HTTP parser: normalization of paths ending with "." or "..".
Earlier, the paths were normalized only if there was a "/" at the end, which
is wrong according to section 5.2.4 of RFC 3986 and hypothetically may allow
to the directory above the document root.
@@ -970,9 +970,11 @@ nxt_http_parse_complex_target(nxt_http_request_parse_t *rp)
state = sw_quoted;
continue;
case '?':
+ u--;
args = p;
goto args;
case '#':
+ u--;
goto done;
default:
state = sw_normal;
@@ -991,30 +993,42 @@ nxt_http_parse_complex_target(nxt_http_request_parse_t *rp)
}
switch (ch) {
+
case '/':
- state = sw_slash;
+ case '?':
+ case '#':
u -= 5;
+
for ( ;; ) {
if (u < rp->path.start) {
return NXT_HTTP_PARSE_INVALID;
}
+
if (*u == '/') {
u++;
break;
}
+
u--;
}
+
+ if (ch == '?') {
+ args = p;
+ goto args;
+ }
+
+ if (ch == '#') {
+ goto done;
+ }
+
+ state = sw_slash;
break;
case '%':
saved_state = state;
state = sw_quoted;
continue;
- case '?':
- args = p;
- goto args;
- case '#':
- goto done;
+
default:
state = sw_normal;
*u++ = ch;
@@ -1097,10 +1111,16 @@ nxt_http_parse_complex_target(nxt_http_request_parse_t *rp)
}
}
+ if (state >= sw_dot) {
if (state >= sw_quoted) {
return NXT_HTTP_PARSE_INVALID;
}
+ /* "/." and "/.." must be normalized similar to "/./" and "/../". */
+ ch = '/';
+ goto again;
+ }
+
args:
for (/* void */; p < rp->target_end; p++) {
