valid_urls.c 22 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802
  1. // SPDX-License-Identifier: GPL-3.0-or-later
  2. #include "libnetdata/libnetdata.h"
  3. #include "libnetdata/required_dummies.h"
  4. #include "database/rrd.h"
  5. #include "web/server/web_client.h"
  6. #include <setjmp.h>
  7. #include <cmocka.h>
  8. #include <stdbool.h>
  9. void free_temporary_host(RRDHOST *host)
  10. {
  11. (void) host;
  12. }
  13. void *__wrap_free_temporary_host(RRDHOST *host)
  14. {
  15. (void) host;
  16. return NULL;
  17. }
  18. RRDHOST *sql_create_host_by_uuid(char *hostname)
  19. {
  20. (void) hostname;
  21. return NULL;
  22. }
  23. RRDHOST *__wrap_sql_create_host_by_uuid(char *hostname)
  24. {
  25. (void) hostname;
  26. return NULL;
  27. }
  28. void repr(char *result, int result_size, char const *buf, int size)
  29. {
  30. int n;
  31. char *end = result + result_size - 1;
  32. unsigned char const *ubuf = (unsigned char const *)buf;
  33. while (size && result_size > 0) {
  34. if (*ubuf <= 0x20 || *ubuf >= 0x80) {
  35. n = snprintf(result, result_size, "\\%02X", *ubuf);
  36. } else {
  37. *result = *ubuf;
  38. n = 1;
  39. }
  40. result += n;
  41. result_size -= n;
  42. ubuf++;
  43. size--;
  44. }
  45. if (result_size > 0)
  46. *(result++) = 0;
  47. else
  48. *end = 0;
  49. }
  50. // ---------------------------------- Mocking accesses from web_client ------------------------------------------------
  51. ssize_t send(int sockfd, const void *buf, size_t len, int flags)
  52. {
  53. info("Mocking send: %zu bytes\n", len);
  54. (void)sockfd;
  55. (void)buf;
  56. (void)flags;
  57. return len;
  58. }
  59. RRDHOST *__wrap_rrdhost_find_by_hostname(const char *hostname, uint32_t hash)
  60. {
  61. (void)hostname;
  62. (void)hash;
  63. return NULL;
  64. }
  65. /* Note: we've got some intricate code inside the global statistics module, might be useful to pull it inside the
  66. test set instead of mocking it. */
  67. void __wrap_finished_web_request_statistics(
  68. uint64_t dt, uint64_t bytes_received, uint64_t bytes_sent, uint64_t content_size, uint64_t compressed_content_size)
  69. {
  70. (void)dt;
  71. (void)bytes_received;
  72. (void)bytes_sent;
  73. (void)content_size;
  74. (void)compressed_content_size;
  75. }
  76. char *__wrap_config_get(struct config *root, const char *section, const char *name, const char *default_value)
  77. {
  78. (void)root;
  79. (void)section;
  80. (void)name;
  81. (void)default_value;
  82. return "UNKNOWN FIX ME";
  83. }
  84. int __wrap_web_client_api_request_v1(RRDHOST *host, struct web_client *w, char *url)
  85. {
  86. char url_repr[160];
  87. repr(url_repr, sizeof(url_repr), url, strlen(url));
  88. printf("web_client_api_request_v1(url=\"%s\")\n", url_repr);
  89. check_expected_ptr(host);
  90. check_expected_ptr(w);
  91. check_expected_ptr(url_repr);
  92. return HTTP_RESP_OK;
  93. }
  94. int __wrap_mysendfile(struct web_client *w, char *filename)
  95. {
  96. (void)w;
  97. printf("mysendfile(filename=\"%s\"\n", filename);
  98. check_expected_ptr(filename);
  99. return HTTP_RESP_OK;
  100. }
  101. int __wrap_rrdpush_receiver_thread_spawn(RRDHOST *host, struct web_client *w, char *url)
  102. {
  103. (void)host;
  104. (void)w;
  105. (void)url;
  106. return 0;
  107. }
  108. RRDHOST *__wrap_rrdhost_find_by_guid(const char *guid, uint32_t hash)
  109. {
  110. (void)guid;
  111. (void)hash;
  112. printf("FIXME: rrdset_find_guid\n");
  113. return NULL;
  114. }
  115. RRDSET *__wrap_rrdset_find_byname(RRDHOST *host, const char *name)
  116. {
  117. (void)host;
  118. (void)name;
  119. printf("FIXME: rrdset_find_byname\n");
  120. return NULL;
  121. }
  122. RRDSET *__wrap_rrdset_find(RRDHOST *host, const char *id)
  123. {
  124. (void)host;
  125. (void)id;
  126. printf("FIXME: rrdset_find\n");
  127. return NULL;
  128. }
  129. // -------------------------------- Mocking the log - dump straight through --------------------------------------------
  130. void __wrap_debug_int(const char *file, const char *function, const unsigned long line, const char *fmt, ...)
