84 lines
2.9 KiB
Diff
84 lines
2.9 KiB
Diff
From a792b23ab87cacbf4dd9462bf7b675fa678efbae Mon Sep 17 00:00:00 2001
|
|
From: Milan Crha <mcrha@redhat.com>
|
|
Date: Tue, 15 Apr 2025 09:59:05 +0200
|
|
Subject: [PATCH] soup-server-http2: Check validity of the constructed
|
|
connection URI
|
|
|
|
The HTTP/2 pseudo-headers can contain invalid values, which the GUri rejects
|
|
and returns NULL, but the soup-server did not check the validity and could
|
|
abort the server itself later in the code.
|
|
|
|
Closes #429
|
|
---
|
|
.../http2/soup-server-message-io-http2.c | 4 +++
|
|
tests/http2-test.c | 28 +++++++++++++++++++
|
|
2 files changed, 32 insertions(+)
|
|
|
|
diff --git a/libsoup/server/http2/soup-server-message-io-http2.c b/libsoup/server/http2/soup-server-message-io-http2.c
|
|
index 943ecfd3..f1fe2d5c 100644
|
|
--- a/libsoup/server/http2/soup-server-message-io-http2.c
|
|
+++ b/libsoup/server/http2/soup-server-message-io-http2.c
|
|
@@ -771,9 +771,13 @@ on_frame_recv_callback (nghttp2_session *session,
|
|
char *uri_string;
|
|
GUri *uri;
|
|
|
|
+ if (msg_io->scheme == NULL || msg_io->authority == NULL || msg_io->path == NULL)
|
|
+ return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
|
|
uri_string = g_strdup_printf ("%s://%s%s", msg_io->scheme, msg_io->authority, msg_io->path);
|
|
uri = g_uri_parse (uri_string, SOUP_HTTP_URI_FLAGS, NULL);
|
|
g_free (uri_string);
|
|
+ if (uri == NULL)
|
|
+ return NGHTTP2_ERR_TEMPORAL_CALLBACK_FAILURE;
|
|
soup_server_message_set_uri (msg_io->msg, uri);
|
|
g_uri_unref (uri);
|
|
|
|
diff --git a/tests/http2-test.c b/tests/http2-test.c
|
|
index 5b6da5e4..ec7972fe 100644
|
|
--- a/tests/http2-test.c
|
|
+++ b/tests/http2-test.c
|
|
@@ -1341,6 +1341,30 @@ do_connection_closed_test (Test *test, gconstpointer data)
|
|
g_uri_unref (uri);
|
|
}
|
|
|
|
+static void
|
|
+do_broken_pseudo_header_test (Test *test, gconstpointer data)
|
|
+{
|
|
+ char *path;
|
|
+ SoupMessage *msg;
|
|
+ GUri *uri;
|
|
+ GBytes *body = NULL;
|
|
+ GError *error = NULL;
|
|
+
|
|
+ uri = g_uri_parse_relative (base_uri, "/ag", SOUP_HTTP_URI_FLAGS, NULL);
|
|
+
|
|
+ /* an ugly cheat to construct a broken URI, which can be sent from other libs */
|
|
+ path = (char *) g_uri_get_path (uri);
|
|
+ path[1] = '%';
|
|
+
|
|
+ msg = soup_message_new_from_uri (SOUP_METHOD_GET, uri);
|
|
+ body = soup_test_session_async_send (test->session, msg, NULL, &error);
|
|
+ g_assert_error (error, G_IO_ERROR, G_IO_ERROR_PARTIAL_INPUT);
|
|
+ g_assert_null (body);
|
|
+ g_clear_error (&error);
|
|
+ g_object_unref (msg);
|
|
+ g_uri_unref (uri);
|
|
+}
|
|
+
|
|
static gboolean
|
|
unpause_message (SoupServerMessage *msg)
|
|
{
|
|
@@ -1662,6 +1686,10 @@ main (int argc, char **argv)
|
|
setup_session,
|
|
do_connection_closed_test,
|
|
teardown_session);
|
|
+ g_test_add ("/http2/broken-pseudo-header", Test, NULL,
|
|
+ setup_session,
|
|
+ do_broken_pseudo_header_test,
|
|
+ teardown_session);
|
|
|
|
ret = g_test_run ();
|
|
|
|
--
|
|
2.49.0
|
|
|