wt/cpp-httplib
1
0
Fork 0
mirror of https://github.com/yhirose/cpp-httplib.git synced 2026-10-01 05:02:29 +07:00
Code Issues Packages Projects Releases Wiki Activity

reject trailing bytes after IPv6 host literal in parse_url (#2536)

Browse Source
This commit is contained in:
metsw24-max
2026-08-14 21:27:40 -04:00
committed by GitHub
parent 1e9d6f0b0b
commit 2d8e49dd9b
2 changed files with 26 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
httplib.h
+9
View File
@@ -851,6 +851,15 @@ inline bool parse_url(const std::string &url, UrlComponents &uc) {
}
pos = close + 1;
// The IPv6 literal is the whole host, so ']' must be followed by a port,
// path, query or fragment delimiter (or the end of input). Otherwise the
// trailing bytes would be folded into the path while the connection
// still targets the bracketed address.
if (pos < url.size() && url[pos] != ':' && url[pos] != '/' &&
url[pos] != '?' && url[pos] != '#') {
return false;
}
} else {
auto end = url.find_first_of(":/?#", pos);
if (end == std::string::npos) { end = url.size(); }
test/test.cc
+17
View File
@@ -15563,6 +15563,23 @@ TEST(ParseUrlTest, VariousPatterns) {
detail::UrlComponents uc;
ASSERT_FALSE(detail::parse_url("http://[::1/path", uc));
}
{
// Bytes after the IPv6 literal must be a delimiter, not folded into
// the path while the connection still targets the bracketed host.
detail::UrlComponents uc;
ASSERT_FALSE(detail::parse_url("http://[::1]evil.com/", uc));
}
{
detail::UrlComponents uc;
ASSERT_FALSE(detail::parse_url("http://[::1]evil", uc));
}
{
detail::UrlComponents uc;
ASSERT_TRUE(detail::parse_url("http://[::1]/path", uc));
EXPECT_EQ("::1", uc.host);
EXPECT_TRUE(uc.port.empty());
EXPECT_EQ("/path", uc.path);
}
{
detail::UrlComponents uc;
ASSERT_TRUE(detail::parse_url("//example.com/path?q=1", uc));