New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WebUI for internally hosted Shellcheck #423

Closed
rawiriblundell opened this Issue Aug 4, 2015 · 10 comments

Comments

Projects
None yet
4 participants
@rawiriblundell

rawiriblundell commented Aug 4, 2015

Hi there. I've been promoting shellcheck to any colleagues who'll listen, in order to help them improve their scripts (and, in turn, help me to not have to constantly fix broken scripts :) ). There have been a couple of justifiable retorts of "we can't trust commercially sensitive scripts on random websites out on the big evil intergeek"

I have encouraged them to install shellcheck locally, tie in with vim etc but I get the feeling that a "shellcheck.internaldomain.tld" would still be the more popular choice.

Has there been any other demand for a webui that users can self-host? Is it possible to provide even a sanitised/simplified/lobotomised version of the .js and .php files used on the main shellcheck site?

Thanks in advance!

@deryni

This comment has been minimized.

Show comment
Hide comment
@deryni

deryni Aug 4, 2015

The html and javascript are retrievably now. The php isn't but the input and response is viewable with your browsers dev tools. The javascript just POSTs to the php script and gets back json output from shellcheck. Which means presumably the php script is just taking the input and throwing it at shellcheck running on the system. You should be able to duplicate that functionality in php (or anything else) fairly easily I would expect.

deryni commented Aug 4, 2015

The html and javascript are retrievably now. The php isn't but the input and response is viewable with your browsers dev tools. The javascript just POSTs to the php script and gets back json output from shellcheck. Which means presumably the php script is just taking the input and throwing it at shellcheck running on the system. You should be able to duplicate that functionality in php (or anything else) fairly easily I would expect.

@rawiriblundell

This comment has been minimized.

Show comment
Hide comment
@rawiriblundell

rawiriblundell Aug 4, 2015

Yep, I'm aware of that, but not 100% on the legality of retrieving said files and smacking together a site. Two of the js files and the shellcheck binary are explicitly licensed, the rest of the resources aren't clear on what license, if any, they're released under.

I agree that reverse-engineering the php files looks fairly easy, if at least to get something rudimentary working. I guess I'm after something a bit more official, updated now and then, and legally clear.

rawiriblundell commented Aug 4, 2015

Yep, I'm aware of that, but not 100% on the legality of retrieving said files and smacking together a site. Two of the js files and the shellcheck binary are explicitly licensed, the rest of the resources aren't clear on what license, if any, they're released under.

I agree that reverse-engineering the php files looks fairly easy, if at least to get something rudimentary working. I guess I'm after something a bit more official, updated now and then, and legally clear.

@deryni

This comment has been minimized.

Show comment
Hide comment
@deryni

deryni Aug 4, 2015

Oh, absolutely. An official version is certainly better. I was just pointing that from a quick glance it looks like all the "magic" is already available and the missing piece is the much simpler part.

deryni commented Aug 4, 2015

Oh, absolutely. An official version is certainly better. I was just pointing that from a quick glance it looks like all the "magic" is already available and the missing piece is the much simpler part.

@brother

This comment has been minimized.

Show comment
Hide comment
@brother

brother Aug 5, 2015

Having a small container available for this would be very nice indeed.

brother commented Aug 5, 2015

Having a small container available for this would be very nice indeed.

@koalaman

This comment has been minimized.

Show comment
Hide comment
@koalaman

koalaman Aug 5, 2015

Owner

You're the first person to ask. If it helps at all I added a notice waiving copyright on index.html and shellcheck.js to make it legally easier to copy/tweak them. The PHP file just calls shellcheck -f json -e 2148 - and pipes in the script. The whole thing was a weekend hack, and was never intended for distribution.

If someone wants to make a better web ui, I'm all for it

Owner

koalaman commented Aug 5, 2015

You're the first person to ask. If it helps at all I added a notice waiving copyright on index.html and shellcheck.js to make it legally easier to copy/tweak them. The PHP file just calls shellcheck -f json -e 2148 - and pipes in the script. The whole thing was a weekend hack, and was never intended for distribution.

If someone wants to make a better web ui, I'm all for it

@rawiriblundell

This comment has been minimized.

Show comment
Hide comment
@rawiriblundell

rawiriblundell Aug 5, 2015

That's brilliant, thanks Vidar 👍 I haven't touched PHP in about a decade, so I'm re-wrapping my head around it. Can I ask what wtfsh.php does?

rawiriblundell commented Aug 5, 2015

That's brilliant, thanks Vidar 👍 I haven't touched PHP in about a decade, so I'm re-wrapping my head around it. Can I ask what wtfsh.php does?

@koalaman

This comment has been minimized.

Show comment
Hide comment
@koalaman

koalaman Aug 5, 2015

Owner

It was for a quick prototype of a tool that names syntactical features in scripts (i.e. says <<< is a "here string"). Eventually it was supposed to link to man bash and such, but I never got beyond the basic proof of concept.