  131. {
  132. (void)file;
  133. (void)function;
  134. (void)line;
  135. va_list args;
  136. va_start(args, fmt);
  137. printf(" DEBUG: ");
  138. printf(fmt, args);
  139. printf("\n");
  140. va_end(args);
  141. }
  142. void __wrap_info_int(const char *file, const char *function, const unsigned long line, const char *fmt, ...)
  143. {
  144. (void)file;
  145. (void)function;
  146. (void)line;
  147. va_list args;
  148. va_start(args, fmt);
  149. printf(" INFO: ");
  150. printf(fmt, args);
  151. printf("\n");
  152. va_end(args);
  153. }
  154. void __wrap_error_int(
  155. const char *prefix, const char *file, const char *function, const unsigned long line, const char *fmt, ...)
  156. {
  157. (void)prefix;
  158. (void)file;
  159. (void)function;
  160. (void)line;
  161. va_list args;
  162. va_start(args, fmt);
  163. printf(" ERROR: ");
  164. printf(fmt, args);
  165. printf("\n");
  166. va_end(args);
  167. }
  168. void __wrap_fatal_int(const char *file, const char *function, const unsigned long line, const char *fmt, ...)
  169. {
  170. (void)file;
  171. (void)function;
  172. (void)line;
  173. va_list args;
  174. va_start(args, fmt);
  175. printf("FATAL: ");
  176. printf(fmt, args);
  177. printf("\n");
  178. va_end(args);
  179. fail();
  180. }
  181. WEB_SERVER_MODE web_server_mode = WEB_SERVER_MODE_STATIC_THREADED;
  182. char *netdata_configured_web_dir = "UNKNOWN FIXME";
  183. RRDHOST *localhost = NULL;
  184. struct config netdata_config = { .first_section = NULL,
  185. .last_section = NULL,
  186. .mutex = NETDATA_MUTEX_INITIALIZER,
  187. .index = { .avl_tree = { .root = NULL, .compar = appconfig_section_compare },
  188. .rwlock = AVL_LOCK_INITIALIZER } };
  189. /* Note: this is not a CMocka group_test_setup/teardown pair. This is performed per-test.
