minetest/minetest — pull request #1869 by Jeija (2014-11-23 18:41:03+00:00)
Title: Add scriptapi interface to HTTPFetchRequest

This pull request enables downloading files or requesting URLs, both POST and GET methods, by providing a simple interface to HTTPFechRequest in Lua.

## Use cases:
* Share creations with others, like buildings, worldedit schemas, mesecons luacontroller code snippets
* Inter-server-communication: Chat, trade and much more
* Update server status on a webpage
* Ingame IRC (with server as wrapper HTTP -> IRC)
* Ingame to real-life interface, enables stuff like https://www.youtube.com/watch?v=jo_GT6a4M90
* Check for updates or install mod updates
* Lots of other stuff

## Code
You can use different ways to perform requests:
```Lua
local handle = minetest.http_request_async({...})
...
local response = minetest.http_request_async_get(handle)
```
This performs a request asynchronously. A response is provided as soon as the server answer or when the connection times out.

```Lua
local response = minetest.http_request_sync({...})
```
This performs a synchronous request which blocks the server thread, but provides direct results as return value.

```Lua
minetest.http_request({...}, function (response)
end)
```
This performs an asynchronous http request. The second argument is a callback function that is called as soon as the server answers or when the connection times out.

Requests must have the following form:
```Lua
{
url = "http://example.org",
timeout = 10, -- optional, in seconds, uses default values if none provided,
post_data = "POSTing this data" -- optional, performs POST request with given data if provided
}
```

Responses will be a table like this one:
```Lua
{
succeeded = true,
timeout = false,
response_code = 200,
data = "response data"
}
```

### Demo mod
You can get a [demo mod](http://mesecons.net/random/curl.zip) that uses HTTP requests. Just read through init.lua and get the nodes from the creative inventory.

## Security
I'd love to disable this function by default and let the server owner / player enable it, but I don't know of any way to achieve something like this as settings in minetest.conf can be altered by mods which renders such an option useless.
Mods can currently use os.execute. So basically, functionality like this is already possible, even though it might be more complex to make it use wget / curl on Unixes and various different methods to request URLs on Windows.

So: As long as mods can do os.execute(), this doesn't affect security in any way. Once that changes, you can easily add configuration checks to the functions in doubt.

Considering the os.execute() security hole has been known since the scriptapi was created and was never closed, I don't see how this could impact security.

Moreover, I don't know of a single case where the os.execute() hole has been exploited by a mod. As mods are open source, you could easily discover such wrongdoings and ban the respective mod creater and delete the mod.
Compared to os.execute(), this even improves security as HTTP requests are logged for server owners to see this way:
```
19:19:02: ACTION[ServerThread]: Mod performs HTTP request with URL http://httpbin.org/post
```