From: Fyodor <fygrave@gmail.com>
Date: Tue, 5 Jun 2012 09:06:55 +0000 (-0600)
Subject: Bug 3074: Improper URL handling with empty path (RFC 3986)
X-Git-Tag: SQUID_3_1_20~3
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=fe1507015c7834091b352e67fd41a423b41abfb6;p=thirdparty%2Fsquid.git

Bug 3074: Improper URL handling with empty path (RFC 3986)
---

diff --git a/src/url.cc b/src/url.cc
index 82e5d632fc..6222fe729a 100644
--- a/src/url.cc
+++ b/src/url.cc
@@ -267,8 +267,9 @@ urlParse(const HttpRequestMethod& method, char *url, HttpRequest *request)
         src += 3;
 
         /* Then everything until first /; thats host (and port; which we'll look for here later) */
-        /* bug 1881: If we don't get a "/" then we imply it was there */
-        for (dst = host; i < l && *src != '/' && *src != '\0'; i++, src++, dst++) {
+        // bug 1881: If we don't get a "/" then we imply it was there
+        // bug 3074: We could just be given a "?" or "#". These also imply "/"
+        for (dst = host; i < l && *src != '/' && *src != '?' && *src != '#' && *src != '\0'; i++, src++, dst++) {
             *dst = *src;
         }
 
@@ -281,8 +282,15 @@ urlParse(const HttpRequestMethod& method, char *url, HttpRequest *request)
             return NULL;
         *dst = '\0';
 
+        // bug 3074: received 'path' starting with '?', '#', or '\0' implies '/'
+        if (*src == '?' || *src == '#' || *src == '\0') {
+            urlpath[0] = '/';
+            dst = &urlpath[1];
+        } else {
+            dst = urlpath;
+        }
         /* Then everything from / (inclusive) until \r\n or \0 - thats urlpath */
-        for (dst = urlpath; i < l && *src != '\r' && *src != '\n' && *src != '\0'; i++, src++, dst++) {
+        for (; i < l && *src != '\r' && *src != '\n' && *src != '\0'; i++, src++, dst++) {
             *dst = *src;
         }