  190. */
  191. static struct web_client *setup_fresh_web_client()
  192. {
  193. struct web_client *w = (struct web_client *)malloc(sizeof(struct web_client));
  194. memset(w, 0, sizeof(struct web_client));
  195. w->response.data = buffer_create(NETDATA_WEB_RESPONSE_INITIAL_SIZE);
  196. w->response.header = buffer_create(NETDATA_WEB_RESPONSE_HEADER_SIZE);
  197. w->response.header_output = buffer_create(NETDATA_WEB_RESPONSE_HEADER_SIZE);
  198. strcpy(w->origin, "*"); // Simulate web_client_create_on_fd()
  199. w->cookie1[0] = 0; // Simulate web_client_create_on_fd()
  200. w->cookie2[0] = 0; // Simulate web_client_create_on_fd()
  201. w->acl = 0x1f; // Everything on
  202. return w;
  203. }
  204. static void destroy_web_client(struct web_client *w)
  205. {
  206. buffer_free(w->response.data);
  207. buffer_free(w->response.header);
  208. buffer_free(w->response.header_output);
  209. free(w);
  210. }
  211. //////////////////////////// Test cases ///////////////////////////////////////////////////////////////////////////////
  212. static void only_root(void **state)
  213. {
  214. (void)state;
  215. if (localhost != NULL)
  216. free(localhost);
  217. localhost = malloc(sizeof(RRDHOST));
  218. struct web_client *w = setup_fresh_web_client();
  219. buffer_strcat(w->response.data, "GET / HTTP/1.1\r\n\r\n");
  220. char debug[4096];
  221. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  222. printf("-> \"%s\"\n", debug);
  223. //char expected_url_repr[4096];
  224. //repr(expected_url_repr, sizeof(expected_url_repr), def->url_out_repr, strlen(def->url_out_repr));
  225. expect_string(__wrap_mysendfile, filename, "/");
  226. web_client_process_request(w);
  227. //assert_string_equal(w->decoded_query_string, def->query_out);
  228. destroy_web_client(w);
  229. free(localhost);
  230. localhost = NULL;
  231. }
  232. static void two_slashes(void **state)
  233. {
  234. (void)state;
  235. if (localhost != NULL)
  236. free(localhost);
  237. localhost = malloc(sizeof(RRDHOST));
  238. struct web_client *w = setup_fresh_web_client();
  239. buffer_strcat(w->response.data, "GET // HTTP/1.1\r\n\r\n");
  240. char debug[4096];
  241. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  242. printf("-> \"%s\"\n", debug);
  243. //char expected_url_repr[4096];
  244. //repr(expected_url_repr, sizeof(expected_url_repr), def->url_out_repr, strlen(def->url_out_repr));
  245. expect_string(__wrap_mysendfile, filename, "//");
  246. web_client_process_request(w);
  247. //assert_string_equal(w->decoded_query_string, def->query_out);
  248. destroy_web_client(w);
  249. free(localhost);
  250. localhost = NULL;
  251. }
  252. static void absolute_url(void **state)
  253. {
  254. (void)state;
  255. if (localhost != NULL)
  256. free(localhost);
  257. localhost = malloc(sizeof(RRDHOST));
  258. struct web_client *w = setup_fresh_web_client();
  259. buffer_strcat(w->response.data, "GET http://localhost:19999/api/v1/info HTTP/1.1\r\n\r\n");
  260. char debug[4096];
  261. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  262. printf("-> \"%s\"\n", debug);
  263. //char expected_url_repr[4096];
  264. //repr(expected_url_repr, sizeof(expected_url_repr), def->url_out_repr, strlen(def->url_out_repr));
  265. expect_value(__wrap_web_client_api_request_v1, host, localhost);
  266. expect_value(__wrap_web_client_api_request_v1, w, w);
  267. expect_string(__wrap_web_client_api_request_v1, url_repr, "info");
  268. web_client_process_request(w);
  269. assert_string_equal(w->decoded_query_string, "?blah");
  270. destroy_web_client(w);
  271. free(localhost);
  272. localhost = NULL;
  273. }
  274. static void valid_url(void **state)
  275. {
  276. (void)state;
  277. if (localhost != NULL)
  278. free(localhost);
  279. localhost = malloc(sizeof(RRDHOST));
  280. struct web_client *w = setup_fresh_web_client();
  281. buffer_strcat(w->response.data, "GET /api/v1/info?blah HTTP/1.1\r\n\r\n");
  282. char debug[4096];
  283. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  284. printf("-> \"%s\"\n", debug);
  285. //char expected_url_repr[4096];
  286. //repr(expected_url_repr, sizeof(expected_url_repr), def->url_out_repr, strlen(def->url_out_repr));
  287. expect_value(__wrap_web_client_api_request_v1, host, localhost);
  288. expect_value(__wrap_web_client_api_request_v1, w, w);
  289. expect_string(__wrap_web_client_api_request_v1, url_repr, "info");
  290. web_client_process_request(w);
  291. assert_string_equal(w->decoded_query_string, "?blah");
  292. destroy_web_client(w);
  293. free(localhost);
  294. localhost = NULL;
  295. }
  296. /* RFC2616, section 4.1:
  297. In the interest of robustness, servers SHOULD ignore any empty
  298. line(s) received where a Request-Line is expected. In other words, if
  299. the server is reading the protocol stream at the beginning of a
  300. message and receives a CRLF first, it should ignore the CRLF.
