python 实用程序代码_python实用程序-HTTP服务调用系统命令（带白名单）

本文转自：http://xiaoxia.org/2011/08/16/a-small-python-program-serverinformation/

需求：

监听一个端口，提供HTTP接口，通过访问Web地址，调用程序获取各种信息。

例如，想在远程服务器上执行free命令查看远程服务器的内存使用情况，

free -m 的base64编码为 ZnJlZSAtbQ== (可以在bash下使用命令生成base64编码  echo -n "free -m"|base64 )

则访问下面的地址：

提交之后返回类似于下面的结果，total used free shared buffers cached

Mem: 16053 10521 5532 0 871 7874

-/+ buffers/cache: 1776 14277

Swap: 16002 0 16002

为了安全使用，在CommandList文本文件里保存着一个命令列表，即可以允许调用的程序。

ps aux

free -m

netstat -na

cat /proc/meminfo

cat /proc/cpuinfo

代码实现：

1.原始版本源代码：from BaseHTTPServer import *

import base64, os

decorator = lambda x: x.rstrip("\n") + " (" + base64.b64encode(x.rstrip("\n")) + ")\n"

class Handler(BaseHTTPRequestHandler):

def process(self):

path = self.path.split('?')[0].split('#')[0][1:]

try:

cmd = base64.decodestring(path)

if cmd == "":

return "Command List: \n\n" + "".join(map(decorator, file("CommandList").readlines()))

except:

return "Try to access /[Base64 String]"

if cmd+"\n" in file("CommandList").readlines():

return os.popen(cmd, "r").read()

else:

return cmd + " is not permitted"

def do_GET(self):

self.send_response(200)

buf = self.process()

self.send_header("Content-Type", "text/plain; charset=utf8")

self.send_header("Content-Length", str(len(buf)))

self.end_headers()

self.wfile.write(buf)

httpd = HTTPServer(("", 10000), Handler)

print "Server starting ..."

try:

httpd.serve_forever()

except KeyboardInterrupt: exit()

2.多线程版本源代码：

from BaseHTTPServer import *

from SocketServer import ThreadingMixIn

import base64, os

decorator = lambda x: x.rstrip("\n") + " (" + base64.b64encode(x.rstrip("\n")) + ")\n"

class Handler(BaseHTTPRequestHandler):

def process(self):

path = self.path.split('?')[0].split('#')[0][1:]

try:

cmd = base64.decodestring(path)

if cmd == "":

return "Command List: \n\n" + "".join(map(decorator, file("CommandList").readlines()))

except:

return "Try to access /[Base64 String]"

if cmd+"\n" in file("CommandList").readlines():

return os.popen(cmd, "r").read()

else:

return cmd + " is not permitted"

def do_GET(self):

self.send_response(200)

buf = self.process()

self.send_header("Content-Type", "text/plain; charset=utf8")

self.send_header("Content-Length", str(len(buf)))

self.end_headers()

self.wfile.write(buf)

class ThreadingHTTPServer(ThreadingMixIn, HTTPServer): pass

httpd = ThreadingHTTPServer(("", 10000), Handler)

print "Server starting ..."

try:

httpd.serve_forever()

except KeyboardInterrupt: exit()