Reject trailing characters in URL port numbers (#2593)

parse_port checked only the error code of from_chars, which stops at
the first non-digit, so http://host:80abc was accepted as port 80, and
a redirect Location with such a port was followed. RFC 3986 defines
port as *DIGIT. Require the whole string to be consumed, as #2590 does
for quality values.
This commit is contained in:
KBS authored and GitHub committed 2026-10-02 21:07:34 -04:00
1 parent 43863e1f67
commit 10aadd57f7
2 files changed
+36 -1

No files matched your search

+3 -1
View File
@@ -834,7 +834,9 @@ inline from_chars_result<double> from_chars(const char *first, const char *last,
inline bool parse_port(const char *s, size_t len, int &port) {
int val = 0;
auto r = from_chars(s, s + len, val);
if (r.ec != std::errc{} || val < 1 || val > 65535) { return false; }
if (r.ec != std::errc{} || r.ptr != s + len || val < 1 || val > 65535) {
return false;
}
port = val;
return true;
}