route[$i]})
-			url_=($clean_url)
+			url_=(${r[url_clean]})
 			unset IFS
 			for (( j=0; j<${#url[@]}; j++ )); do
 				# TODO: think about the significance of this if really hard when i'm less tired

From 23e85fc7d0a3bb1a6b0979bb201c7d63f279a04e Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Tue, 14 Jan 2025 13:40:57 +0000
Subject: [PATCH 105/112] main: add a $run_once variable, to discern between
 startup and normal operation

---
 .resources/config.sh | 5 +++++
 http.sh              | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/.resources/config.sh b/.resources/config.sh
index ac7d28d..cf6950d 100644
--- a/.resources/config.sh
+++ b/.resources/config.sh
@@ -3,3 +3,8 @@
 
 # worker_add example 5
 cfg[enable_multipart]=false # by default, uploading files is disabled
+
+if [[ "$run_once" ]]; then
+	# the following will only run once at startup, not with every request
+	:
+fi
diff --git a/http.sh b/http.sh
index 83f7ef5..2d186c8 100755
--- a/http.sh
+++ b/http.sh
@@ -122,7 +122,9 @@ fi
 source src/worker.sh
 
 if [[ -f "${cfg[namespace]}/config.sh" ]]; then
+	run_once=true
 	source "${cfg[namespace]}/config.sh"
+	unset run_once
 fi
 
 if [[ ${cfg[socat_only]} == true ]]; then

From f7627c7af641b1558a220d84e6dd147307f9d32d Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Tue, 14 Jan 2025 16:43:42 +0000
Subject: [PATCH 106/112] template: new array copy solution (... not happy
 about it, but what can I do)

---
 src/template.sh | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/src/template.sh b/src/template.sh
index 80702cc..f336880 100755
--- a/src/template.sh
+++ b/src/template.sh
@@ -136,14 +136,12 @@ function nested_declare() {
 # nested_add(ref, array)
 function nested_add() {
 	local nested_id=$(_nested_random)
-	declare -n nested_ref="$2"
 	declare -g -A _$nested_id
-	
-	# poor man's array copy
-	IFS=' '
-	for k in ${!nested_ref[@]}; do
-		declare -g -A _$nested_id["$k"]="${nested_ref["$k"]}"
-	done
+
+	local a
+	a="$(declare -p "$2")"
+	# pain
+	eval "${a/ $2=/ -g _$nested_id=}"
 	
 	local -n ref=$1
 	ref+=("$nested_id")

From 4b59b3d2575dff25a900138d97be2d46b521328e Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Wed, 12 Feb 2025 04:47:37 +0100
Subject: [PATCH 107/112] template: add -uri-num tags for automatic URL
 manipulation

---
 src/template.sh | 36 ++++++++++++++++++++++++++++++++++++
 1 file changed, 36 insertions(+)

diff --git a/src/template.sh b/src/template.sh
index f336880..80022bf 100755
--- a/src/template.sh
+++ b/src/template.sh
@@ -77,6 +77,7 @@ function render() {
 				echo 's'$'\02''\{\{\#'"$key"'\}\}'$'\02''I cowardly refuse to endlessly recurse\!'$'\02''g;' >> "$subtemplate"
 			elif [[ -f "$key" ]]; then
 				echo 's'$'\02''\{\{\#'"$key"'\}\}'$'\02'"$(tr -d $'\01'$'\02' < "$key" | tr $'\n' $'\01' | sed 's/\&/�UwU�/g')"$'\02''g;' >> "$subtemplate"
+				_template_find_special_uri "$(cat "$key")"
 			fi
 		done <<< "$(grep -Poh '{{#.*?}}' <<< "$template" | sed 's/{{#//;s/}}$//')"
 
@@ -84,6 +85,9 @@ function render() {
 		rm "$subtemplate"
 	fi
 
+	_template_find_special_uri "$template"
+	_template_gen_special_uri >> "$tmp"
+
 	if [[ "$3" != true ]]; then # are we recursing?
 		cat "$tmp" | tr '\n' $'\01' | sed -E 's/'$'\02'';'$'\01''/'$'\02'';/g;s/'$'\02''g;'$'\01''/'$'\02''g;/g' > "${tmp}_"
 		
