xavi/libweb/http.c, branch v0.4.0

http.c: Fix ending boundaries not followed by CRLF

2024-08-22T00:27:34+00:00

According to RFC 2046, section 5.1.1, end boundaries might not be followed by CRLF. However, so far libweb naively relied on this behaviour as major implementations, such as cURL, Chromium or Gecko always add the optional CRLF, whereas Dillo does not.

http.c: Accept double quotes on boundaries

2024-08-22T00:27:34+00:00

"multipart/form-data"-encoded POST requests might use double quotes for their boundaries. While this is required when invalid characters are otherwise used (e.g.: ':'), some web clients always insert double quotes. Additionally, according to RFC 2046 section 5.1.1, the boundary parameter consists of 1 to 70 characters, but libweb was not imposing such restrictions.

http.c: Remove unneeded parameter

2024-08-22T00:27:34+00:00

This parameter was rendered obsolete after the following commit: commit b0accd099fa8c5110d4c3c68830ad6fd810ca3ec Author: Xavier Del Campo Romero Date: Fri Nov 24 00:52:50 2023 +0100 http.c: Unify read operations

http.c: Remove unused variable

2024-08-22T00:27:34+00:00

http.c: Fix memory leak on read failure

2024-08-22T00:27:33+00:00

For some unknown reason, ctx_free was only called by update_lstate, but this is not the only function that modifies a struct ctx instance. Since struct ctx is related to read operations, ctx_free must instead be called whenever http_read fails.

http.c: Fix wrong check

2024-08-22T00:24:42+00:00

p->f is a FILE *, so it is invalid to check against negative values. This bug was introduced when p->fd, a file descriptor, was replaced with p->f, a FILE *, by the following commit: commit b0accd099fa8c5110d4c3c68830ad6fd810ca3ec Author: Xavier Del Campo Romero Date: Fri Nov 24 00:52:50 2023 +0100 http.c: Unify read operations

Limit maximum multipart/form-data pairs and files

2024-02-19T22:00:56+00:00

A malicious user could inject an infinite number of empty files or key/value pairs into a request in order to exhaust the device's resources.

http.c: Solve performance issues on POST uploads

2024-01-20T00:19:57+00:00

Profiling showed that reading multipart/form POST uploads byte-by-byte was too slow and typically led to maximum CPU usage. Therefore, the older approach (as done up to commit 7efc2b3a) was more efficient, even if the resulting code was a bit uglier.

http.c: Unify read operations

2023-11-24T00:36:38+00:00

So far, libweb would perform different read operations depending on its state: - For HTTP headers or request bodies, one byte at a time was read. - For multipart/form-data, up to BUFSIZ bytes at a time were read. However, this caused a significant extra number of syscalls for no reason and would increase code complexity, specially when parsing multiform/form-data boundaries. Now, http_read always reads up to BUFSIZ bytes at a time and process them on a loop. Apart from reducing code complexity, this should increase performance due to the (much) lower number of syscalls required.

http.c. Limit multipart/form-data to POST

2023-11-20T15:34:24+00:00