  301. */
  302. static void leading_blanks(void **state)
  303. {
  304. (void)state;
  305. if (localhost != NULL)
  306. free(localhost);
  307. localhost = malloc(sizeof(RRDHOST));
  308. struct web_client *w = setup_fresh_web_client();
  309. buffer_strcat(w->response.data, "\r\n\r\nGET /api/v1/info?blah HTTP/1.1\r\n\r\n");
  310. char debug[4096];
  311. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  312. printf("-> \"%s\"\n", debug);
  313. //char expected_url_repr[4096];
  314. //repr(expected_url_repr, sizeof(expected_url_repr), def->url_out_repr, strlen(def->url_out_repr));
  315. expect_value(__wrap_web_client_api_request_v1, host, localhost);
  316. expect_value(__wrap_web_client_api_request_v1, w, w);
  317. expect_string(__wrap_web_client_api_request_v1, url_repr, "info");
  318. web_client_process_request(w);
  319. assert_string_equal(w->decoded_query_string, "?blah");
  320. destroy_web_client(w);
  321. free(localhost);
  322. localhost = NULL;
  323. }
  324. static void empty_url(void **state)
  325. {
  326. (void)state;
  327. if (localhost != NULL)
  328. free(localhost);
  329. localhost = malloc(sizeof(RRDHOST));
  330. struct web_client *w = setup_fresh_web_client();
  331. buffer_strcat(w->response.data, "GET HTTP/1.1\r\n\r\n");
  332. char debug[4096];
  333. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  334. printf("-> \"%s\"\n", debug);
  335. //char expected_url_repr[4096];
  336. //repr(expected_url_repr, sizeof(expected_url_repr), def->url_out_repr, strlen(def->url_out_repr));
  337. expect_value(__wrap_web_client_api_request_v1, host, localhost);
  338. expect_value(__wrap_web_client_api_request_v1, w, w);
  339. expect_string(__wrap_web_client_api_request_v1, url_repr, "info");
  340. web_client_process_request(w);
  341. assert_string_equal(w->decoded_query_string, "?blah");
  342. destroy_web_client(w);
  343. free(localhost);
  344. localhost = NULL;
  345. }
  346. /* If the %-escape is being performed at the correct time then the url should not be treated as a query, but instead
  347. as a path "/api/v1/info?blah?" which should dispatch into the API with the given values.