@@ -97,6 +101,38 @@ function render() {
 	fi
 }
 
+_template_uri_list=()
+# internal function that finds all occurences of the special `{{-uri-N}}` tag.
+# here to also make it run on subtemplates
+#
+# _template_find_special_uri(tpl_string)
+_template_find_special_uri() {
+	local IFS=$'\n'
+	local line
+	if [[ "$1" == *'{{-uri'* ]]; then
+		while read line; do
+			_template_uri_list+=("${line//[^0-9]}")
+		done <<< "$(grep -Poh '{{-uri-[0-9]*}}' <<< "$1")"
+	fi
+}
+
+# internal function that takes the output from _template_find_special_uri and
+# transforms it into sed exprs
+#
+# _template_gen_special_uri() -> stdout
+_template_gen_special_uri() {
+	local IFS=$'\n'
+	local num
+	local uri
+	# {{-uri-<num>}}, where num is amount of slashed parts to include
+	sort <<< ${_template_uri_list[*]} | uniq | while read num; do
+		uri="$(grep -Poh '^(/.*?){'"$((num+1))"'}' <<< "${r[url_clean]}/")"
+		echo 's'$'\02''\{\{-uri-'"$num"'\}\}'$'\02'"$uri"$'\02''g;'
+	done
+	# for replacing plain {{-uri}} without a number
+	echo 's'$'\02''\{\{-uri\}\}'$'\02'"${r[url_clean]}"$'\02''g;'
+}
+
 # render_unsafe(array, template_file)
 function render_unsafe() {
 	local template="$(cat "$2")"

From 993941680a5056f3dde98b72c547a0e74ac6c308 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Thu, 13 Feb 2025 23:21:02 +0100
Subject: [PATCH 108/112] notORM: hotfix the off-by-one bug until I can find a
 better solution

---
 src/notORM.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index a5b6d98..e1ae45c 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -218,7 +218,7 @@ data_replace_value() {
 	if [[ $column == 0 ]]; then
 		local expr="s$ctrl^$(_sed_sanitize "$2")\(${delim}.*\)$ctrl$(_sed_sanitize "$3")\1$ctrl"
 	else
-		local expr="s$ctrl^\($(repeat $column ".*$delim")\)$(_sed_sanitize "$2")\($delim$(repeat $(( $(cat "${1}.cols") - column )) ".*$delim")\)"'$'"$ctrl\1$(_sed_sanitize "$3")\2$ctrl"
+		local expr="s$ctrl^\($(repeat $column ".*$delim")\)$(_sed_sanitize "$2")\($delim$(repeat $(( $(cat "${1}.cols") - column - 1 )) ".*$delim")\)"'$'"$ctrl\1$(_sed_sanitize "$3")\2$ctrl"
 	fi
 
 	sed -i "$expr" "$1"
@@ -253,7 +253,7 @@ data_replace() {
 		if [[ $column == 0 ]]; then
 			local expr="s$ctrl^$(_sed_sanitize "$2")${delim}.*$ctrl"
 		else
-			local expr="s$ctrl^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${store}.cols") - column )) ".*$delim")"'$'"$ctrl"
+			local expr="s$ctrl^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${store}.cols") - column - 1 )) ".*$delim")"'$'"$ctrl"
 		fi
 
 	# fi
@@ -290,7 +290,7 @@ data_yeet() {
 		if [[ $column == 0 ]]; then
 			local expr="/^$(_sed_sanitize "$2")${delim}.*/d"
 		else
-			local expr="/^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${store}.cols") - column )) ".*$delim")"'$'"/d"
+			local expr="/^$(repeat $column ".*$delim")$(_sed_sanitize "$2")$delim$(repeat $(( $(cat "${store}.cols") - column - 1 )) ".*$delim")"'$'"/d"
 		fi
 	fi
 

From febb4087e4c0675e5ee42a4ee5b50b827d2c04f9 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Fri, 14 Feb 2025 17:41:26 +0100
Subject: [PATCH 109/112] misc: sync up immediate cookie changes with cookies
 array

---
 src/misc.sh | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/src/misc.sh b/src/misc.sh
index 0c110ec..c9ad60d 100755
--- a/src/misc.sh
+++ b/src/misc.sh
@@ -4,16 +4,19 @@
 # set_cookie(cookie_name, cookie_content)
 function set_cookie() {
 	r[headers]+="Set-Cookie: $1=$2; Path=${cfg[cookie_path]}\r\n"
+	cookies["$1"]="$2"
 }
 
