Repository navigation
Conversation
extract_url() split the host from the path on the first '/', so a request-target like "http://example.com?q=1", which is valid absolute-form (RFC 3986 section 3.2: the authority ends at '/', '?' or '#'), left the query in the host: tinyproxy tried to resolve "example.com?q=1", and the filter matched against that string instead of the host. Split on the first of '/', '?' or '#', and give a path that starts with '?' or '#' its leading '/'.
Contributor
|
please quote the relevant section of the RFC allowing this. the only thing i found is
refering to path, not host. |
Author
I think at this point in the code we are working with the authority instead of just the host (it strips the username_password then the port a few lines later |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
extract_url()splits the host from the path on the first/only. A request-target likehttp://example.com?q=1is valid absolute-form (RFC 3986 §3.2: the authority ends at/,?or#), but tinyproxy keeps the query in the host: it tries to resolveexample.com?q=1, andFiltermatches against that string instead of the host.I hit this with a Java application whose HTTP client sends
GET http://search.example.net?type=artist&query=... HTTP/1.1with no/before the query. WithFilterDefaultDeny Yesevery one of those requests was refused, although the domain was allowed.This splits on the first of
/,?or#, and gives a path that starts with?or#its leading/.Raw request lines (curl normalises the URL, so these were sent over a plain socket), with a filter allowing only
(^|\.)example\.com$:http://example.com?q=1http://example.com#fraghttp://[email protected]?q=1http://evil.invalid?.example.comhttp://evil.invalid#.example.comhttp://example.com:80?q=1http://example.com/?q=1Built and tested on master; no new compiler warnings.