Hardened URL + HTTP/1.x response-head parsing (see n_url_safe.h). More...

#include "nilorea/n_url_safe.h"
#include <stdio.h>
#include <string.h>

Include dependency graph for n_url_safe.c:

Functions
static int	ci_prefix (const char s, const char lit)
static void	copy_clean (char out, size_t cap, const char v, size_t n)
static void	copy_mime (char out, size_t cap, const char v, size_t n)
static int	has_token (const char s, size_t n, const char tok)
static int	lc (int c)
int	n_url_safe_find (const char text, size_t len, char out, size_t cap)
	find the first http(s) URL in a block of text
int	n_url_safe_head_parse (const char buf, size_t len, n_url_safe_head out)
	parse an HTTP/1.x response head from [buf, buf+len)
int	n_url_safe_parse (const char url, size_t len, n_url_safe out)
	parse an absolute http(s) URL [url, url+len) into a bounded struct
int	n_url_safe_resolve (const char base, size_t base_len, const char loc, size_t loc_len, char *out, size_t cap)
	resolve a redirect Location against a request URL
static int	name_eq (const char s, size_t n, const char lit)
static long long	parse_clen (const char *s, size_t n)
static int	parse_port (const char s, size_t n, uint16_t out)

Detailed Description

Hardened URL + HTTP/1.x response-head parsing (see n_url_safe.h).

Pure, bounded, non-allocating, over-read safe.

Author: Castagnier Mickael

Version: 1.0

Definition in file n_url_safe.c.

Function Documentation

◆ ci_prefix()

int ci_prefix	(	const char *	s,
		const char *	lit )

static

Definition at line 38 of file n_url_safe.c.

References lc().

Referenced by n_url_safe_find(), n_url_safe_head_parse(), n_url_safe_parse(), and n_url_safe_resolve().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ copy_clean()

void copy_clean	(	char *	out,
		size_t	cap,
		const char *	v,
		size_t	n )

static

Definition at line 207 of file n_url_safe.c.

Referenced by n_url_safe_head_parse().

Here is the caller graph for this function:

◆ copy_mime()

void copy_mime	(	char *	out,
		size_t	cap,
		const char *	v,
		size_t	n )

static

Definition at line 218 of file n_url_safe.c.

References lc().

Referenced by n_url_safe_head_parse().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ has_token()

int has_token	(	const char *	s,
		size_t	n,
		const char *	tok )

static

Definition at line 185 of file n_url_safe.c.

References name_eq().

Referenced by n_url_safe_head_parse().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ lc()

int lc ( int c )

static

Definition at line 32 of file n_url_safe.c.

Referenced by ci_prefix(), copy_mime(), and name_eq().

Here is the caller graph for this function:

◆ n_url_safe_find()

int n_url_safe_find	(	const char *	text,
		size_t	len,
		char *	out,
		size_t	cap )

find the first http(s) URL in a block of text

Writes it to out (cap includes the NUL). Trailing sentence punctuation is trimmed. The candidate must pass n_url_safe_parse (so a userinfo / malformed URL is skipped, and scanning continues), which makes this a safe trigger: it never surfaces a URL n_url_safe_parse would reject.

Parameters

text	the text to scan
len	its length
out	output buffer for the found URL
cap	capacity of out (including the NUL)

Returns: 1 if a URL was found, 0 otherwise

Examples: ex_url_safe.c.

Definition at line 344 of file n_url_safe.c.

References ci_prefix(), and n_url_safe_parse().

Referenced by main().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ n_url_safe_head_parse()

int n_url_safe_head_parse	(	const char *	buf,
		size_t	len,
		n_url_safe_head *	out )

parse an HTTP/1.x response head from [buf, buf+len)

Returns 1 only when a complete head (through CRLFCRLF) is present and the status line is well-formed; 0 if incomplete, malformed, or larger than N_URL_SAFE_HEAD_MAX. On success out->head_len is the offset of the body. Header names are matched case-insensitively; unknown headers are ignored. Bounded and over-read safe.

Parameters

buf	the received bytes
len	number of bytes in buf
out	the parsed head to fill

Returns: 1 on success, 0 otherwise

Examples: ex_url_safe.c.

Definition at line 230 of file n_url_safe.c.

References n_url_safe_head::chunked, ci_prefix(), n_url_safe_head::content_length, n_url_safe_head::content_type, copy_clean(), copy_mime(), has_token(), n_url_safe_head::head_len, le(), n_url_safe_head::location, N_URL_SAFE_HEAD_MAX, name_eq(), parse_clen(), and n_url_safe_head::status.

Referenced by main().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ n_url_safe_parse()

int n_url_safe_parse	(	const char *	url,
		size_t	len,
		n_url_safe *	out )

parse an absolute http(s) URL [url, url+len) into a bounded struct

Rejects a non-http(s) scheme, userinfo ("user@host" – an SSRF / phishing vector), an empty or over-long host, a bad port, control bytes, and anything longer than the caps. IPv6 literals in brackets are accepted (brackets stripped into host).

Parameters

url	the URL bytes
len	number of bytes in url
out	the parsed URL to fill

Returns: 1 on success, 0 otherwise

Examples: ex_url_safe.c.

Definition at line 76 of file n_url_safe.c.

References ci_prefix(), n_url_safe::host, n_url_safe::https, N_URL_SAFE_HOST_MAX, N_URL_SAFE_MAX, parse_port(), n_url_safe::path, and n_url_safe::port.

Referenced by n_url_safe_find(), n_url_safe_resolve(), and uparse().

Here is the call graph for this function:

Here is the caller graph for this function:

◆ n_url_safe_resolve()

int n_url_safe_resolve	(	const char *	base,
		size_t	base_len,
		const char *	loc,
		size_t	loc_len,
		char *	out,
		size_t	cap )

resolve a redirect Location against a request URL

Handles an absolute http(s) target, a scheme-relative "//host/..." and a root-relative "/path"; a bare relative path is refused (returns 0). The result is re-validated with n_url_safe_parse.

Parameters

base	the request URL
base_len	its length
loc	the Location value
loc_len	its length
out	output buffer for the absolute URL
cap	capacity of out (including the NUL)