ws-server: restrict returned Sec-Websocket-Protocol to the chosen name only

https://libwebsockets.org/pipermail/libwebsockets/2016-November/002948.html

Updated to fix a problem with no protocol

https://github.com/warmcat/libwebsockets/issues/705

Change-Id: I06e9f9d5849e66291b246316008c6e2c5981a372

diff --git a/lib/server-handshake.c b/lib/server-handshake.c
index 7328e5e..ed257de 100644 (file)
--- a/lib/server-handshake.c
+++ b/lib/server-handshake.c
@@ -214,7 +214,12 @@ handshake_0405(struct lws_context *context, struct lws *wsi)
        strcpy(p, (char *)pt->serv_buf);
        p += accept_len;
 
-       if (wsi->protocol->name && wsi->protocol->name[0]) {
+       /* we can only return the protocol header if:
+        *  - one came in, and ... */
+       if (lws_hdr_total_length(wsi, WSI_TOKEN_PROTOCOL) &&
+           /*  - it is not an empty string */
+           wsi->protocol->name &&
+           wsi->protocol->name[0]) {
                LWS_CPYAPP(p, "\x0d\x0aSec-WebSocket-Protocol: ");
                p += lws_snprintf(p, 128, "%s", wsi->protocol->name);
        }