aboutsummaryrefslogtreecommitdiff
Commit message (Collapse)AuthorAgeFilesLines
* handler.c: Fix double freefix-double-freeXavier Del Campo Romero2026-01-311-0/+3
|
* form.c: Fix leak on invalid formv0.5.1Xavier Del Campo Romero2025-10-261-2/+1
| | | | | When one or more entries have been appended to a struct form instance, but then an error occurs, those valid entries must be deallocated, too.
* Add man3 pages for the form APIv0.5.0Xavier Del Campo Romero2025-10-095-0/+207
|
* Free chunk/step user data on context freeXavier Del Campo Romero2025-10-082-2/+18
| | | | | | | | | So far, users had no way to free user-defined data allocated inside the chunk/step function pointers whenever an error occurred. Now, the free callback can be also used in conjunction with chunk/step, so that user-defined data is now deallocated when the operation finishes (in the case of chunk-encoded data) or an error occurs.
* libweb_http.7: Remove obsolete informationXavier Del Campo Romero2025-10-081-20/+5
|
* Implement HTTP chunk encodingXavier Del Campo Romero2025-10-085-26/+198
| | | | | | A new function pointer, namely chunk, has been added to struct http_response so that library users can generate their message bodies dynamically.
* Allow custom backlog connectionsXavier Del Campo Romero2025-10-065-7/+32
| | | | | | | | | libweb calls listen(2) when setting up the HTTP server, and its backlog argument was hardcoded to 10. While probably not an issue for some applications, it can be too limiting for some others. Therefore, it is desirable to allow library users to set up their own limits. Otherwise, 10 is still chosen as a sane default.
* libweb_http.7: Add note about HTTP responsesXavier Del Campo Romero2025-10-061-0/+35
|
* Fix design issues with async responses, add async exampleXavier Del Campo Romero2025-10-0610-56/+470
| | | | | | | | | | | | | | | | | | struct http_response did not provide users any void * that could be used to maintain a state between calls to an asynchronous HTTP response. On the other hand, the user pointer could not be used for this purpose, since it is shared among all HTTP clients for a given struct handler instance. Moreover, the length callback was still not supporting this feature, which in fact might be required by some users. Implementing this was particularly challenging, as this broke the current assumption that all bytes on a call to http_read were being processed. Now, since a client request can only be partially processed because of the length callback, http_read must take this into account so that the remaining bytes are still available for future calls, before reading again from the file descriptor.
* Implement form interfaceXavier Del Campo Romero2025-10-0211-0/+455
| | | | | This new interface allows library users to parse application/x-www-form-urlencoded data conveniently.
* examples: Add distclean targetXavier Del Campo Romero2025-10-026-0/+19
|
* examples/Makefile: Increase flexibilityXavier Del Campo Romero2025-10-021-12/+9
| | | | | The former implementation required redundant code for every new directory.
* html.c: Replace \n with <br> on html_encodeXavier Del Campo Romero2025-09-281-1/+2
| | | | | This replacement can come in handy for library users dealing with multi-line user-generated content.
* html: Make html_encode publicXavier Del Campo Romero2025-09-283-1/+47
| | | | | Among other reasons, this function can be useful to sanitize user-generated content before assigning it do a node.
* html.c: Do not recurse on siblingsXavier Del Campo Romero2025-09-271-7/+21
| | | | | It is not required to do so. Otherwise, nodes with many siblings could lead to a very deep call stack for no reason.
* Implement async HTTP responsesXavier Del Campo Romero2025-09-244-44/+140
| | | | | | | | | | | | Sometimes, library users cannot return a HTTP response as soon as the request is received, or the operations that are required to generate it can take a long time. In order to solve this, libweb adds a new member to struct http_response, namely step, which must be assigned to a function whenever a HTTP response should be generated in a non-blocking manner. Leaving the function pointer as null will fall back to the default behaviour.
