simon/tiny_httpd
1
0
Fork 0
mirror of https://github.com/c-cube/tiny_httpd.git synced 2025-12-06 11:15:35 -05:00
Code Issues Projects Releases Packages Wiki Activity Actions

Validate header key's character set (#15)

Browse source 
* Validate header key's character set
This commit is contained in:
Anurag Soni 2021-05-14 12:10:33 -04:00 • committed by GitHub
parent 2340cf0bf7
commit 6b57540b50
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 16 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
src/Tiny_httpd.ml
View file

@ -321,6 +321,20 @@ module Headers = struct
let pp_pair out (k,v) = Format.fprintf out "@[<h>%s: %s@]" k v in let pp_pair out (k,v) = Format.fprintf out "@[<h>%s: %s@]" k v in
Format.fprintf out "@[<v>%a@]" (Format.pp_print_list pp_pair) l Format.fprintf out "@[<v>%a@]" (Format.pp_print_list pp_pair) l
(* token = 1*tchar
tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." / "^" / "_"
/ "`" / "|" / "~" / DIGIT / ALPHA ; any VCHAR, except delimiters
Reference: https://datatracker.ietf.org/doc/html/rfc7230#section-3.2 *)
let is_tchar = function
| '0' .. '9' | 'a' .. 'z' | 'A' .. 'Z'
| '!' | '#' | '$' | '%' | '&' | '\'' | '*' | '+' | '-' | '.' | '^'
| '_' | '`' | '|' | '~' -> true
| _ -> false
let for_all pred s =
try String.iter (fun c->if not (pred c) then raise Exit) s; true
with Exit -> false
let parse_ ~buf (bs:byte_stream) : t = let parse_ ~buf (bs:byte_stream) : t =
let rec loop acc = let rec loop acc =
let line = Byte_stream.read_line ~buf bs in let line = Byte_stream.read_line ~buf bs in
@ -332,6 +346,8 @@ module Headers = struct
try try
let i = String.index line ':' in let i = String.index line ':' in
let k = String.sub line 0 i in let k = String.sub line 0 i in
if not (for_all is_tchar k) then (
invalid_arg (Printf.sprintf "Invalid header key: %S" k));
let v = String.sub line (i+1) (String.length line-i-1) |> String.trim in let v = String.sub line (i+1) (String.length line-i-1) |> String.trim in
k,v k,v
with _ -> bad_reqf 400 "invalid header line: %S" line with _ -> bad_reqf 400 "invalid header line: %S" line