aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* WIP async responseasync-responseXavier Del Campo Romero2025-09-243-44/+121
|
* http.c: Always set SameSite=Strict to cookiesXavier Del Campo Romero2025-09-231-6/+7
| | | | | | | This cookie attribute allows to mitigate CSRF attacks, while not requiring the server to store additional data. [1] [1]: https://owasp.org/www-community/SameSite
* Implement HTTP byte servingXavier Del Campo Romero2024-11-112-26/+275
| | | | | | | | | | | | | | This commit allows the HTTP server to return partial content to clients, rather than returning the whole resource. This can be particularly useful for applications such as audio/video playback or showing large PDF files. Notes: - Applications must not care about partial contents i.e., if a valid user request was made, applications must still return HTTP status 200 ("OK"), as usual. The HTTP server will then translate the status code to 206 ("Partial Content") if required.
* http.c: Always call ctx_to_payloadXavier Del Campo Romero2024-10-041-46/+10
| | | | | | | | | Defining each struct http_payload manually had the risk of missing some member on the initializer. This was in fact the case for `n_headers` and `headers`, which were only assigned by ctx_to_payload, and therefore some specific HTTP requests would mistakenly not reflect such information to users.
* http.c: Avoid isspace(3) in get_boundaryXavier Del Campo Romero2024-10-041-2/+1
| | | | | | | | | According to POSIX.1-2008, this function is sensitive to the system locale, which might then have different definitions for a whitespace character. Therefore, it is safer to only check against ' ' so as to remove such a dependency.
* server.c: Fix wrong for loop rangev0.4.1Xavier Del Campo Romero2024-08-281-1/+1
|
* server.c: Multiplex client eventsXavier Del Campo Romero2024-08-251-4/+15
| | | | | | | Future commits would allow user-defined callbacks to write zero, one or more bytes to a file descriptor. If zero bytes were written, server_poll must avoid to always point to the same server_client, so that other requests from other server_client instances can still be handled.
* server.c: Fix descriptor leak on failed fcntl(2)Xavier Del Campo Romero2024-08-251-8/+14
|
* handler.c: Do not printf when exitingXavier Del Campo Romero2024-08-251-3/+0
| | | | | libweb is meant to be silent during normal operation, thus only printing to stderr on errors.
* Bump version to 0.4.0v0.4.0Xavier Del Campo Romero2024-08-2225-25/+25
|
* Move signal handling to processesXavier Del Campo Romero2024-08-228-108/+345
| | | | | | | | | | | | | | So far, libweb installed a signal handler so as to handle SIGTERM, SIGPIPE and SIGINT signals so that processes would not have to care about such details. However, it is not advisable for libraries to install signal handlers, as signals are handled on a per-process basis. The previous approach would be incompatible if several instances of the library were allocated by the same process. Unfortunately, this has the undesired side effect of adding the boilerplate code into the process.
* http.c: Fix ending boundaries not followed by CRLFXavier Del Campo Romero2024-08-221-41/+84
| | | | | | | According to RFC 2046, section 5.1.1, end boundaries might not be followed by CRLF. However, so far libweb naively relied on this behaviour as major implementations, such as cURL, Chromium or Gecko always add the optional CRLF, whereas Dillo does not.
* http.c: Accept double quotes on boundariesXavier Del Campo Romero2024-08-221-7/+66
| | | | | | | | | | | "multipart/form-data"-encoded POST requests might use double quotes for their boundaries. While this is required when invalid characters are otherwise used (e.g.: ':'), some web clients always insert double quotes. Additionally, according to RFC 2046 section 5.1.1, the boundary parameter consists of 1 to 70 characters, but libweb was not imposing such restrictions.
* http.c: Remove unneeded parameterXavier Del Campo Romero2024-08-221-17/+17
| | | | | | | | | | This parameter was rendered obsolete after the following commit: commit b0accd099fa8c5110d4c3c68830ad6fd810ca3ec Author: Xavier Del Campo Romero <xavi.dcr@tutanota.com> Date: Fri Nov 24 00:52:50 2023 +0100 http.c: Unify read operations
* http.c: Remove unused variableXavier Del Campo Romero2024-08-221-1/+1
|
* http.c: Fix memory leak on read failureXavier Del Campo Romero2024-08-221-9/+9
| | | | | | | For some unknown reason, ctx_free was only called by update_lstate, but this is not the only function that modifies a struct ctx instance. Since struct ctx is related to read operations, ctx_free must instead be called whenever http_read fails.
* http.c: Fix wrong checkXavier Del Campo Romero2024-08-221-1/+1
| | | | | | | | | | | | | p->f is a FILE *, so it is invalid to check against negative values. This bug was introduced when p->fd, a file descriptor, was replaced with p->f, a FILE *, by the following commit: commit b0accd099fa8c5110d4c3c68830ad6fd810ca3ec Author: Xavier Del Campo Romero <xavi.dcr@tutanota.com> Date: Fri Nov 24 00:52:50 2023 +0100 http.c: Unify read operations
* Bump version to 0.3.0v0.3.0Xavier Del Campo Romero2024-02-1925-25/+25
|
* CMakeLists.txt: Fix dynstr versionXavier Del Campo Romero2024-02-191-1/+1
| | | | It was accidentally bumped to 0.2.0 during libweb's 0.2.0 release.
* Limit maximum multipart/form-data pairs and filesXavier Del Campo Romero2024-02-196-4/+59
| | | | | | A malicious user could inject an infinite number of empty files or key/value pairs into a request in order to exhaust the device's resources.
* html.c: Avoid half-init objects on html_node_add_attrXavier Del Campo Romero2024-02-191-12/+23
| | | | | | The previous implementation would leave half-initialised objects if one of the calls to strdup(3) failed. Now, n->attrs is only modified when all previous memory allocations were successful.
* Bump version to 0.2.0v0.2.0Xavier Del Campo Romero2024-02-1225-26/+26
|
* README.md: Update according to status quoXavier Del Campo Romero2024-02-121-4/+4
|
* README.md: Fix typoXavier Del Campo Romero2024-02-121-1/+1
| | | | | Whereas the project is usually referred to as libweb, the CMake exported target name is simply "web".
* README.md: Add Alpine Linux build instructionsXavier Del Campo Romero2024-02-121-0/+14
|
* libweb_http.7: Update according to status quoXavier Del Campo Romero2024-02-121-60/+137
|
* libweb_html.7: Fix typoXavier Del Campo Romero2024-02-121-1/+1
|
* Update copyright notices to 2024Xavier Del Campo Romero2024-02-1224-24/+24
|
* server.c: Fix wrong priority for do_exitXavier Del Campo Romero2024-01-201-6/+6
| | | | | | Under some specific circumstances, poll(2) would return a positive integer, but do_exit might had been previously set. This caused libweb to ignore SIGTERM, with the potential risk for an endless loop.
* http.c: Solve performance issues on POST uploadsXavier Del Campo Romero2024-01-201-47/+91
| | | | | | | Profiling showed that reading multipart/form POST uploads byte-by-byte was too slow and typically led to maximum CPU usage. Therefore, the older approach (as done up to commit 7efc2b3a) was more efficient, even if the resulting code was a bit uglier.
* http.c: Unify read operationsXavier Del Campo Romero2023-11-241-159/+178
| | | | | | | | | | | | | | | | | So far, libweb would perform different read operations depending on its state: - For HTTP headers or request bodies, one byte at a time was read. - For multipart/form-data, up to BUFSIZ bytes at a time were read. However, this caused a significant extra number of syscalls for no reason and would increase code complexity, specially when parsing multiform/form-data boundaries. Now, http_read always reads up to BUFSIZ bytes at a time and process them on a loop. Apart from reducing code complexity, this should increase performance due to the (much) lower number of syscalls required.
* .gitignore: Add headers executableXavier Del Campo Romero2023-11-241-0/+1
|
* .gitmodule: Point dynstr to high-availability mirrorXavier Del Campo Romero2023-11-221-1/+1
| | | | | https://gitea.privatedns.org is a small Gitea instance running on a home server, which might be problematic for large deployments.
* headers/main.c: Update to new handler interfaceXavier Del Campo Romero2023-11-201-2/+11
|
* Merge pull request 'Add support for HTTP `PUT`' (#3) from ↵xavi2023-11-209-41/+380
|\ | | | | | | | | | | midokura-xavi/libweb:put into master Reviewed-on: https://gitea.privatedns.org/xavi/libweb/pulls/3
| * Add PUT server exampleXavier Del Campo2023-11-207-1/+142
| |
| * http.c. Limit multipart/form-data to POSTXavier Del Campo2023-11-201-0/+6
| |
| * http: Add support for PUTXavier Del Campo2023-11-202-40/+232
|/ | | | | | | | | | | | | | Notes: - Since curl would use the "Expect: 100-continue" header field for PUT operations, this was a good operation to fix the existing issues in its implementation. Breaking changes: - expect_continue is no longer exclusive to struct http_post. Now, it has been moved into struct http_payload and it is up to users to check it.
* Merge pull request 'Fix double-free on failed `server_client_close`' (#2) ↵xavi2023-11-202-6/+2
|\ | | | | | | | | | | from midokura-xavi/libweb:fix-double-free into master Reviewed-on: https://gitea.privatedns.org/xavi/libweb/pulls/2
| * Fix double-free on failed server_client_closeXavier Del Campo2023-11-202-6/+2
| | | | | | | | | | Even if server_client_close fails, it is needed for client_free to remove the dangling reference from h->clients.
* | Merge pull request 'Allow `listen_port` to return selected port number' (#1) ↵xavi2023-11-2013-52/+149
|\ \ | |/ |/| | | | | | | from midokura-xavi/libweb:listen-port into master Reviewed-on: https://gitea.privatedns.org/xavi/libweb/pulls/1
| * doc: Update handler_{loop,listen}Xavier Del Campo2023-11-206-40/+114
| |
| * examples/hello: Update according to handler_loopXavier Del Campo2023-11-202-5/+18
| |
| * Split handler_loop from handler_listenXavier Del Campo2023-11-204-6/+16
| | | | | | | | | | | | | | | | | | | | | | | | | | | | Some applications might set up a struct handler object to listen on any port i.e., 0, but still need a way to determine which port number was eventually selected by the implementation. Therefore, handler_listen has been reduced to the server initialization bit, whereas the main loop has been split into its own function, namely handler_loop. Because of these changes, it no longer made sense for libweb to write the selected port to standard output, as this is something now applications can do on their own.
| * README.md: Use generic term for copyright holdersXavier Del Campo2023-11-201-1/+1
|/ | | | | | Similarly to other projects within the free software community, a generic term is used so as to avoid listing every single contributor to the project.
* Send HTTP headers to payload callbackXavier Del Campo Romero2023-11-1812-13/+232
| | | | | | | | | | | | Even if libweb already parses some common headers, such as Content-Length, some users might find it interesting to inspect which headers were received from a request. Since HTTP/1.1 does not define a limit on the number of maximum headers a client can send, for security reasons a maximum value must be provided by the user. Any extra headers shall be then discarded by libweb. An example application showing this new feature is also provided.
* http.c: Fix more issues with partial boundariesXavier Del Campo Romero2023-11-121-19/+36
| | | | | | | | | - http_memmem must not check strlen(a) > n because, in case of a partial boundary, it would wrongfully return NULL. - If one or more characters from a partial boundary are found at the end of a buffer, but the next buffer does not start with the rest of the boundary, the accumulated boundary must be reset, and then look for a new boundary.
* http.c: Fix several issues with partial boundariesXavier Del Campo Romero2023-11-121-11/+17
| | | | | | | | | | - Writing to m->boundary[len] did not make any sense, as len is not meant to change between calls to read_mf_boundary_byte. - For the same reason, memset(3)ing "len + 1" did not make any sense. - When a partial boundary is found, http_memmem must still return st. - Calling reset_boundary with prev == 0 did not make sense, since that case typically means a partial boundary was found on a previous iteration, so m->blen must not be reset.
* doc: Add man3 page for http_decode_urldecode-urlXavier Del Campo Romero2023-11-122-0/+42
| | | | | | | Suprisingly, this man page was missing on the 0.1.0 release. The recent signature changes on http_decode_url have already been reflected.
* http: Make http_decode_url return intXavier Del Campo Romero2023-11-122-33/+43
| | | | | So far, it was not possible callers to distinguish between decoding errors, as caused by ill-formed input, from fatal errors.
generated by cgit v1.2.3 (git 2.39.1) at 2026-05-18 21:39:49 +0000