diff --git a/mongoose.c b/mongoose.c index dd21977e..718371f3 100644 --- a/mongoose.c +++ b/mongoose.c @@ -3730,6 +3730,12 @@ static void handle_proxy_request(struct mg_connection *conn) { } } +static int is_valid_uri(const char *uri) { + // Conform to http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html#sec5.1.2 + // URI can be an asterisk (*) or should start with slash. + return (uri[0] == '/' || (uri[0] == '*' && uri[1] == '\0')); +} + static void process_new_connection(struct mg_connection *conn) { struct mg_request_info *ri = &conn->request_info; int keep_alive_enabled; @@ -3756,7 +3762,7 @@ static void process_new_connection(struct mg_connection *conn) { // Nul-terminate the request cause parse_http_request() uses sscanf conn->buf[conn->request_len - 1] = '\0'; if (!parse_http_request(conn->buf, ri) || - (!conn->client.is_proxy && ri->uri[0] != '/')) { + (!conn->client.is_proxy && !is_valid_uri(ri->uri))) { // Do not put garbage in the access log, just send it back to the client send_http_error(conn, 400, "Bad Request", "Cannot parse HTTP request: [%.*s]", conn->data_len, conn->buf); diff --git a/test/test.pl b/test/test.pl index 82d731a4..22676e5b 100644 --- a/test/test.pl +++ b/test/test.pl @@ -231,6 +231,8 @@ o("GET /ta/x/ HTTP/1.0\n\n", "SCRIPT_NAME=/ta/x/index.cgi", # 'HTTP/1.1 200.+keep-alive.+HTTP/1.1 200.+close', # 'Request pipelining', 2); +o("GET * HTTP/1.0\n\n", "^HTTP/1.1 404", '* URI'); + my $mime_types = { html => 'text/html', htm => 'text/html',