* http.c: Always set SameSite=Strict to cookiesXavier Del Campo Romero2025-09-231-6/+7
| | | | | | | This cookie attribute allows to mitigate CSRF attacks, while not requiring the server to store additional data. [1] [1]: https://owasp.org/www-community/SameSite
* Implement HTTP byte servingXavier Del Campo Romero2024-11-112-26/+275
| | | | | | | | | | | | | | This commit allows the HTTP server to return partial content to clients, rather than returning the whole resource. This can be particularly useful for applications such as audio/video playback or showing large PDF files. Notes: - Applications must not care about partial contents i.e., if a valid user request was made, applications must still return HTTP status 200 ("OK"), as usual. The HTTP server will then translate the status code to 206 ("Partial Content") if required.
* http.c: Always call ctx_to_payloadXavier Del Campo Romero2024-10-041-46/+10
| | | | | | | | | Defining each struct http_payload manually had the risk of missing some member on the initializer. This was in fact the case for `n_headers` and `headers`, which were only assigned by ctx_to_payload, and therefore some specific HTTP requests would mistakenly not reflect such information to users.
* http.c: Avoid isspace(3) in get_boundaryXavier Del Campo Romero2024-10-041-2/+1
| | | | | | | | | According to POSIX.1-2008, this function is sensitive to the system locale, which might then have different definitions for a whitespace character. Therefore, it is safer to only check against ' ' so as to remove such a dependency.
* server.c: Fix wrong for loop rangev0.4.1Xavier Del Campo Romero2024-08-281-1/+1
|
* server.c: Multiplex client eventsXavier Del Campo Romero2024-08-251-4/+15
| | | | | | | Future commits would allow user-defined callbacks to write zero, one or more bytes to a file descriptor. If zero bytes were written, server_poll must avoid to always point to the same server_client, so that other requests from other server_client instances can still be handled.
* server.c: Fix descriptor leak on failed fcntl(2)Xavier Del Campo Romero2024-08-251-8/+14
|
* handler.c: Do not printf when exitingXavier Del Campo Romero2024-08-251-3/+0
| | | | | libweb is meant to be silent during normal operation, thus only printing to stderr on errors.
* Bump version to 0.4.0v0.4.0Xavier Del Campo Romero2024-08-2225-25/+25
|
* Move signal handling to processesXavier Del Campo Romero2024-08-228-108/+345
| | | | | | | | | | | | | | So far, libweb installed a signal handler so as to handle SIGTERM, SIGPIPE and SIGINT signals so that processes would not have to care about such details. However, it is not advisable for libraries to install signal handlers, as signals are handled on a per-process basis. The previous approach would be incompatible if several instances of the library were allocated by the same process. Unfortunately, this has the undesired side effect of adding the boilerplate code into the process.
* http.c: Fix ending boundaries not followed by CRLFXavier Del Campo Romero2024-08-221-41/+84
| | | | | | | According to RFC 2046, section 5.1.1, end boundaries might not be followed by CRLF. However, so far libweb naively relied on this behaviour as major implementations, such as cURL, Chromium or Gecko always add the optional CRLF, whereas Dillo does not.
* http.c: Accept double quotes on boundariesXavier Del Campo Romero2024-08-221-7/+66
| | | | | | | | | | | "multipart/form-data"-encoded POST requests might use double quotes for their boundaries. While this is required when invalid characters are otherwise used (e.g.: ':'), some web clients always insert double quotes. Additionally, according to RFC 2046 section 5.1.1, the boundary parameter consists of 1 to 70 characters, but libweb was not imposing such restrictions.
* http.c: Remove unneeded parameterXavier Del Campo Romero2024-08-221-17/+17
| | | | | | | | | | This parameter was rendered obsolete after the following commit: commit b0accd099fa8c5110d4c3c68830ad6fd810ca3ec Author: Xavier Del Campo Romero <xavi.dcr@tutanota.com> Date: Fri Nov 24 00:52:50 2023 +0100 http.c: Unify read operations
* http.c: Remove unused variableXavier Del Campo Romero2024-08-221-1/+1
|
* http.c: Fix memory leak on read failureXavier Del Campo Romero2024-08-221-9/+9
| | | | | | | For some unknown reason, ctx_free was only called by update_lstate, but this is not the only function that modifies a struct ctx instance. Since struct ctx is related to read operations, ctx_free must instead be called whenever http_read fails.