I also never removed the "name syntax" link even though it's not especially useful at the moment.

Owner

koalaman commented Aug 5, 2015

It was for a quick prototype of a tool that names syntactical features in scripts (i.e. says <<< is a "here string"). Eventually it was supposed to link to man bash and such, but I never got beyond the basic proof of concept.

I also never removed the "name syntax" link even though it's not especially useful at the moment.

@rawiriblundell

This comment has been minimized.

Show comment
Hide comment
@rawiriblundell

rawiriblundell Aug 7, 2015

ok, after a bit of head scratching, I've finally got something working with the following shellcheck.php:

<?php
// Read input, automatically urldecoded by _POST
// This will probably need to be upgraded to something else i.e. php://input
$content = $_POST['script'];
$input = escapeshellarg($content);

// Set response header
header("Content-type: application/json; charset=UTF-8");

// Pass to the shellcheck binary
passthru("echo $input | /usr/bin/shellcheck -f json -e 2148 -");
?>

How close is that?

Just got an aesthetic oddity to figure out: ^–– is showing as ^––, which I can deal with separately.

rawiriblundell commented Aug 7, 2015

ok, after a bit of head scratching, I've finally got something working with the following shellcheck.php:

<?php
// Read input, automatically urldecoded by _POST
// This will probably need to be upgraded to something else i.e. php://input
$content = $_POST['script'];
$input = escapeshellarg($content);

// Set response header
header("Content-type: application/json; charset=UTF-8");

// Pass to the shellcheck binary
passthru("echo $input | /usr/bin/shellcheck -f json -e 2148 -");
?>

How close is that?

Just got an aesthetic oddity to figure out: ^–– is showing as ^––, which I can deal with separately.

@koalaman

This comment has been minimized.

Show comment
Hide comment
@koalaman

koalaman Aug 7, 2015

Owner

This is what I did:

<?php                                                                                   
header('Content-type: application/json; charset=UTF-8');                                

$fds = array(                                                                           
    0 => array("pipe", "r"),                                                            
    1 => array("pipe", "w"),                                                            
);                                                                                      
$cwd = '/tmp';                                                                          
$env = array();                                                                         

$process = proc_open("exec /path/to/shellcheckwrapper.sh", $fds, $pipes, $cwd, $env);                   
if(is_resource($process)) {                                                             
  fwrite($pipes[0], $_POST["script"]);                                                  
  fclose($pipes[0]);                                                                    
  echo stream_get_contents($pipes[1]);                                                  
  fclose($pipes[1]);                                                                    
  proc_close($process);                                                                 
} else {                                                                                
  echo "[{ 'line': 1, 'column': 1, 'level': 'error', 'message': 'Oops, internal server error unrelated to your script! Sorry!'}]";                                                  
}                                                                                       
?>

Where shellcheckwrapper.sh is

#!/bin/dash
export LC_CTYPE=en_US.utf8
ulimit -v 50000
ulimit -t 3
exec shellcheck -f json -e 2148 -
Owner

koalaman commented Aug 7, 2015

This is what I did:

<?php                                                                                   
header('Content-type: application/json; charset=UTF-8');                                

$fds = array(                                                                           
    0 => array("pipe", "r"),                                                            
    1 => array("pipe", "w"),                                                            
);                                                                                      
$cwd = '/tmp';                                                                          
$env = array();                                                                         

$process = proc_open("exec /path/to/shellcheckwrapper.sh", $fds, $pipes, $cwd, $env);                   
if(is_resource($process)) {                                                             
  fwrite($pipes[0], $_POST["script"]);                                                  
  fclose($pipes[0]);                                                                    
  echo stream_get_contents($pipes[1]);                                                  
  fclose($pipes[1]);                                                                    
  proc_close($process);                                                                 
} else {                                                                                
  echo "[{ 'line': 1, 'column': 1, 'level': 'error', 'message': 'Oops, internal server error unrelated to your script! Sorry!'}]";                                                  
}                                                                                       
?>

Where shellcheckwrapper.sh is

#!/bin/dash
export LC_CTYPE=en_US.utf8
ulimit -v 50000
ulimit -t 3
exec shellcheck -f json -e 2148 -
@rawiriblundell

This comment has been minimized.

Show comment
Hide comment
@rawiriblundell

rawiriblundell Aug 8, 2015

Excellent, I was throwing some larger scripts at mine for testing and found that something (not sure what) was limited, giving unpredictable behaviour... I've copied yours into place and it's working perfectly. Thanks again Vidar! :)

rawiriblundell commented Aug 8, 2015

Excellent, I was throwing some larger scripts at mine for testing and found that something (not sure what) was limited, giving unpredictable behaviour... I've copied yours into place and it's working perfectly. Thanks again Vidar! :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment