2005-09-01 11:44:57 +00:00
|
|
|
#!/usr/bin/env perl
|
2005-06-26 10:27:41 +00:00
|
|
|
BEGIN {
|
2008-01-15 22:03:59 +00:00
|
|
|
# add current source dir to the include-path
|
|
|
|
# we need this for make distcheck
|
|
|
|
(my $srcdir = $0) =~ s,/[^/]+$,/,;
|
|
|
|
unshift @INC, $srcdir;
|
2005-06-26 10:27:41 +00:00
|
|
|
}
|
2005-03-02 11:27:02 +00:00
|
|
|
|
|
|
|
use strict;
|
|
|
|
use IO::Socket;
|
2018-04-21 21:23:17 +00:00
|
|
|
use Test::More tests => 12;
|
2005-06-15 09:37:18 +00:00
|
|
|
use LightyTest;
|
2005-03-02 11:27:02 +00:00
|
|
|
|
2005-06-15 09:37:18 +00:00
|
|
|
my $tf = LightyTest->new();
|
|
|
|
my $t;
|
|
|
|
|
|
|
|
ok($tf->start_proc == 0, "Starting lighttpd") or die();
|
2005-03-02 11:27:02 +00:00
|
|
|
|
|
|
|
|
2005-06-15 09:37:18 +00:00
|
|
|
$t->{REQUEST} = ( <<EOF
|
2005-03-02 11:27:02 +00:00
|
|
|
GET / HTTP/1.0
|
|
|
|
EOF
|
|
|
|
);
|
2005-08-31 12:55:44 +00:00
|
|
|
$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
|
2018-04-21 21:23:17 +00:00
|
|
|
ok($tf->handle_http($t) == 0, 'Valid HTTP/1.0 Request') or die();
|
2005-03-02 11:27:02 +00:00
|
|
|
|
2005-06-15 09:37:18 +00:00
|
|
|
$t->{REQUEST} = ( <<EOF
|
2018-04-21 21:23:17 +00:00
|
|
|
OPTIONS * HTTP/1.0
|
2005-03-02 11:27:02 +00:00
|
|
|
EOF
|
|
|
|
);
|
2005-08-31 12:55:44 +00:00
|
|
|
$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
|
2018-04-21 21:23:17 +00:00
|
|
|
ok($tf->handle_http($t) == 0, 'OPTIONS');
|
2005-03-02 11:27:02 +00:00
|
|
|
|
2005-06-15 09:37:18 +00:00
|
|
|
$t->{REQUEST} = ( <<EOF
|
2018-04-21 21:23:17 +00:00
|
|
|
OPTIONS / HTTP/1.1
|
|
|
|
Host: www.example.org
|
|
|
|
Connection: close
|
2005-03-02 11:27:02 +00:00
|
|
|
EOF
|
|
|
|
);
|
2018-04-21 21:23:17 +00:00
|
|
|
$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.1', 'HTTP-Status' => 200 } ];
|
|
|
|
ok($tf->handle_http($t) == 0, 'OPTIONS');
|
2005-03-02 11:27:02 +00:00
|
|
|
|
|
|
|
|
2018-04-21 21:23:17 +00:00
|
|
|
## Low-Level Request-Header Parsing - URI
|
2005-03-02 11:27:02 +00:00
|
|
|
|
2005-06-15 09:37:18 +00:00
|
|
|
$t->{REQUEST} = ( <<EOF
|
2018-04-21 21:23:17 +00:00
|
|
|
GET /index%2ehtml HTTP/1.0
|
2005-03-02 11:27:02 +00:00
|
|
|
EOF
|
|
|
|
);
|
2005-08-31 12:55:44 +00:00
|
|
|
$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
|
2018-04-21 21:23:17 +00:00
|
|
|
ok($tf->handle_http($t) == 0, 'URL-encoding');
|
2005-03-02 11:27:02 +00:00
|
|
|
|
2005-06-15 09:37:18 +00:00
|
|
|
$t->{REQUEST} = ( <<EOF
|
2018-04-21 21:23:17 +00:00
|
|
|
GET /index.html%00 HTTP/1.0
|
2005-03-02 11:27:02 +00:00
|
|
|
EOF
|
|
|
|
);
|
[core] behavior change: stricter URL normalization
behavior change: stricter URL normalization
Prior behavior can be obtained by configuring lighttpd.conf with:
server.http-parseopts = (“url-normalize” => “disable” )
although this is not recommended.
This behavior change was pre-announced with the releases of
lighttpd 1.4.52 (2018.11.28)
lighttpd 1.4.53 (2019.01.27)
The recommended settings are:
server.http-parseopts = (
"header-strict" => "enable",
"host-strict" => "enable",
"host-normalize" => "enable",
"url-normalize" => "enable",
"url-normalize-unreserved" => "enable",
"url-normalize-required" => "enable",
"url-ctrls-reject" => "enable",
"url-path-2f-decode" => "enable",
"url-path-backslash-trans" => "enable",
"url-path-dotseg-remove" => "enable",
"url-query-20-plus" => "enable"
)
The lighttpd defaults with this commit are slightly less strict:
server.http-parseopts = (
"header-strict" => "enable",
"host-strict" => "enable",
"host-normalize" => "enable",
"url-normalize" => "enable",
"url-normalize-unreserved" => "enable",
#"url-normalize-required" => "enable",
"url-ctrls-reject" => "enable",
"url-path-2f-decode" => "enable",
#"url-path-backslash-trans" => "enable",
"url-path-dotseg-remove" => "enable",
#"url-query-20-plus" => "enable"
)
2019-05-04 21:36:31 +00:00
|
|
|
$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 400 } ];
|
2018-04-21 21:23:17 +00:00
|
|
|
ok($tf->handle_http($t) == 0, 'URL-encoding, %00');
|
2005-03-02 11:27:02 +00:00
|
|
|
|
2005-06-15 09:37:18 +00:00
|
|
|
$t->{REQUEST} = ( <<EOF
|
2005-03-02 11:27:02 +00:00
|
|
|
POST /12345.txt HTTP/1.0
|
|
|
|
Host: 123.example.org
|
|
|
|
Content-Length: 2147483648
|
|
|
|
EOF
|
|
|
|
);
|
2005-08-31 12:55:44 +00:00
|
|
|
$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 413 } ];
|
2005-06-15 09:37:18 +00:00
|
|
|
ok($tf->handle_http($t) == 0, 'Content-Length > max-request-size');
|
2005-03-02 11:27:02 +00:00
|
|
|
|
|
|
|
|
2005-08-27 16:35:57 +00:00
|
|
|
print "\nContent-Type\n";
|
|
|
|
$t->{REQUEST} = ( <<EOF
|
|
|
|
GET /image.jpg HTTP/1.0
|
|
|
|
EOF
|
|
|
|
);
|
2005-08-31 12:55:44 +00:00
|
|
|
$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200, 'Content-Type' => 'image/jpeg' } ];
|
2005-08-27 16:35:57 +00:00
|
|
|
ok($tf->handle_http($t) == 0, 'Content-Type - image/jpeg');
|
|
|
|
|
|
|
|
$t->{REQUEST} = ( <<EOF
|
|
|
|
GET /image.JPG HTTP/1.0
|
|
|
|
EOF
|
|
|
|
);
|
2005-08-31 12:55:44 +00:00
|
|
|
$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200, 'Content-Type' => 'image/jpeg' } ];
|
2005-09-29 14:42:35 +00:00
|
|
|
ok($tf->handle_http($t) == 0, 'Content-Type - image/jpeg (upper case)');
|
2005-08-27 16:35:57 +00:00
|
|
|
|
|
|
|
$t->{REQUEST} = ( <<EOF
|
|
|
|
GET /a HTTP/1.0
|
|
|
|
EOF
|
|
|
|
);
|
2005-08-31 12:55:44 +00:00
|
|
|
$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200, 'Content-Type' => 'application/octet-stream' } ];
|
2005-08-27 16:35:57 +00:00
|
|
|
ok($tf->handle_http($t) == 0, 'Content-Type - unknown');
|
|
|
|
|
2005-10-02 21:50:51 +00:00
|
|
|
$t->{REQUEST} = ( <<EOF
|
|
|
|
GET /Foo.txt HTTP/1.0
|
|
|
|
EOF
|
|
|
|
);
|
|
|
|
$t->{RESPONSE} = [ { 'HTTP-Protocol' => 'HTTP/1.0', 'HTTP-Status' => 200 } ];
|
|
|
|
ok($tf->handle_http($t) == 0, 'uppercase filenames');
|
|
|
|
|
2005-08-27 16:35:57 +00:00
|
|
|
|
2005-06-15 09:37:18 +00:00
|
|
|
ok($tf->stop_proc == 0, "Stopping lighttpd");
|