feat: harden HTTP request parsing (RFC 7230)#57
Merged
mgrossmann merged 4 commits intomainfrom Apr 11, 2026
Merged
Conversation
Add validation for HTTP requests in httpin.c and httpgets.c: - Validate HTTP version (only 1.0/1.1 accepted) → 505 - Reject multiple Host headers → 400 - Validate Content-Length (digits only, non-empty) → 400 - Validate header names (RFC 7230 token chars) → 400 - Reject control characters in header values → 400 - Detect bare CR without LF in httpgets.c → 400 - Reject oversized request lines (buffer full) → 414 URI Too Long Change unknown HTTP methods from 501 Not Implemented to 405 Method Not Allowed in httppars.c (RFC 7231 §6.5.5). Fixes #10
When a request has a body (Content-Length or Transfer-Encoding) that HTTPD doesn't read (unknown method → 405, POST without Content-Type), the unread body data remains on the socket and corrupts the next request on a keep-alive connection. Force Connection: close in these cases to prevent poisoning.
Without a DOCROOT keyword in HTTPPRM, the document root was empty, causing all static file requests to return 404. Set the default to /www to match the documented sample configuration.
Switch header name validation from blocklist to allowlist using isalnum() plus RFC 7230 token special chars. The blocklist approach failed for [ and ] because CP037 asc2ebc maps ASCII 0x5B/0x5D to 0xBA/0xBB, while c2asm370 compiles '['/']' as 0xAD/0xBD — a code page mismatch that silently passed invalid characters. Also send 400 Bad Request when the HTTP version is missing from the request line (e.g. "GET / \r\n") instead of silently resetting the connection, which caused h1spec to timeout.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
httpin.chttpgets.chttppars.c)Acceptance Criteria (from h1spec)
curl -X PATCH /→ 405Test plan
make build && make link)Fixes #10