receiveHTTP does not preprocess the incoming URI before it is parsed
- 主要语言
- Haskell
- 星标
- 186
- 派生
- 59
- PR 合并指标
- 30 天内没有已合并 PR
描述
Because of the strict parsing of URIs by Network.URI.parseURIReference, parseRequestHead fails on this "almost valid" URI:
```
ghci> parseRequestHead ["GET http://fonts.googleapis.com/css?family=Roboto:300|Open+Sans:700|Open+Sans:300&lang=en HTTP/1.1"]
ghci> Left (ErrorParse "parseRequestHead Request command line parse failure: GET http://fonts.googleapis.com/css?family=Roboto:300|Open+Sans:700|Open+Sans:300&lang=en HTTP/1.1")
```
Replacing the pipe characters with %7C allows the URI to parse.
receiveHTTP, or maybe parseRequestHead, should probably try to escape the characters that are considered invalid for URIs, before sending the string through parseURIReference.
In that regard, `escapeURIString isAllowedInURI` from Network.URI may be handy.
(Something about "be conservative in what you send, be liberal in what you accept" prompted me to raise this issue.)
贡献指南
这个仓库没有索引到贡献指南
调研方向
首先阅读 receiveHTTP 和 parseRequestHead,然后检查传入请求 URI 如何到达 Network.URI.parseURIReference。检查针对无效 URI 字符所建议的 escapeURIString isAllowedInURI 行为,并考虑 issue 中提到的两个入口点。完成的标准是:所示 URI 能够被接受,同时已经有效的 URI 仍能继续被正确解析。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- haskell
- 领域
- networking
- Issue 类型
- 缺陷
- 难度
- 3/5
- 预计耗时
- 1-2 天
- 活跃度
- 停滞
- 描述清晰度
- 基本清楚
- 新手友好度
- 42/100