  348. */
  349. static void not_a_query(void **state)
  350. {
  351. (void)state;
  352. localhost = malloc(sizeof(RRDHOST));
  353. struct web_client *w = setup_fresh_web_client();
  354. buffer_strcat(w->response.data, "GET /api/v1/info%3fblah%3f HTTP/1.1\r\n\r\n");
  355. char debug[160];
  356. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  357. printf("->%s\n", debug);
  358. char expected_url_repr[160];
  359. repr(expected_url_repr, sizeof(expected_url_repr), "info?blah?", 10);
  360. expect_value(__wrap_web_client_api_request_v1, host, localhost);
  361. expect_value(__wrap_web_client_api_request_v1, w, w);
  362. expect_string(__wrap_web_client_api_request_v1, url_repr, expected_url_repr);
  363. web_client_process_request(w);
  364. assert_string_equal(w->decoded_query_string, "");
  365. destroy_web_client(w);
  366. free(localhost);
  367. }
  368. static void cr_in_url(void **state)
  369. {
  370. (void)state;
  371. localhost = malloc(sizeof(RRDHOST));
  372. struct web_client *w = setup_fresh_web_client();
  373. buffer_strcat(w->response.data, "GET /api/v1/inf\ro\t?blah HTTP/1.1\r\n\r\n");
  374. char debug[160];
  375. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  376. printf("->%s\n", debug);
  377. char expected_url_repr[160];
  378. repr(expected_url_repr, sizeof(expected_url_repr), "inf\no\t", 6);
  379. web_client_process_request(w);
  380. assert_int_equal(w->response.code, HTTP_RESP_BAD_REQUEST);
  381. destroy_web_client(w);
  382. free(localhost);
  383. }
  384. static void newline_in_url(void **state)
  385. {
  386. (void)state;
  387. localhost = malloc(sizeof(RRDHOST));
  388. struct web_client *w = setup_fresh_web_client();
  389. buffer_strcat(w->response.data, "GET /api/v1/inf\no\t?blah HTTP/1.1\r\n\r\n");
  390. char debug[160];
  391. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  392. printf("->%s\n", debug);
  393. char expected_url_repr[160];
  394. repr(expected_url_repr, sizeof(expected_url_repr), "inf\no\t", 6);
  395. web_client_process_request(w);
  396. assert_int_equal(w->response.code, HTTP_RESP_BAD_REQUEST);
  397. destroy_web_client(w);
  398. free(localhost);
  399. }
  400. static void bad_version(void **state)
  401. {
  402. (void)state;
  403. localhost = malloc(sizeof(RRDHOST));
  404. struct web_client *w = setup_fresh_web_client();
  405. buffer_strcat(w->response.data, "GET /api/v1/info?blah HTTP/1.2\r\n\r\n");
  406. char debug[160];
  407. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  408. printf("->%s\n", debug);
  409. char expected_url_repr[160];
  410. repr(expected_url_repr, sizeof(expected_url_repr), "inf\no\t", 6);
  411. web_client_process_request(w);
  412. assert_int_equal(w->response.code, HTTP_RESP_BAD_REQUEST);
  413. destroy_web_client(w);
  414. free(localhost);
  415. }
  416. static void pathless_query(void **state)
  417. {
  418. (void)state;
  419. localhost = malloc(sizeof(RRDHOST));
  420. struct web_client *w = setup_fresh_web_client();
  421. buffer_strcat(w->response.data, "GET ?blah HTTP/1.1\r\n\r\n");
  422. char debug[160];
  423. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  424. printf("->%s\n", debug);
  425. char expected_url_repr[160];
  426. repr(expected_url_repr, sizeof(expected_url_repr), "inf\no\t", 6);
  427. web_client_process_request(w);
  428. assert_int_equal(w->response.code, HTTP_RESP_BAD_REQUEST);
  429. destroy_web_client(w);
  430. free(localhost);
  431. }
  432. static void pathless_fragment(void **state)
  433. {
  434. (void)state;
  435. localhost = malloc(sizeof(RRDHOST));
  436. struct web_client *w = setup_fresh_web_client();
  437. buffer_strcat(w->response.data, "GET #blah HTTP/1.1\r\n\r\n");
  438. char debug[160];
