arduino/esp8266
1
0
Fork 0
mirror of https://github.com/esp8266/Arduino.git synced 2025-04-21 10:26:06 +03:00
Code

Fix URL parameter decoding in web server (#3313)

Browse Source 
* Make HTTP server test data easier to examine

* Add HTTP server parameter tests containing & and =

* Fix URL parameter decoding in web server

The parameters string needs to be first split on & and =, and URL
decoding on parts done after that. Otherwise URL encoded & and = within
parameter names and values cause incorrect splitting.
This commit is contained in:
Ville Skyttä 2017-12-30 19:24:37 +02:00 committed by Develo
parent 4ab89d07fc
commit b4653f4d44
3 changed files with 19 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
libraries/ESP8266WebServer/src/Parsing.cpp
View File

@ -184,13 +184,9 @@ bool ESP8266WebServer::_parseRequest(WiFiClient& client) {
return false; return false;
} }
if (contentLength > 0) { if (contentLength > 0) {
if (searchStr != "") searchStr += '&';
if(isEncoded){ if(isEncoded){
//url encoded form //url encoded form
String decoded = urlDecode(plainBuf); if (searchStr != "") searchStr += '&';
size_t decodedLen = decoded.length();
memcpy(plainBuf, decoded.c_str(), decodedLen);
plainBuf[decodedLen] = 0;
searchStr += plainBuf; searchStr += plainBuf;
} }
_parseArguments(searchStr); _parseArguments(searchStr);
@ -321,7 +317,7 @@ void ESP8266WebServer::_parseArguments(String data) {
continue; continue;
} }
RequestArgument& arg = _currentArgs[iarg]; RequestArgument& arg = _currentArgs[iarg];
arg.key = data.substring(pos, equal_sign_index); arg.key = urlDecode(data.substring(pos, equal_sign_index));
arg.value = urlDecode(data.substring(equal_sign_index + 1, next_arg_index)); arg.value = urlDecode(data.substring(equal_sign_index + 1, next_arg_index));
#ifdef DEBUG_ESP_HTTP_SERVER #ifdef DEBUG_ESP_HTTP_SERVER
DEBUG_OUTPUT.print("arg "); DEBUG_OUTPUT.print("arg ");

