authorgravatar for arshidkv12@gmail.comarshidkv12 <arshidkv12@gmail.com> 2026-07-04 03:53:33+02:00
committergravatar for squeek502@hotmail.comRyan Liptak <squeek502@hotmail.com> 2026-07-04 03:53:33+02:00
logbd4e82b460f3a2173ff546e59ae3a903fb1c1c50
treedc100eabfc221ac0296fd371753c5aac2847c49e
parent67b05e521603be6bd276f26b30523b03a58cb0e0

std.Uri: validate host length in parseAfterScheme (#35604)

Fixes https://codeberg.org/ziglang/zig/issues/35578 Reviewed-on: https://codeberg.org/ziglang/zig/pulls/35604

1 files changed, 9 insertions(+), 7 deletions(-)

lib/std/Uri.zig+9-7
...@@ -197,12 +197,7 @@ pub fn percentDecodeInPlace(buffer: []u8) []u8 {...@@ -197,12 +197,7 @@ pub fn percentDecodeInPlace(buffer: []u8) []u8 {
197 return percentDecodeBackwards(buffer, buffer);197 return percentDecodeBackwards(buffer, buffer);
198}198}
199199
200pub const ParseError = error{200pub const ParseError = error{ UnexpectedCharacter, InvalidFormat, InvalidPort, InvalidHostName };
201 UnexpectedCharacter,
202 InvalidFormat,
203 InvalidPort,
204 InvalidHostName,
205};
206201
207/// Parses the URI or returns an error. This function is not compliant, but is required to parse202/// Parses the URI or returns an error. This function is not compliant, but is required to parse
208/// some forms of URIs in the wild, such as HTTP Location headers.203/// some forms of URIs in the wild, such as HTTP Location headers.
...@@ -264,7 +259,9 @@ pub fn parseAfterScheme(scheme: []const u8, text: []const u8) ParseError!Uri {...@@ -264,7 +259,9 @@ pub fn parseAfterScheme(scheme: []const u8, text: []const u8) ParseError!Uri {
264 }259 }
265260
266 if (start_of_host >= end_of_host) return error.InvalidFormat;261 if (start_of_host >= end_of_host) return error.InvalidFormat;
267 uri.host = .{ .percent_encoded = authority[start_of_host..end_of_host] };262 const host = authority[start_of_host..end_of_host];
263 if (host.len > HostName.max_len) return error.InvalidHostName;
264 uri.host = .{ .percent_encoded = host };
268 }265 }
269266
270 const path_start = i;267 const path_start = i;
...@@ -594,6 +591,11 @@ test "should fail gracefully" {...@@ -594,6 +591,11 @@ test "should fail gracefully" {
594 try std.testing.expectError(error.InvalidFormat, parse("foobar://"));591 try std.testing.expectError(error.InvalidFormat, parse("foobar://"));
595}592}
596593
594test "parse name too long" {
595 const uri = "http://" ++ @as([HostName.max_len + 1]u8, @splat('Z'));
596 try std.testing.expectError(error.InvalidHostName, parse(uri));
597}
598
597test "file" {599test "file" {
598 const parsed = try parse("file:///");600 const parsed = try parse("file:///");
599 try std.testing.expectEqualStrings("file", parsed.scheme);601 try std.testing.expectEqualStrings("file", parsed.scheme);