wt/cpp-httplib
1
0 Fork 0
mirror of https://github.com/yhirose/cpp-httplib.git synced 2026-10-17 10:59:39 +00:00
Code Issues Packages Projects Releases Wiki Activity

use strict hex parsing in decode_query_component (#2472)

Browse Source
This commit is contained in:
metsw24-max authored and GitHub committed 2026-06-12 13:54:04 -04:00
1 parent 7532932276
commit 28d95937b5
2 files changed
+16 -5
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

test/test.cc
+13
View File
@@ -386,6 +386,19 @@ TEST(DecodePathTest, UnicodeEncoding) {
EXPECT_EQ("", decode_path_component("%uD800"));
}
TEST(DecodeQueryTest, RejectsNonHexEscapes) {
// A sign or whitespace inside the two-character escape window must not be
// accepted as a valid percent-encoding; the sequence is passed through
// literally, matching decode_uri_component / decode_path_component.
EXPECT_EQ("%-1", decode_query_component("%-1", false));
EXPECT_EQ("%-0", decode_query_component("%-0", false));
EXPECT_EQ("%+5", decode_query_component("%+5", false));
EXPECT_EQ("% 5", decode_query_component("% 5", false));
// Well-formed escapes still decode.
EXPECT_EQ("-", decode_query_component("%2D", false));
EXPECT_EQ("A", decode_query_component("%41", false));
}
TEST(SanitizeFilenameTest, VariousPatterns) {
// Path traversal
EXPECT_EQ("passwd", httplib::sanitize_filename("../../../etc/passwd"));