n_http_req.c

Go to the documentation of this file.

/*
 * Nilorea Library
 * Copyright (C) 2005-2026 Castagnier Mickael
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
 * implied. See the License for the specific language governing
 * permissions and limitations under the License.
 *
 * SPDX-License-Identifier: Apache-2.0
 */

#include "nilorea/n_http_req.h"
 
#include <string.h>
 
static int lc(int c) {
    return (c >= 'A' && c <= 'Z') ? c - 'A' + 'a' : c;
}
 
/* Case-insensitive compare of an \p n-byte field name against a lowercase,
 * NUL-terminated literal. */
static int name_eq(const char* s, size_t n, const char* lit) {
    size_t i;
    for (i = 0; i < n; i++)
        if (lit[i] == '\0' || lc((unsigned char)s[i]) != lit[i])
            return 0;
    return lit[n] == '\0';
}
 
/* A field-name must be a non-empty token: no controls, DEL, or whitespace (so
 * "Content-Length " with a trailing space is rejected, not silently ignored,
 * a request-smuggling vector against a downstream proxy). */
static int name_token_ok(const char* s, size_t n) {
    size_t i;
    if (n == 0)
        return 0;
    for (i = 0; i < n; i++)
        if ((unsigned char)s[i] <= 0x20 || (unsigned char)s[i] == 0x7f)
            return 0;
    return 1;
}
 
/* Parse a bounded non-negative decimal [s, s+n) into *out. Returns 1 on a clean
 * parse within N_HTTP_REQ_BODY_MAX, else 0 (empty / non-digit / over cap).
 */
static int parse_body_len(const char* s, size_t n, long long* out) {
    unsigned long long v = 0;
    size_t i;
    if (n == 0)
        return 0;
    for (i = 0; i < n; i++) {
        if (s[i] < '0' || s[i] > '9')
            return 0;
        v = v * 10u + (unsigned)(s[i] - '0');
        if (v > (unsigned long long)N_HTTP_REQ_BODY_MAX)
            return 0;
    }
    *out = (long long)v;
    return 1;
}
 
/* A valid byte in an origin-form request target: printable ASCII, no space, no
 * '#' (a fragment must never reach the server). */
static int target_ok(unsigned char c) {
    return c > 0x20 && c < 0x7f && c != '#';
}
 
n_http_req_status n_http_request_parse(const char* buf, size_t len, n_http_request* out) {
    size_t scan, i, sl, p, tstart, tend, line_start, nheaders = 0;
    int have_clen = 0;
 
    if (!buf || !out)
        return N_HTTP_REQ_ERROR;
    memset(out, 0, sizeof(*out));
 
    /* locate the end of the head (CRLFCRLF) within the cap */
    scan = len < N_HTTP_REQ_HEAD_MAX ? len : (size_t)N_HTTP_REQ_HEAD_MAX;
    /* nothing shorter than the CRLFCRLF terminator itself can hold a head: the
     * loop below cannot run, head_len stays 0, and since scan < 4 implies
     * len < N_HTTP_REQ_HEAD_MAX the head_len test reports INCOMPLETE.
     * The older cppcheck used by CI folds the ternary assignment above down to
     * a single value of 0 and then calls this walk dead code, a valueflow
     * false positive: scan follows the caller's len, unknown here. Spelling
     * the bound as an explicit "if (scan < 4)" guard only moves the same
     * diagnostic onto that guard, hence the inline suppression. */
    // cppcheck-suppress knownConditionTrueFalse ; scan is caller-controlled, the walk is reachable
    for (i = 0; i + 3 < scan; i++)
        if (buf[i] == '\r' && buf[i + 1] == '\n' && buf[i + 2] == '\r' &&
            buf[i + 3] == '\n') {
            out->head_len = i + 4;
            break;
        }
    if (out->head_len == 0)
        return len < N_HTTP_REQ_HEAD_MAX ? N_HTTP_REQ_INCOMPLETE
                                         : N_HTTP_REQ_ERROR;
 