16
tests/device/test_http_server/test_http_server.ino
View File

@ -36,7 +36,7 @@ TEST_CASE("HTTP GET Parameters", "[HTTPServer]")
siteData = ""; siteData = "";
for (uint8_t i=0; i<server.args(); i++){ for (uint8_t i=0; i<server.args(); i++){
if(i > 0) if(i > 0)
siteData += "&"; siteData += "\n";
siteData += server.argName(i) + " = " + server.arg(i); siteData += server.argName(i) + " = " + server.arg(i);
} }
siteHits++; siteHits++;
@ -45,7 +45,7 @@ TEST_CASE("HTTP GET Parameters", "[HTTPServer]")
uint32_t startTime = millis(); uint32_t startTime = millis();
while(siteHits == 0 && (millis() - startTime) < 10000) while(siteHits == 0 && (millis() - startTime) < 10000)
server.handleClient(); server.handleClient();
REQUIRE(siteHits > 0 && siteData.equals("var1=val with spaces&var+=some%")); REQUIRE(siteHits > 0 && siteData.equals("var1 = val with spaces\nva=r+ = so&me%"));
} }
} }
@ -57,7 +57,7 @@ TEST_CASE("HTTP POST Parameters", "[HTTPServer]")
siteData = ""; siteData = "";
for (uint8_t i=0; i<server.args(); i++){ for (uint8_t i=0; i<server.args(); i++){
if(i > 0) if(i > 0)
siteData += "&"; siteData += "\n";
siteData += server.argName(i) + " = " + server.arg(i); siteData += server.argName(i) + " = " + server.arg(i);
} }
siteHits++; siteHits++;
@ -78,7 +78,7 @@ TEST_CASE("HTTP GET+POST Parameters", "[HTTPServer]")
siteData = ""; siteData = "";
for (uint8_t i=0; i<server.args(); i++){ for (uint8_t i=0; i<server.args(); i++){
if(i > 0) if(i > 0)
siteData += "&"; siteData += "\n";
siteData += server.argName(i) + " = " + server.arg(i); siteData += server.argName(i) + " = " + server.arg(i);
} }
siteHits++; siteHits++;
@ -87,7 +87,7 @@ TEST_CASE("HTTP GET+POST Parameters", "[HTTPServer]")
uint32_t startTime = millis(); uint32_t startTime = millis();
while(siteHits == 0 && (millis() - startTime) < 10000) while(siteHits == 0 && (millis() - startTime) < 10000)
server.handleClient(); server.handleClient();
REQUIRE(siteHits > 0 && siteData.equals("var3=val with spaces&var+=some%")); REQUIRE(siteHits > 0 && siteData.equals("var3 = val with spaces\nva&r+ = so=me%"));
} }
} }
@ -98,7 +98,7 @@ TEST_CASE("HTTP Upload", "[HTTPServer]")
server.on("/upload", HTTP_POST, [](){ server.on("/upload", HTTP_POST, [](){
for (uint8_t i=0; i<server.args(); i++){ for (uint8_t i=0; i<server.args(); i++){
if(i > 0) if(i > 0)
siteData += "&"; siteData += "\n";
siteData += server.argName(i) + " = " + server.arg(i); siteData += server.argName(i) + " = " + server.arg(i);
} }
siteHits++; siteHits++;
@ -110,13 +110,13 @@ TEST_CASE("HTTP Upload", "[HTTPServer]")
} else if(upload.status == UPLOAD_FILE_END){ } else if(upload.status == UPLOAD_FILE_END){
siteData.concat(":"); siteData.concat(":");
siteData.concat(String(upload.totalSize)); siteData.concat(String(upload.totalSize));
siteData.concat("&"); siteData.concat("\n");
} }
}); });
uint32_t startTime = millis(); uint32_t startTime = millis();
while(siteHits == 0 && (millis() - startTime) < 10000) while(siteHits == 0 && (millis() - startTime) < 10000)
server.handleClient(); server.handleClient();
REQUIRE(siteHits > 0 && siteData.equals("test.txt:16&var4=val with spaces")); REQUIRE(siteHits > 0 && siteData.equals("test.txt:16\nvar4 = val with spaces"));
} }
} }

6
tests/device/test_http_server/test_http_server.py
View File

@ -24,7 +24,7 @@ def http_test(res, url, get=None, post=None):
@setup('HTTP GET Parameters') @setup('HTTP GET Parameters')
def setup_http_get_params(e): def setup_http_get_params(e):
def testRun(): def testRun():
return http_test('var1=val with spaces&var+=some%', 'http://etd.local/get', {'var1' : 'val with spaces', 'var+' : 'some%'}) return http_test('var1 = val with spaces\nva=r+ = so&me%', 'http://etd.local/get', {'var1' : 'val with spaces', 'va=r+' : 'so&me%'})
Thread(target=testRun).start() Thread(target=testRun).start()
@teardown('HTTP GET Parameters') @teardown('HTTP GET Parameters')
@ -44,7 +44,7 @@ def teardown_http_post_params(e):
@setup('HTTP GET+POST Parameters') @setup('HTTP GET+POST Parameters')
def setup_http_getpost_params(e): def setup_http_getpost_params(e):
def testRun(): def testRun():
return http_test('var3=val with spaces&var+=some%', 'http://etd.local/get_and_post', {'var3' : 'val with spaces'}, {'var+' : 'some%'}) return http_test('var3 = val with spaces\nva&r+ = so=me%', 'http://etd.local/get_and_post', {'var3' : 'val with spaces'}, {'va&r+' : 'so=me%'})
Thread(target=testRun).start() Thread(target=testRun).start()
@teardown('HTTP GET+POST Parameters') @teardown('HTTP GET+POST Parameters')
@ -63,7 +63,7 @@ def setup_http_upload(e):
response = urllib2.urlopen(request, None, 2).read() response = urllib2.urlopen(request, None, 2).read()
except: except:
return 1 return 1
if response != 'test.txt:16&var4=val with spaces': if response != 'test.txt:16\nvar4 = val with spaces':
return 1 return 1
return 0 return 0
Thread(target=testRun).start() Thread(target=testRun).start()