security disallow repeated GET

Signed-off-by: Andy Green <andy.green@linaro.org>

diff --git a/lib/parsers.c b/lib/parsers.c
index 953e5d8..23c3b94 100644 (file)
--- a/lib/parsers.c
+++ b/lib/parsers.c
@@ -512,6 +512,12 @@ int libwebsocket_parse(struct libwebsocket *wsi, unsigned char c)
 
                        lwsl_parser("known hdr '%s'\n", wsi->u.hdr.name_buffer);
 
+                       if (n == WSI_TOKEN_GET_URI &&
+                               wsi->u.hdr.ah->frag_index[WSI_TOKEN_GET_URI]) {
+                               lwsl_warn("Duplicated GET\n");
+                               return -1;
+                       }
+
                        /*
                         * WSORIGIN is protocol equiv to ORIGIN,
                         * JWebSocket likes to send it, map to ORIGIN