Bug 3074: Improper URL handling with empty path (RFC 3986)

diff --git a/src/url.cc b/src/url.cc
index 2f1eeb594c5ca9fcce513d07f978fc8db3bac244..c93a13931f5d99d0179e8e7ccb6a5285d12bad66 100644 (file)
--- a/src/url.cc
+++ b/src/url.cc
@@ -268,8 +268,9 @@ urlParse(const HttpRequestMethod& method, char *url, HttpRequest *request)
         src += 3;
 
         /* Then everything until first /; thats host (and port; which we'll look for here later) */
-        /* bug 1881: If we don't get a "/" then we imply it was there */
-        for (dst = host; i < l && *src != '/' && *src != '\0'; i++, src++, dst++) {
+        // bug 1881: If we don't get a "/" then we imply it was there
+        // bug 3074: We could just be given a "?" or "#". These also imply "/"
+        for (dst = host; i < l && *src != '/' && *src != '?' && *src != '#' && *src != '\0'; i++, src++, dst++) {
             *dst = *src;
         }
 
@@ -282,8 +283,15 @@ urlParse(const HttpRequestMethod& method, char *url, HttpRequest *request)
             return NULL;
         *dst = '\0';
 
+        // bug 3074: received 'path' starting with '?', '#', or '\0' implies '/'
+        if (*src == '?' || *src == '#' || *src == '\0') {
+            urlpath[0] = '/';
+            dst = &urlpath[1];
+        } else {
+            dst = urlpath;
+        }
         /* Then everything from / (inclusive) until \r\n or \0 - thats urlpath */
-        for (dst = urlpath; i < l && *src != '\r' && *src != '\n' && *src != '\0'; i++, src++, dst++) {
+        for (; i < l && *src != '\r' && *src != '\n' && *src != '\0'; i++, src++, dst++) {
             *dst = *src;
         }