summaryrefslogtreecommitdiff
path: root/systems/texlive/tlnet/tlpkg/tlperl/site/lib/HTTP/Daemon.pm
diff options
context:
space:
mode:
Diffstat (limited to 'systems/texlive/tlnet/tlpkg/tlperl/site/lib/HTTP/Daemon.pm')
-rw-r--r--systems/texlive/tlnet/tlpkg/tlperl/site/lib/HTTP/Daemon.pm78
1 files changed, 57 insertions, 21 deletions
diff --git a/systems/texlive/tlnet/tlpkg/tlperl/site/lib/HTTP/Daemon.pm b/systems/texlive/tlnet/tlpkg/tlperl/site/lib/HTTP/Daemon.pm
index c14f498d03..f9b321671e 100644
--- a/systems/texlive/tlnet/tlpkg/tlperl/site/lib/HTTP/Daemon.pm
+++ b/systems/texlive/tlnet/tlpkg/tlperl/site/lib/HTTP/Daemon.pm
@@ -1,11 +1,11 @@
-package HTTP::Daemon; # git description: v6.13-4-ge6492b6
+package HTTP::Daemon; # git description: v6.15-4-gbab5825
# ABSTRACT: A simple http server class
use strict;
use warnings;
-our $VERSION = '6.14';
+our $VERSION = '6.16';
use Socket ();
use IO::Socket::IP;
@@ -192,9 +192,9 @@ READ_HEADER:
}
# Find out how much content to read
- my $te = $r->header('Transfer-Encoding');
- my $ct = $r->header('Content-Type');
- my $len = $r->header('Content-Length');
+ my $tr_enc = $r->header('Transfer-Encoding');
+ my $ct_type = $r->header('Content-Type');
+ my $ct_len = $r->header('Content-Length');
# Act on the Expect header, if it's there
for my $e ($r->header('Expect')) {
@@ -209,7 +209,7 @@ READ_HEADER:
}
}
- if ($te && lc($te) eq 'chunked') {
+ if ($tr_enc && lc($tr_enc) eq 'chunked') {
# Handle chunked transfer encoding
my $body = "";
@@ -280,32 +280,60 @@ READ_HEADER:
$r->push_header($key, $val) if $key;
}
- elsif ($te) {
+ elsif ($tr_enc) {
$self->send_error(501); # Unknown transfer encoding
- $self->reason("Unknown transfer encoding '$te'");
+ $self->reason("Unknown transfer encoding '$tr_enc'");
return;
}
- elsif ($len) {
+ elsif ($ct_len) {
+
+ # After a security issue, we ensure we comply to
+ # RFC-7230 -- HTTP/1.1 Message Syntax and Routing
+ # section 3.3.2 -- Content-Length
+ # section 3.3.3 -- Message Body Length
+
+ # split and clean up Content-Length ', ' separated string
+ my @vals = map {my $str = $_; $str =~ s/^\s+//; $str =~ s/\s+$//; $str }
+ split ',', $ct_len;
+ # check that they are all numbers (RFC: Content-Length = 1*DIGIT)
+ my @nums = grep { /^[0-9]+$/} @vals;
+ unless (@vals == @nums) {
+ my $reason = "Content-Length value must be an unsigned integer";
+ $self->send_error(400, $reason);
+ $self->reason($reason);
+ return;
+ }
+ # check they are all the same
+ my $ct_len = shift @nums;
+ foreach (@nums) {
+ next if $_ == $ct_len;
+ my $reason = "Content-Length values are not the same";
+ $self->send_error(400, $reason);
+ $self->reason($reason);
+ return;
+ }
+ # ensure we have now a fixed header, with only 1 value
+ $r->header('Content-Length' => $ct_len);
# Plain body specified by "Content-Length"
- my $missing = $len - length($buf);
+ my $missing = $ct_len - length($buf);
while ($missing > 0) {
print "Need $missing more bytes of content\n" if $DEBUG;
my $n = $self->_need_more($buf, $timeout, $fdset);
return unless $n;
$missing -= $n;
}
- if (length($buf) > $len) {
- $r->content(substr($buf, 0, $len));
- substr($buf, 0, $len) = '';
+ if (length($buf) > $ct_len) {