  439. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  440. printf("->%s\n", debug);
  441. char expected_url_repr[160];
  442. repr(expected_url_repr, sizeof(expected_url_repr), "inf\no\t", 6);
  443. web_client_process_request(w);
  444. assert_int_equal(w->response.code, HTTP_RESP_BAD_REQUEST);
  445. destroy_web_client(w);
  446. free(localhost);
  447. }
  448. static void short_percent(void **state)
  449. {
  450. (void)state;
  451. localhost = malloc(sizeof(RRDHOST));
  452. struct web_client *w = setup_fresh_web_client();
  453. buffer_strcat(w->response.data, "GET % HTTP/1.1\r\n\r\n");
  454. char debug[160];
  455. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  456. printf("->%s\n", debug);
  457. char expected_url_repr[160];
  458. repr(expected_url_repr, sizeof(expected_url_repr), "inf\no\t", 6);
  459. web_client_process_request(w);
  460. assert_int_equal(w->response.code, HTTP_RESP_BAD_REQUEST);
  461. destroy_web_client(w);
  462. free(localhost);
  463. }
  464. static void short_percent2(void **state)
  465. {
  466. (void)state;
  467. localhost = malloc(sizeof(RRDHOST));
  468. struct web_client *w = setup_fresh_web_client();
  469. buffer_strcat(w->response.data, "GET %0 HTTP/1.1\r\n\r\n");
  470. char debug[160];
  471. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  472. printf("->%s\n", debug);
  473. char expected_url_repr[160];
  474. repr(expected_url_repr, sizeof(expected_url_repr), "inf\no\t", 6);
  475. web_client_process_request(w);
  476. assert_int_equal(w->response.code, HTTP_RESP_BAD_REQUEST);
  477. destroy_web_client(w);
  478. free(localhost);
  479. }
  480. static void short_percent3(void **state)
  481. {
  482. (void)state;
  483. localhost = malloc(sizeof(RRDHOST));
  484. struct web_client *w = setup_fresh_web_client();
  485. buffer_strcat(w->response.data, "GET %");
  486. char debug[160];
  487. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  488. printf("->%s\n", debug);
  489. char expected_url_repr[160];
  490. repr(expected_url_repr, sizeof(expected_url_repr), "inf\no\t", 6);
  491. web_client_process_request(w);
  492. assert_int_equal(w->response.code, HTTP_RESP_BAD_REQUEST);
  493. destroy_web_client(w);
  494. free(localhost);
  495. }
  496. static void percent_nulls(void **state)
  497. {
  498. (void)state;
  499. localhost = malloc(sizeof(RRDHOST));
  500. struct web_client *w = setup_fresh_web_client();
  501. buffer_strcat(w->response.data, "GET %00%00%00%00%00%00 HTTP/1.1\r\n");
  502. char debug[160];
  503. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  504. printf("->%s\n", debug);
  505. char expected_url_repr[160];
  506. repr(expected_url_repr, sizeof(expected_url_repr), "inf\no\t", 6);
  507. web_client_process_request(w);
  508. assert_int_equal(w->response.code, HTTP_RESP_BAD_REQUEST);
  509. destroy_web_client(w);
  510. free(localhost);
  511. }
  512. static void percent_invalid(void **state)
  513. {
  514. (void)state;
  515. localhost = malloc(sizeof(RRDHOST));
  516. struct web_client *w = setup_fresh_web_client();
  517. buffer_strcat(w->response.data, "GET /%x%x%x%x%x%x HTTP/1.1\r\n");
  518. char debug[160];
  519. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  520. printf("->%s\n", debug);
  521. char expected_url_repr[160];
  522. repr(expected_url_repr, sizeof(expected_url_repr), "inf\no\t", 6);
  523. web_client_process_request(w);
  524. assert_int_equal(w->response.code, HTTP_RESP_BAD_REQUEST);
  525. destroy_web_client(w);
  526. free(localhost);
  527. }
  528. static void space_in_url(void **state)
  529. {
  530. (void)state;
  531. localhost = malloc(sizeof(RRDHOST));
  532. struct web_client *w = setup_fresh_web_client();
  533. buffer_strcat(w->response.data, "GET / / HTTP/1.1\r\n\r\n");
