| Commit message (Collapse) | Author | Age | Files | Lines |
| | |
|
| | |
|
| |\
| |
| | |
feat(url): classify host as name/ipv4/ipv6 in parse and build
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
The Host header must wrap an IPv6 literal in brackets (RFC 7230), but
adjustheaders() used reqt.host as-is, which is unbracketed after
url.parse(). Use url.classify_host() to detect IPv6 and bracket it,
handling an already-bracketed input without doubling the brackets.
Closes #445
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
parse() now sets hosttype ("name"/"ipv4"/"ipv6") plus a matching
hostname/ipv4/ipv6 field alongside host. build() accepts those same
fields when host is absent, erroring if more than one is set.
classify_host is exported for standalone use; it classifies by shape
(colon present -> ipv6, dotted-quad shape -> ipv4) rather than
validating the address.
|
| |\ \
| | |
| | | |
Fix/http size protect
|
| | | |
| | |
| | |
| | |
| | | |
fixes unbounded reads when using the "*l" pattern. Typically on
headers and other control lines.
|
| | | | |
|
| |\ \ \
| | | |
| | | | |
feat(headers): dynamically create cononicalized headers
|
| | | | |
| | | |
| | | | |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
| | | |/
| |/|
| | |
| | |
| | |
| | |
| | |
| | | |
Instead of a static list dynamically add entries in proper casing.
Also allowing to add non-standard ones through `setcanonic`.
closes #442
fixes #440
|
| |\ \ \
| | | |
| | | | |
fix(receive): a receive 0 should immediately return, not block
|
| | | | | |
|
| | | |/
| |/|
| | |
| | |
| | |
| | |
| | |
| | | |
The fix is slightly more complex because reading from a closed
socket should still return a closed-error.
fixes: #427
fixes: https://github.com/ledgetech/lua-resty-http/pull/313
|
| |\| |
| | |
| | | |
feat(receive): add maxsize argument to bound memory usage
|
| | | |
| | |
| | |
| | |
| | |
| | | |
Same class of bug as the maxsize cast: a double larger than
SIZE_MAX cast to size_t is undefined behavior. Bound-check the
numeric receive pattern before the cast, and cover it with a test.
|
| | | |
| | |
| | |
| | |
| | | |
Casting a double larger than SIZE_MAX to size_t is undefined
behavior; bound-check maxsize before the cast.
|
| | |/
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
client:receive("*l") and receive("*a") are unbounded: a peer that never
sends a newline, or never closes, makes LuaSocket buffer until the
process runs out of memory (e.g. src/http.lua reading response headers
in a loop). Add an optional maxsize argument that caps the payload a
single call may accumulate, including prefix.
- Hoist all argument validation ahead of timeout_markstart() so bad
calls (maxsize < 1, #prefix >= maxsize, numeric pattern > maxsize)
raise before any I/O and leave the socket untouched.
- recvline/recvall take a budget and return a new internal
BUF_OVERSIZED code, surfaced to Lua as the "oversized" error
alongside "timeout"/"closed", with the partial held in the 3rd
return value.
- recvraw is left untouched: argument checks make the cap unreachable
for numeric patterns.
- Preserve three invariants: a timeout partial is always shorter than
maxsize (safe to retry as prefix), completion beats the cap for *a,
and no bytes are lost or skipped on overflow.
- tcp.c, unixstream.c and serial.c all share this code path unchanged.
Adds test coverage (argument errors, *l/*a boundaries, timeout/close
at the cap, the drain idiom, numeric patterns, unix-stream mirror) and
documents the new argument, error, and recovery idioms in docs/tcp.html.
|
| |/ |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
| |
Closes #401
|
| |\ |
|
| | | |
|
| | | |
|
| |/ |
|
| | |
|
| |
|
|
| |
independent version
|
| |
|
|
| |
Co-authored-by: Sewbacca <sebastian.kalus@kolabnow.com>
|
| | |
|
| |
|
| |
Location header can now be relative: https://httpwg.org/specs/rfc9110.html#field.location
|
| |
|
|
|
|
| |
This reverts commit 88c72acd771ac6c96ea7f4e57293307e282ad49f.
See discussion on #390
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
| |
* Explicitly call gai_strerrorA (for Windows builds), so that the code work correctly in 32bit or 64bit builds.
* Implement GAI_STRERROR macro to deal with Windows vs. Non-Windows compiles for 64-bit.
* make usocket.c consistent with other modules that call macro GAI_STRERROR
* Use different name not just different case for macro wrapping function
Co-authored-by: Caleb Maclennan <caleb@alerque.com>
|
| |
|
|
|
|
|
|
| |
This makes it so that a listening socket does not become readable for
accept() until a connection has been fully established *and* started
sending something, thus the program doesn't have to wait for the first
data. This only makes sense for client-speaks-first protocols.
Co-authored-by: Caleb Maclennan <caleb@alerque.com>
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
If a source is specified without a content-length header, LuaSocket
sends the data in the chunked transfer coding; however, it doesn't set
the transfer-encoding header. While I recognize that the user can set
this manually, this is a gotcha that has caught me multiple times.
RFC7230, section 3.3.3
(https://tools.ietf.org/html/rfc7230#section-3.3.3)
is clear about this; if neither content-length nor transfer-encoding
chunked are specified, the request message body length is zero. While
some servers may ignore this, I have encountered several that follow
the RFC in this regard, most recently golang's net/http.
|
| | |
|
| |\ |
|
| | | |
|
| |/
|
| |
Co-authored-by: Denise Cullassnekuff <19711487+BlackCutpoint@users.noreply.github.com>
|