Merge branch 'mr-178'

code/client/shared/Utils.cpp

@@ -309,3 +309,53 @@ std::wstring ToWide(std::string_view narrow)
 
 	return std::move(outVec);
 }
+
+std::map<std::string, std::string> ParsePOSTString(const std::string_view& postDataString)
+{
+	std::map<std::string, std::string> postMap;
+
+	for (int i = 0; i < postDataString.size(); i++)
+	{
+		int keyIndex = 0;
+		int keyLen = 0;
+		for (int keyItr = i; keyItr < postDataString.size(); keyItr++)
+		{
+			if (postDataString[keyItr] == '=')
+			{
+				break;
+			}
+			keyLen++;
+		}
+
+		keyIndex = i;
+		i = (i + keyLen + 1);
+
+		int valueLen = 0;
+		for (int valueItr = i; valueItr < postDataString.size(); valueItr++)
+		{
+			if (postDataString[valueItr] == '&')
+			{
+				break;
+			}
+			valueLen++;
+		}
+
+		if (valueLen)
+		{
+			std::string key(&postDataString[keyIndex], keyLen);
+			std::string value(&postDataString[i], valueLen);
+
+			std::string keyDecoded;
+			std::string valueDecoded;
+
+			UrlDecode(key, keyDecoded);
+			UrlDecode(value, valueDecoded);
+
+			postMap[keyDecoded] = valueDecoded;
+		}
+
+		i += valueLen;
+	}
+
+	return postMap;
+}

code/client/shared/Utils.h

@@ -294,6 +294,8 @@ void SetThreadName(int threadId, const char* threadName);
 std::wstring ToWide(std::string_view narrow);
 std::string ToNarrow(std::wstring_view wide);
 
+std::map<std::string, std::string> ParsePOSTString(const std::string_view& postDataString);
+
 #ifdef COMPILING_CORE
 extern "C" bool DLL_EXPORT CoreIsDebuggerPresent();
 extern "C" void DLL_EXPORT CoreSetDebuggerPresent();

code/components/citizen-server-impl/src/ClientHttpHandler.cpp

@@ -12,6 +12,7 @@
 using json = nlohmann::json;
 
 static std::shared_ptr<ConVar<bool>> g_threadedHttpVar;
+static std::shared_ptr<ConVar<int>> g_maxClientEndpointRequestSize;
 
 namespace fx
 {
@@ -27,41 +28,6 @@ namespace fx
 		return {};
 	}
 
-	std::map<std::string, std::string> ParsePOSTString(const std::string_view& postDataString)
-	{
-		std::map<std::string, std::string> postMap;
-
-		// split the string by the usual post map characters
-		int curPos = 0;
-
-		while (true)
-		{
-			int endPos = postDataString.find_first_of('&', curPos);
-
-			int equalsPos = postDataString.find_first_of('=', curPos);
-
-			std::string key;
-			std::string value;
-
-			UrlDecode(std::string(postDataString.substr(curPos, equalsPos - curPos)), key);
-			UrlDecode(std::string(postDataString.substr(equalsPos + 1, endPos - equalsPos - 1)), value);
-
-			postMap[key] = value;
-
-			// save and continue
-			curPos = endPos;
-
-			if (curPos == std::string::npos)
-			{
-				break;
-			}
-
-			curPos++;
-		}
-
-		return postMap;
-	}
-
 	static auto GetClientEndpointHandler(fx::ServerInstanceBase* instance)
 	{
 		return [=](const fwRefContainer<net::HttpRequest>& request, fwRefContainer<net::HttpResponse> response)
@@ -80,6 +46,12 @@ namespace fx
 					response->End(json::object({ {"error", error} }).dump(-1, ' ', false, json::error_handler_t::replace));
 				};
 
+				if (postData.size() > g_maxClientEndpointRequestSize->GetValue())
+				{
+					endError("POST data too big");
+					return;
+				}
+
 				auto postMap = ParsePOSTString(std::string(postData.begin(), postData.end()));
 
 				auto method = postMap.find("method");
@@ -165,6 +137,7 @@ static InitFunction initFunction([]()
 	fx::ServerInstanceBase::OnServerCreate.Connect([](fx::ServerInstanceBase* instance)
 	{
 		g_threadedHttpVar = instance->AddVariable<bool>("sv_threadedClientHttp", ConVar_None, true);
+		g_maxClientEndpointRequestSize = instance->AddVariable<int>("sv_maxClientEndpointRequestSize", ConVar_None, 1024 * 100);
 
 		instance->SetComponent(new fx::ClientMethodRegistry());
 

code/components/citizen-server-impl/src/GameServer.cpp

@@ -630,8 +630,6 @@ namespace fx
 		return variable->GetValue();
 	}
 
-	std::map<std::string, std::string> ParsePOSTString(const std::string_view& postDataString);
-
 	void GameServer::ProcessPacket(NetPeerBase* peer, const uint8_t* data, size_t size)
 	{
 		// create a netbuffer and read the message type

code/components/nui-core/src/InternalRPCHandler.cpp

@@ -117,33 +117,7 @@ bool InternalRPCHandler::ProcessRequest(CefRefPtr<CefRequest> request, CefRefPtr
 
 			delete[] bytes;
 
-			// split the string by the usual post map characters
-			int curPos = 0;
-
-			while (true)
-			{
-				int endPos = postDataString.find_first_of('&', curPos);
-
-				int equalsPos = postDataString.find_first_of('=', curPos);
-
-				std::string key;
-				std::string value;
-
-				UrlDecode(postDataString.substr(curPos, equalsPos - curPos), key);
-				UrlDecode(postDataString.substr(equalsPos + 1, endPos - equalsPos - 1), value);
-
-				postMap[key] = value;
-
-				// save and continue
-				curPos = endPos;
-
-				if (curPos == std::string::npos)
-				{
-					break;
-				}
-
-				curPos++;
-			}
+			postMap = ParsePOSTString(postDataString);
 		}
 	}
 

code/components/ros-patches-five/src/ros/Entitlements.cpp

@@ -30,42 +30,6 @@ using json = nlohmann::json;
 
 int StoreDecryptedBlob(void* a1, void* a2, uint32_t a3, void* inOutBlob, uint32_t a5, void* a6);
 
-// TODO: turn into a generic utility
-static std::map<std::string, std::string> ParsePOSTString(const std::string& postDataString)
-{
-	std::map<std::string, std::string> postMap;
-
-	// split the string by the usual post map characters
-	int curPos = 0;
-
-	while (true)
-	{
-		int endPos = postDataString.find_first_of('&', curPos);
-
-		int equalsPos = postDataString.find_first_of('=', curPos);
-
-		std::string key;
-		std::string value;
-
-		UrlDecode(postDataString.substr(curPos, equalsPos - curPos), key);
-		UrlDecode(postDataString.substr(equalsPos + 1, endPos - equalsPos - 1), value);
-
-		postMap[key] = value;
-
-		// save and continue
-		curPos = endPos;
-
-		if (curPos == std::string::npos)
-		{
-			break;
-		}
-
-		curPos++;
-	}
-
-	return postMap;
-}
-
 extern std::string g_entitlementSource;
 
 bool LoadOwnershipTicket();