    /* ---- request line: METHOD SP target SP HTTP/1.x CRLF ---- */
    sl = 0;
    while (sl + 1 < out->head_len && !(buf[sl] == '\r' && buf[sl + 1] == '\n'))
        sl++;
    if (sl >= 4 && buf[0] == 'G' && buf[1] == 'E' && buf[2] == 'T' &&
        buf[3] == ' ') {
        out->method = N_HTTP_REQ_GET;
        p = 4;
    } else if (sl >= 5 && buf[0] == 'P' && buf[1] == 'O' && buf[2] == 'S' &&
               buf[3] == 'T' && buf[4] == ' ') {
        out->method = N_HTTP_REQ_POST;
        p = 5;
    } else {
        return N_HTTP_REQ_ERROR;
    }
    /* origin-form target, from p to the next space */
    tstart = p;
    while (p < sl && buf[p] != ' ') {
        if (!target_ok((unsigned char)buf[p]))
            return N_HTTP_REQ_ERROR;
        p++;
    }
    tend = p;
    if (tend == tstart || buf[tstart] != '/' ||
        tend - tstart > N_HTTP_REQ_PATH_MAX)
        return N_HTTP_REQ_ERROR;
    /* exactly one SP, then the version filling the rest of the line */
    if (p >= sl || buf[p] != ' ')
        return N_HTTP_REQ_ERROR;
    p++;
    if (sl - p != 8 || memcmp(buf + p, "HTTP/1.", 7) != 0 ||
        (buf[p + 7] != '0' && buf[p + 7] != '1'))
        return N_HTTP_REQ_ERROR;
    memcpy(out->path, buf + tstart, tend - tstart);
    out->path[tend - tstart] = '\0';
 
    /* ---- header lines up to the blank line ---- */
    line_start = sl + 2;
    while (line_start + 1 < out->head_len) {
        size_t le = line_start, colon, vs, vlen, nlen;
        const char *name, *val;
        while (le + 1 < out->head_len &&
               !(buf[le] == '\r' && buf[le + 1] == '\n'))
            le++;
        if (le == line_start)
            break; /* blank line: end of headers */
        if (++nheaders > N_HTTP_REQ_HEADERS_MAX)
            return N_HTTP_REQ_ERROR;
        colon = line_start;
        while (colon < le && buf[colon] != ':')
            colon++;
        if (colon >= le)
            return N_HTTP_REQ_ERROR; /* header without a colon */
        name = buf + line_start;
        nlen = colon - line_start;
        if (!name_token_ok(name, nlen))
            return N_HTTP_REQ_ERROR;
        vs = colon + 1;
        while (vs < le && (buf[vs] == ' ' || buf[vs] == '\t'))
            vs++;
        val = buf + vs;
        vlen = le - vs;
        while (vlen > 0 && (val[vlen - 1] == ' ' || val[vlen - 1] == '\t'))
            vlen--;
        if (name_eq(name, nlen, "transfer-encoding"))
            return N_HTTP_REQ_ERROR; /* no chunked, smuggling defense */
        if (name_eq(name, nlen, "content-length")) {
            long long cl;
            if (have_clen) /* duplicate Content-Length, smuggling */
                return N_HTTP_REQ_ERROR;
            if (!parse_body_len(val, vlen, &cl))
                return N_HTTP_REQ_ERROR;
            out->content_length = cl;
            have_clen = 1;
        } else if (name_eq(name, nlen, "authorization")) {
            /* capture the credential; refuse rather than truncate an over-long
             * one (a truncated bearer token must never be treated as valid) */
            if (out->authorization[0] != '\0' || vlen > N_HTTP_REQ_AUTH_MAX)
                return N_HTTP_REQ_ERROR;
            memcpy(out->authorization, val, vlen);
            out->authorization[vlen] = '\0';
        }
        line_start = le + 2;
    }
    return N_HTTP_REQ_OK;
}