diff --git a/ChangeLog b/ChangeLog index b47afd26..c4b8e52b 100644 --- a/ChangeLog +++ b/ChangeLog @@ -1,3 +1,7 @@ +Sun Apr 23 20:05:44 CEST 2017 + Enforce RFC 7230's rule on no whitespace in HTTP header + field names if MHD_USE_PEDANTIC_CHECKS is set. -CG + Sun Apr 23 19:20:33 CEST 2017 Replace remaining occurences of sprintf() with MHD_snprintf_(). Thanks to Ram for pointing this out. -CG diff --git a/src/examples/minimal_example.c b/src/examples/minimal_example.c index b6e5edc3..c5796fc8 100644 --- a/src/examples/minimal_example.c +++ b/src/examples/minimal_example.c @@ -68,7 +68,7 @@ main (int argc, char *const *argv) return 1; } d = MHD_start_daemon (// MHD_USE_INTERNAL_POLLING_THREAD | MHD_USE_ERROR_LOG, - MHD_USE_AUTO | MHD_USE_INTERNAL_POLLING_THREAD | MHD_USE_ERROR_LOG, + MHD_USE_AUTO | MHD_USE_INTERNAL_POLLING_THREAD | MHD_USE_PEDANTIC_CHECKS | MHD_USE_ERROR_LOG, // MHD_USE_INTERNAL_POLLING_THREAD | MHD_USE_ERROR_LOG | MHD_USE_POLL, // MHD_USE_THREAD_PER_CONNECTION | MHD_USE_INTERNAL_POLLING_THREAD | MHD_USE_ERROR_LOG | MHD_USE_POLL, // MHD_USE_THREAD_PER_CONNECTION | MHD_USE_INTERNAL_POLLING_THREAD | MHD_USE_ERROR_LOG, diff --git a/src/microhttpd/connection.c b/src/microhttpd/connection.c index da54bf1a..cbac8447 100644 --- a/src/microhttpd/connection.c +++ b/src/microhttpd/connection.c @@ -2213,6 +2213,22 @@ process_header_line (struct MHD_Connection *connection, _("Received malformed line (no colon). Closing connection.\n")); return MHD_NO; } + if (0 != (MHD_USE_PEDANTIC_CHECKS & connection->daemon->options)) + { + /* check for whitespace before colon, which is not allowed + by RFC 7230 section 3.2.4; we count space ' ' and + tab '\t', but not '\r\n' as those would have ended the line. */ + const char *white; + + white = strchr (line, ' '); + if ( (NULL != white) && + (white < colon) ) + return MHD_NO; + white = strchr (line, '\t'); + if ( (NULL != white) && + (white < colon) ) + return MHD_NO; + } /* zero-terminate header */ colon[0] = '\0'; colon++; /* advance to value */ diff --git a/src/microhttpd/digestauth.c b/src/microhttpd/digestauth.c index 8b219296..7ade4542 100644 --- a/src/microhttpd/digestauth.c +++ b/src/microhttpd/digestauth.c @@ -413,7 +413,7 @@ check_nonce_nc (struct MHD_Connection *connection, { /* Fresh nonce, reinitialize array */ strcpy (nn->nonce, - nonce); + nonce); nn->nc = 0; nn->nmask = 0; MHD_mutex_unlock_chk_ (&daemon->nnc_lock);