 # set_cookie_permanent(cookie_name, cookie_content)
 function set_cookie_permanent() {
 	r[headers]+="Set-Cookie: $1=$2; Expires=Mon, 26 Jul 2100 22:45:00 GMT; Path=${cfg[cookie_path]}\r\n"
+	cookies["$1"]="$2"
 }
 
 # remove_cookie(cookie_name)
 function remove_cookie() {
 	r[headers]+="Set-Cookie: $1=; Expires=Sat, 02 Apr 2005 20:37:00 GMT\r\n"
+	unset cookies["$1"]
 }
 
 # header(header, header...)

From affe9e4fbee4be46b30e13ab412eebf0aed78809 Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Wed, 19 Feb 2025 22:42:42 +0100
Subject: [PATCH 110/112] notORM: fix a few leaky variables

---
 src/notORM.sh | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index e1ae45c..3767de5 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -70,6 +70,7 @@ alias _data_parse_pairs='
 _data_gen_expr() {
 	# we need the pairs sorted due to how the sed expr generation works
 	local IFS=$'\01\n'
+	local i
 	sorted=($(for (( i=0; i<${#search[@]}; i++ )); do
 		echo "${column[i]}"$'\01'"${search[i]}"
 	done | sort -n -t$'\01'))
@@ -100,6 +101,7 @@ data_add() {
 	local res=
 	local IFS=$'\n'
 
+	local i
 	for i in "${ref[@]}"; do
 		_trim_control "$i"
 		res+="$tr$delim"
@@ -257,7 +259,7 @@ data_replace() {
 		fi
 
 	# fi
-	
+	local i
 	for i in "${ref[@]}"; do
 		_trim_control "$i"
 		output+="$tr$delim"

From 9c403fbc3b87d6e6f91cf962dae4413ca330711b Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Wed, 19 Feb 2025 23:05:57 +0100
Subject: [PATCH 111/112] notORM: data_add now supports auto-increment IDs

---
 src/notORM.sh | 22 ++++++++++++++++++++--
 1 file changed, 20 insertions(+), 2 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index 3767de5..3e009ef 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -90,17 +90,35 @@ _data_gen_expr() {
 # a store can be any file, as long as we have r/w access to it and the
 # adjacent directory.
 #
+# 3rd argument is optional, and will specify whether to insert an auto-increment
+# ID column. False by default; Setting to true will cause an internal data_iter
+# call. The inserted ID column is always the zeroeth one.
+#
 # this function will create some helper files if they don't exist. those
 # shouldn't be removed, as other functions may use them for data mangling.
 #
-# data_add(store, array)
+# data_add(store, array, [numbered])
 data_add() {
 	[[ ! -v "$2" ]] && return 1
 	local -n ref="$2"
-	[[ ! -f "$1" ]] && echo "${#ref[@]}" > "${1}.cols"
 	local res=
 	local IFS=$'\n'
 
+	if [[ ! -f "$1" ]]; then
+		if [[ "$3" == true ]]; then
+			res+="0$delim"
+			echo "$((${#ref[@]}+1))" > "${1}.cols"
+		else
+			echo "${#ref[@]}" > "${1}.cols"
+		fi
+	elif [[ "$3" == true ]]; then
+		local data
+		data_iter "$1" { } : # get last element
+		local id=$(( ${data[0]}+1 )) # returns 1 on non-int values
+		
+		res+="$id$delim"
+	fi
+
 	local i
 	for i in "${ref[@]}"; do
 		_trim_control "$i"

From ec6a0d81a98cbbcff71453ebf9d4f2499e46bdcb Mon Sep 17 00:00:00 2001
From: sdomi <ja@sdomi.pl>
Date: Thu, 20 Feb 2025 15:45:44 +0100
Subject: [PATCH 112/112] notORM: fix spurious missing backslashes

---
 src/notORM.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/notORM.sh b/src/notORM.sh
index 3e009ef..81a0bcd 100755
--- a/src/notORM.sh
+++ b/src/notORM.sh
@@ -155,7 +155,7 @@ data_get() {
 	fi
 
 	local line
-	while read line; do
+	while read -r line; do
 		IFS=$delim
 		
 		# LOAD-BEARING!!
@@ -201,7 +201,7 @@ data_iter() {
 		local column=("${4:-0}")
 	fi
 
-	while read line; do
+	while read -r line; do
 		IFS=$delim
 		
 		# LOAD BEARING; see data_get