Skip to content

Commit 02abd6e

Browse files
authored
Forbid or replace empty targets in HTTP/1.1 requests (#469)
1 parent 763e70c commit 02abd6e

File tree

2 files changed

+2
-1
lines changed

2 files changed

+2
-1
lines changed

lib/mint/http1.ex

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -978,6 +978,7 @@ defmodule Mint.HTTP1 do
978978
# Percent-encoding is not case sensitive so we have to account for lowercase and uppercase.
979979
@hex_characters ~c"0123456789abcdefABCDEF"
980980

981+
defp validate_target(<<>> = empty_target), do: {:error, {:invalid_request_target, empty_target}}
981982
defp validate_target(target), do: validate_target(target, target)
982983

983984
defp validate_target(<<?%, char1, char2, rest::binary>>, original_target)

test/mint/http1/conn_test.exs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -761,7 +761,7 @@ defmodule Mint.HTTP1Test do
761761
""")
762762
end
763763

764-
@invalid_request_targets ["/ /", "/%foo", "/foo%x"]
764+
@invalid_request_targets ["", "/ /", "/%foo", "/foo%x"]
765765
test "targets are validated by default", %{port: port, server_ref: server_ref} do
766766
assert {:ok, conn} = HTTP1.connect(:http, "localhost", port)
767767

0 commit comments

Comments
 (0)