+ $r->content(substr($buf, 0, $ct_len));
+ substr($buf, 0, $ct_len) = '';
}
else {
$r->content($buf);
$buf = '';
}
}
- elsif ($ct && $ct =~ m/^multipart\/\w+\s*;.*boundary\s*=\s*("?)(\w+)\1/i) {
+ elsif ($ct_type && $ct_type =~ m/^multipart\/\w+\s*;.*boundary\s*=\s*("?)(\w+)\1/i) {
# Handle multipart content type
my $boundary = "$CRLF--$2--";
@@ -497,8 +525,8 @@ sub send_redirect {
print $self "Location: $loc$CRLF";
if ($content) {
- my $ct = $content =~ /^\s*</ ? "text/html" : "text/plain";
- print $self "Content-Type: $ct$CRLF";
+ my $ct_type = $content =~ /^\s*</ ? "text/html" : "text/plain";
+ print $self "Content-Type: $ct_type$CRLF";
}
print $self $CRLF;
print $self $content if $content && !$self->head_request;
@@ -537,12 +565,12 @@ sub send_file_response {
local (*F);
sysopen(F, $file, 0) or return $self->send_error(RC_FORBIDDEN);
binmode(F);
- my ($ct, $ce) = guess_media_type($file);
+ my ($mime_type, $file_enc) = guess_media_type($file);
my ($size, $mtime) = (stat _)[7, 9];
unless ($self->antique_client) {
$self->send_basic_header;
- print $self "Content-Type: $ct$CRLF";
- print $self "Content-Encoding: $ce$CRLF" if $ce;
+ print $self "Content-Type: $mime_type$CRLF";
+ print $self "Content-Encoding: $file_enc$CRLF" if $file_enc;
print $self "Content-Length: $size$CRLF" if $size;
print $self "Last-Modified: ", time2str($mtime), "$CRLF" if $mtime;
print $self $CRLF;
@@ -603,7 +631,7 @@ HTTP::Daemon - A simple http server class
=head1 VERSION
-version 6.14
+version 6.16
=head1 SYNOPSIS
@@ -915,7 +943,7 @@ Gisle Aas <gisle@activestate.com>
=head1 CONTRIBUTORS
-=for stopwords Olaf Alders Ville Skyttä Karen Etheridge Mark Stosberg Shoichi Kaji Chase Whitener Slaven Rezic Petr Písař Zefram Alexey Tourbin Bron Gondwana Michal Josef Špaček Mike Schilli Tom Hukins Adam Kennedy Sjogren Alex Kapranoff amire80 Andreas J. Koenig Bill Mann Daniel Hedlund David E. Wheeler DAVIDRW Father Chrysostomos Ferenc Erki FWILES Gavin Peters Graeme Thompson Hans-H. Froehlich Ian Kilgore Jacob J jefflee john9art murphy Ondrej Hanak Perlover Peter Rabbitson phrstbrn Robert Stone Rolf Grossmann ruff sasao Sean M. Burke Spiros Denaxas Steve Hay Todd Lipcon Tony Finch Toru Yamaguchi Yuri Karaban
+=for stopwords Olaf Alders Ville Skyttä Graham Knop Karen Etheridge Mark Stosberg Shoichi Kaji Chase Whitener Theo van Hoesel Slaven Rezic Petr Písař Zefram Alexey Tourbin Bron Gondwana Michal Josef Špaček Mike Schilli Tom Hukins Adam Kennedy Sjogren Alex Kapranoff amire80 Andreas J. Koenig Bill Mann Daniel Hedlund David E. Wheeler DAVIDRW Father Chrysostomos Ferenc Erki FWILES Gavin Peters Graeme Thompson Hans-H. Froehlich Ian Kilgore Jacob J jefflee john9art murphy Ondrej Hanak Perlover Peter Rabbitson phrstbrn Robert Stone Rolf Grossmann ruff sasao Sean M. Burke Spiros Denaxas Steve Hay Todd Lipcon Tony Finch Toru Yamaguchi Yuri Karaban
=over 4
@@ -929,6 +957,10 @@ Ville Skyttä <ville.skytta@iki.fi>
=item *
+Graham Knop <haarg@haarg.org>
+
+=item *
+
Karen Etheridge <ether@cpan.org>
=item *
@@ -945,6 +977,10 @@ Chase Whitener <capoeirab@cpan.org>
=item *
+Theo van Hoesel <tvanhoesel@perceptyx.com>
+
+=item *
+
Slaven Rezic <slaven@rezic.de>
=item *