  534. char debug[160];
  535. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  536. printf("->%s\n", debug);
  537. char expected_url_repr[160];
  538. repr(expected_url_repr, sizeof(expected_url_repr), "inf\no\t", 6);
  539. web_client_process_request(w);
  540. assert_int_equal(w->response.code, HTTP_RESP_BAD_REQUEST);
  541. destroy_web_client(w);
  542. free(localhost);
  543. }
  544. static void random_sploit1(void **state)
  545. {
  546. (void)state;
  547. localhost = malloc(sizeof(RRDHOST));
  548. struct web_client *w = setup_fresh_web_client();
  549. // FIXME: Encoding probably needs to go through printf
  550. buffer_need_bytes(w->response.data, 55);
  551. memcpy(
  552. w->response.data->buffer,
  553. "GET \x03\x00\x00/*\xE0\x00\x00\x00\x00\x00Cookie: mstshash=Administr HTTP/1.1\r\n\r\n", 54);
  554. w->response.data->len = 54;
  555. char debug[160];
  556. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  557. printf("->%s\n", debug);
  558. char expected_url_repr[160];
  559. repr(expected_url_repr, sizeof(expected_url_repr), "inf\no\t", 6);
  560. web_client_process_request(w);
  561. assert_int_equal(w->response.code, HTTP_RESP_BAD_REQUEST);
  562. destroy_web_client(w);
  563. free(localhost);
  564. }
  565. static void null_in_url(void **state)
  566. {
  567. (void)state;
  568. localhost = malloc(sizeof(RRDHOST));
  569. struct web_client *w = setup_fresh_web_client();
  570. buffer_strcat(w->response.data, "GET / / HTTP/1.1\r\n\r\n");
  571. w->response.data->buffer[5] = 0;
  572. char debug[160];
  573. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  574. printf("->%s\n", debug);
  575. char expected_url_repr[160];
  576. repr(expected_url_repr, sizeof(expected_url_repr), "inf\no\t", 6);
  577. web_client_process_request(w);
  578. assert_int_equal(w->response.code, HTTP_RESP_BAD_REQUEST);
  579. destroy_web_client(w);
  580. free(localhost);
  581. }
  582. static void many_ands(void **state)
  583. {
  584. (void)state;
  585. localhost = malloc(sizeof(RRDHOST));
  586. struct web_client *w = setup_fresh_web_client();
  587. buffer_strcat(w->response.data, "GET foo?");
  588. for (size_t i = 0; i < 600; i++)
  589. buffer_strcat(w->response.data, "&");
  590. buffer_strcat(w->response.data, " HTTP/1.1\r\n\r\n");
  591. char debug[2048];
  592. repr(debug, sizeof(debug), w->response.data->buffer, w->response.data->len);
  593. printf("->%s\n", debug);
  594. char expected_url_repr[160];
  595. repr(expected_url_repr, sizeof(expected_url_repr), "inf\no\t", 6);
  596. web_client_process_request(w);
  597. assert_int_equal(w->response.code, HTTP_RESP_BAD_REQUEST);
  598. destroy_web_client(w);
  599. free(localhost);
  600. }
  601. int main(void)
  602. {
  603. debug_flags = 0xffffffffffff;
  604. int fails = 0;
  605. struct CMUnitTest static_tests[] = {
  606. cmocka_unit_test(only_root), cmocka_unit_test(two_slashes), cmocka_unit_test(valid_url),
  607. cmocka_unit_test(leading_blanks), cmocka_unit_test(empty_url), cmocka_unit_test(newline_in_url),
  608. cmocka_unit_test(not_a_query), cmocka_unit_test(cr_in_url), cmocka_unit_test(pathless_query),
  609. cmocka_unit_test(pathless_fragment), cmocka_unit_test(short_percent), cmocka_unit_test(short_percent2),
  610. cmocka_unit_test(short_percent3), cmocka_unit_test(percent_nulls), cmocka_unit_test(percent_invalid),
  611. cmocka_unit_test(space_in_url), cmocka_unit_test(random_sploit1), cmocka_unit_test(null_in_url),
  612. cmocka_unit_test(absolute_url),
  613. // cmocka_unit_test(many_ands), CMocka cannot recover after this crash
  614. cmocka_unit_test(bad_version)
  615. };
  616. (void)many_ands;
  617. fails += cmocka_run_group_tests_name("static_tests", static_tests, NULL, NULL);
  618. return fails;
  619. }