# HG changeset patch # User jbe # Date 1422544076 -3600 # Node ID 7e6faff049c3f601e2ba17dbe7d6a85c19668ff3 # Parent 757902555204d96dbc5a69c8acc320684811bbdc Removed request.url; String in request.path does not contain a leading slash anymore; Stricter parsing of request targets diff -r 757902555204 -r 7e6faff049c3 example_application.lua --- a/example_application.lua Thu Jan 29 15:14:58 2015 +0100 +++ b/example_application.lua Thu Jan 29 16:07:56 2015 +0100 @@ -61,14 +61,14 @@ if request.method == "GET" or request.method == "HEAD" then - if request.path == "/" then + if request.path == "" then request:send_status("303 See Other") request:send_header("Location", "http://" .. request.headers_value.host .. "/example_webpage.html") else - local document_name = string.match(request.path, "^/(.*)$") + local document_name = request.path local document_extension = string.match(document_name, "%.([^.])$") - local document = documents[string.match(request.path, "^/(.*)$")] + local document = documents[document_name] if document then request:send_status("200 OK") @@ -88,7 +88,7 @@ elseif request.method == "POST" then - if request.path == "/post_example" then + if request.path == "post_example" then local files = {} do local file diff -r 757902555204 -r 7e6faff049c3 moonbridge_http.lua --- a/moonbridge_http.lua Thu Jan 29 15:14:58 2015 +0100 +++ b/moonbridge_http.lua Thu Jan 29 16:07:56 2015 +0100 @@ -804,8 +804,8 @@ if remaining_header_size_limit == 0 then return error_response("413 Request Entity Too Large", "Request line too long") end - local proto - request.method, request.target, proto = + local target, proto + request.method, target, proto = line:match("^([^ \t\r]+)[ \t]+([^ \t\r]+)[ \t]*([^ \t\r]*)[ \t]*\r?\n$") if not request.method then return error_response("400 Bad Request") @@ -865,20 +865,22 @@ return error_response("417 Expectation Failed", "Unexpected Expect header") end end + -- get mandatory Host header according to RFC 7230: + request.host = request.headers_value["Host"] + if not request.host then + return error_response("400 Bad Request", "No valid host header") + end -- parse request target: - request.path, request.query = string.match(request.target, "^(/[^?]*)%??(.*)$") - if request.path then - request.host = request.headers_value["Host"] - if not request.host then - return error_response("400 Bad Request", "No valid host header") - end - else - request.host, request.path, request.query = string.match(request.target, "^[Hh][Tt][Tt][Pp]://([^/?]+)/?([^?]*)%??(.*)$") - if request.host then - if request.host ~= request.headers_value["Host"] then + request.path, request.query = string.match(target, "^/([^?]*)%??(.*)$") + if not request.path then + local host2 + host2, request.path, request.query = string.match(target, "^[Hh][Tt][Tt][Pp]://([^/?]+)/?([^?]*)%??(.*)$") + if host2 then + if request.host ~= host2 then return error_response("400 Bad Request", "No valid host header") end - request.path = "/" .. request.path + elseif not (target == "*" and request.method == "OPTIONS") then + return error_response("400 Bad Request", "Invalid request target") end end -- parse GET params: diff -r 757902555204 -r 7e6faff049c3 reference.txt --- a/reference.txt Thu Jan 29 15:14:58 2015 +0100 +++ b/reference.txt Thu Jan 29 16:07:56 2015 +0100 @@ -268,8 +268,13 @@ ### request.path -The requested path, e.g. "/index.html", without the query part (that starts -with a question mark, see request.query and request.url). +The requested path without a leading slash and without the query part (e.g. +"index.html" if "/index.html?a=b&c=d" has been requested). For the query part, +see request.query. + +This value will be nil if (and only if) the request method is "OPTIONS" with a +request target equal to "*" (see also asterisk-form of request-target in +section 5.3.4 in RFC 7230). ### request.post_metadata @@ -300,9 +305,15 @@ ### request.query -Query part of request path without the leading question mark, e.g. "a=b&c=d" if -request.path is "index.html?a=b&c=d". The data is automatically parsed and made -available through request.get_params and request.get_params_list. +Query part of the request target without the leading question mark, e.g. +"a=b&c=d" if the requested target is "/index.html?a=b&c=d". The data is +automatically parsed and made available through request.get_params and +request.get_params_list. + +If there is no query part given in the request target, then this string is +the empty string. This value will be nil if (and only if) the request method +is "OPTIONS" with a request target equal to "*" (see also asterisk-form of +request-target in section 5.3.4 in RFC 7230). ### request:process_request_body() @@ -403,9 +414,3 @@ given. -### request.url - -The requested URL. This value is automatically split up into request.path and -request.query using the question mark as delimiter. The - -