Commit Graph

6 Commits

Author SHA1 Message Date
Xavier Del Campo Romero afe0681c0b
Limit maximum multipart/form-data pairs and files
A malicious user could inject an infinite number of empty files or
key/value pairs into a request in order to exhaust the device's
resources.
2024-02-19 23:00:56 +01:00
Xavier Del Campo 1755ee663c
http: Add support for PUT
Notes:

- Since curl would use the "Expect: 100-continue" header field for PUT
operations, this was a good operation to fix the existing issues in its
implementation.

Breaking changes:

- expect_continue is no longer exclusive to struct http_post. Now, it
has been moved into struct http_payload and it is up to users to check
it.
2023-11-20 16:34:24 +01:00
Xavier Del Campo 98f5f52461
Split handler_loop from handler_listen
Some applications might set up a struct handler object to listen on any
port i.e., 0, but still need a way to determine which port number was
eventually selected by the implementation.

Therefore, handler_listen has been reduced to the server initialization
bit, whereas the main loop has been split into its own function, namely
handler_loop.

Because of these changes, it no longer made sense for libweb to write
the selected port to standard output, as this is something now
applications can do on their own.
2023-11-20 16:06:19 +01:00
Xavier Del Campo Romero 65031ca350
Send HTTP headers to payload callback
Even if libweb already parses some common headers, such as
Content-Length, some users might find it interesting to inspect which
headers were received from a request.

Since HTTP/1.1 does not define a limit on the number of maximum headers
a client can send, for security reasons a maximum value must be provided
by the user. Any extra headers shall be then discarded by libweb.

An example application showing this new feature is also provided.
2023-11-18 01:03:12 +01:00
Xavier Del Campo Romero 9ac68fd76c
http: Make http_decode_url return int
So far, it was not possible callers to distinguish between decoding
errors, as caused by ill-formed input, from fatal errors.
2023-11-12 01:29:54 +01:00
Xavier Del Campo Romero 0222b75e85
Rename project from slweb to libweb
It was found out there was another project of the same name around
(https://git.sr.ht/~strahinja/slweb/), also related to website
generation.

In order to avoid confusion, a new name has been chosen for this
project. Surprisingly, libweb was not in use by any distributions
(according to https://repology.org and AUR index), and it should
reflect well the intention behind this project i.e., being a library
to build web-related stuff.
2023-10-11 00:07:13 +02:00