* http.c: Fix wrong checkXavier Del Campo Romero2024-08-221-1/+1
| | | | | | | | | | | | | p->f is a FILE *, so it is invalid to check against negative values. This bug was introduced when p->fd, a file descriptor, was replaced with p->f, a FILE *, by the following commit: commit b0accd099fa8c5110d4c3c68830ad6fd810ca3ec Author: Xavier Del Campo Romero <xavi.dcr@tutanota.com> Date: Fri Nov 24 00:52:50 2023 +0100 http.c: Unify read operations
* Bump version to 0.3.0v0.3.0Xavier Del Campo Romero2024-02-1925-25/+25
|
* CMakeLists.txt: Fix dynstr versionXavier Del Campo Romero2024-02-191-1/+1
| | | | It was accidentally bumped to 0.2.0 during libweb's 0.2.0 release.
* Limit maximum multipart/form-data pairs and filesXavier Del Campo Romero2024-02-196-4/+59
| | | | | | A malicious user could inject an infinite number of empty files or key/value pairs into a request in order to exhaust the device's resources.
* html.c: Avoid half-init objects on html_node_add_attrXavier Del Campo Romero2024-02-191-12/+23
| | | | | | The previous implementation would leave half-initialised objects if one of the calls to strdup(3) failed. Now, n->attrs is only modified when all previous memory allocations were successful.
* Bump version to 0.2.0v0.2.0Xavier Del Campo Romero2024-02-1225-26/+26
|
* README.md: Update according to status quoXavier Del Campo Romero2024-02-121-4/+4
|
* README.md: Fix typoXavier Del Campo Romero2024-02-121-1/+1
| | | | | Whereas the project is usually referred to as libweb, the CMake exported target name is simply "web".
* README.md: Add Alpine Linux build instructionsXavier Del Campo Romero2024-02-121-0/+14
|
* libweb_http.7: Update according to status quoXavier Del Campo Romero2024-02-121-60/+137
|
* libweb_html.7: Fix typoXavier Del Campo Romero2024-02-121-1/+1
|
* Update copyright notices to 2024Xavier Del Campo Romero2024-02-1224-24/+24
|
* server.c: Fix wrong priority for do_exitXavier Del Campo Romero2024-01-201-6/+6
| | | | | | Under some specific circumstances, poll(2) would return a positive integer, but do_exit might had been previously set. This caused libweb to ignore SIGTERM, with the potential risk for an endless loop.
* http.c: Solve performance issues on POST uploadsXavier Del Campo Romero2024-01-201-47/+91
| | | | | | | Profiling showed that reading multipart/form POST uploads byte-by-byte was too slow and typically led to maximum CPU usage. Therefore, the older approach (as done up to commit 7efc2b3a) was more efficient, even if the resulting code was a bit uglier.
* http.c: Unify read operationsXavier Del Campo Romero2023-11-241-159/+178
| | | | | | | | | | | | | | | | | So far, libweb would perform different read operations depending on its state: - For HTTP headers or request bodies, one byte at a time was read. - For multipart/form-data, up to BUFSIZ bytes at a time were read. However, this caused a significant extra number of syscalls for no reason and would increase code complexity, specially when parsing multiform/form-data boundaries. Now, http_read always reads up to BUFSIZ bytes at a time and process them on a loop. Apart from reducing code complexity, this should increase performance due to the (much) lower number of syscalls required.
* .gitignore: Add headers executableXavier Del Campo Romero2023-11-241-0/+1
|
* .gitmodule: Point dynstr to high-availability mirrorXavier Del Campo Romero2023-11-221-1/+1
| | | | | https://gitea.privatedns.org is a small Gitea instance running on a home server, which might be problematic for large deployments.
* headers/main.c: Update to new handler interfaceXavier Del Campo Romero2023-11-201-2/+11
|
* Merge pull request 'Add support for HTTP `PUT`' (#3) from ↵xavi2023-11-209-41/+380
|\ | | | | | | | | | | midokura-xavi/libweb:put into master Reviewed-on: https://gitea.privatedns.org/xavi/libweb/pulls/3
generated by cgit v1.2.3 (git 2.39.1) at 2026-03-14 04:41:36 +0000