mirror of
https://github.com/yhirose/cpp-httplib.git
synced 2026-10-14 10:29:35 +00:00
Reject trailing characters in URL port numbers (#2593)
parse_port checked only the error code of from_chars, which stops at the first non-digit, so http://host:80abc was accepted as port 80, and a redirect Location with such a port was followed. RFC 3986 defines port as *DIGIT. Require the whole string to be consumed, as #2590 does for quality values.
This commit is contained in:
2 files changed
+36
-1
No files matched your search
@@ -834,7 +834,9 @@ inline from_chars_result<double> from_chars(const char *first, const char *last,
|
||||
inline bool parse_port(const char *s, size_t len, int &port) {
|
||||
int val = 0;
|
||||
auto r = from_chars(s, s + len, val);
|
||||
if (r.ec != std::errc{} || val < 1 || val > 65535) { return false; }
|
||||
if (r.ec != std::errc{} || r.ptr != s + len || val < 1 || val > 65535) {
|
||||
return false;
|
||||
}
|
||||
port = val;
|
||||
return true;
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user