fix %3d handling in path part and add attack.sh

https://github.com/warmcat/libwebsockets/issues/518

Signed-off-by: Andy Green <andy@warmcat.com>

diff --git a/lib/parsers.c b/lib/parsers.c
index cfacaced74222e0c3077623ba71e0869a58eac28..95257e70a4a1e316e1a23feec10080595e19d901 100644 (file)
--- a/lib/parsers.c
+++ b/lib/parsers.c
@@ -675,7 +675,9 @@ lws_parse(struct lws *wsi, unsigned char c)
                                goto swallow;
                        }
                        /* uriencoded = in the name part, disallow */
-                       if (c == '=' && enc && !wsi->u.hdr.post_literal_equal)
+                       if (c == '=' && enc &&
+                           ah->frag_index[WSI_TOKEN_HTTP_URI_ARGS] &&
+                           !wsi->u.hdr.post_literal_equal)
                                c = '_';
 
                        /* after the real =, we don't care how many = */

diff --git a/test-server/attack.sh b/test-server/attack.sh
index 7fe3d84107662667bebeb9e273e1cd0b2a1010af..bf4823e765bea9f820c393dd91cec6abdd989508 100755 (executable)
--- a/test-server/attack.sh
+++ b/test-server/attack.sh
@@ -50,6 +50,14 @@ function check {
                fi
        fi
 
+       if [ "$1" == "0" ] ; then
+               a="`dd if=$LOG bs=1 skip=$LEN 2>/dev/null |grep "get\ \ =" | tr -s ' ' | cut -d' ' -f4-`"
+               if [ "$a" != "$2" ] ; then
+                       echo "URL path '$a' not $2"
+                       exit 1
+               fi
+       fi
+
        if [ "$1" == "1" ] ; then
                a="`dd if=$LOG bs=1 skip=$LEN 2>/dev/null |grep URI\ Arg\ 1\: | tr -s ' ' | cut -d' ' -f5-`"
                if [ "$a" != "$2" ] ; then
@@ -106,9 +114,10 @@ check 1 "key1=value1"
 check
 
 echo
-echo "---- ? processing (/test?key1%3d2=value1)"
+echo "---- ? processing (/t%3dest?key1%3d2=value1)"
 rm -f /tmp/lwscap
-echo -e "GET /test?key1%3d2=value1 HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
+echo -e "GET /t%3dest?key1%3d2=value1 HTTP/1.1\x0d\x0a\x0d\x0a" | nc $SERVER $PORT | sed '1,/^\r$/d'> /tmp/lwscap
+check 0 "/t=est"
 check 1 "key1_2=value1"
 check