aboutsummaryrefslogtreecommitdiff
path: root/src/core/ngx_string.c
Commit message (Collapse)AuthorAge
* Core: stricter UTF-8 handling in ngx_utf8_decode().Yugo Horie2023-02-23
| | | | | | | | | | An UTF-8 octet sequence cannot start with a 11111xxx byte (above 0xf8), see https://datatracker.ietf.org/doc/html/rfc3629#section-3. Previously, such bytes were accepted by ngx_utf8_decode() and misinterpreted as 11110xxx bytes (as in a 4-byte sequence). While unlikely, this can potentially cause issues. Fix is to explicitly reject such bytes in ngx_utf8_decode().
* Core: escaping of chars not allowed in URIs per RFC 3986.Maxim Dounin2021-06-28
| | | | | | | | | | | | | | | | | | | | | Per RFC 3986 only the following characters are allowed in URIs unescaped: unreserved = ALPHA / DIGIT / "-" / "." / "_" / "~" gen-delims = ":" / "/" / "?" / "#" / "[" / "]" / "@" sub-delims = "!" / "$" / "&" / "'" / "(" / ")" / "*" / "+" / "," / ";" / "=" And "%" can appear as a part of escaping itself. The following characters are not allowed and need to be escaped: %00-%1F, %7F-%FF, " ", """, "<", ">", "\", "^", "`", "{", "|", "}". Not escaping ">" is known to cause problems at least with MS Exchange (see http://nginx.org/pipermail/nginx-ru/2010-January/031261.html) and in Tomcat (ticket #2191). The patch adds escaping of the following chars in all URI parts: """, "<", ">", "\", "^", "`", "{", "|", "}". Note that comments are mostly preserved to outline important characters being escaped.
* Core: fixed comment about escaping in arguments.Maxim Dounin2021-06-28
| | | | | After 4954530db2af, the ";" character is escaped by ngx_escape_uri(NGX_ESCAPE_ARGS).
* Core: fixed comment about msie_refresh escaping.Ruslan Ermilov2021-05-19
| | | | | After 12a656452ad1, the "%" character is no longer escaped by ngx_escape_uri(NGX_ESCAPE_REFRESH).
* Core: added format specifiers to output binary data as hex.Vladimir Homutov2020-10-28
| | | | | | | Now "s", "V", and "v" format specifiers may be prefixed with "x" (lowercase) or "X" (uppercase) to output corresponding data in hexadecimal format. In collaboration with Maxim Dounin.
* Fixed incorrect length handling in ngx_utf8_length().Maxim Dounin2019-04-15
| | | | | | | | | | | | | Previously, ngx_utf8_decode() was called from ngx_utf8_length() with incorrect length, potentially resulting in out-of-bounds read when handling invalid UTF-8 strings. In practice out-of-bounds reads are not possible though, as autoindex, the only user of ngx_utf8_length(), provides null-terminated strings, and ngx_utf8_decode() anyway returns an errors when it sees a null in the middle of an UTF-8 sequence. Reported by Yunbin Liu.
* Core: ngx_explicit_memzero().Maxim Dounin2018-11-15
|
* Fixed handling of non-null-terminated unix sockets.Maxim Dounin2017-10-04
| | | | | | | | | | | | | At least FreeBSD, macOS, NetBSD, and OpenBSD can return unix sockets with non-null-terminated sun_path. Additionally, the address may become non-null-terminated if it does not fit into the buffer provided and was truncated (may happen on macOS, NetBSD, and Solaris, which allow unix socket addresess larger than struct sockaddr_un). As such, ngx_sock_ntop() might overread the sockaddr provided, as it used "%s" format and thus assumed null-terminated string. To fix this, the ngx_strnlen() function was introduced, and it is now used to calculate correct length of sun_path.
* Parenthesized ASCII-related calculations.Valentin Bartenev2017-07-17
| | | | | This also fixes potential undefined behaviour in the range and slice filter modules, caused by local overflows of signed integers in expressions.
* Core: improved JSON escaping.Valentin Bartenev2017-04-12
| | | | Two-character representations are now used for \b, \f, \n, \r, and \t.
* Avoid left-shifting integers into the sign bit, which is undefined.Sergey Kandaurov2016-07-07
| | | | Found with UndefinedBehaviorSanitizer.
* Style: NGX_PTR_SIZE replaced with sizeof(void *).Maxim Dounin2015-12-03
| | | | | The NGX_PTR_SIZE macro is only needed in preprocessor directives where it's not possible to use sizeof().
* Core: overflow detection in number parsing functions.Ruslan Ermilov2015-03-17
|
* A bounds check of %N format on Windows.Igor Sysoev2015-01-27
| | | | Thanks to Joe Bialek, Adam Zabrocki and Microsoft Vulnerability Research.
* Autoindex: implemented JSON output format.Valentin Bartenev2014-12-12
|
* Core: use uppercase hexadecimal digits for percent-encoding.Piotr Sikora2014-06-26
| | | | | | | | | | | | | RFC3986 says that, for consistency, URI producers and normalizers should use uppercase hexadecimal digits for all percent-encodings. This is also what modern web browsers and other tools use. Using lowercase hexadecimal digits makes it harder to interact with those tools in case when use of the percent-encoded URI is required, for example when $request_uri is part of the cache key. Signed-off-by: Piotr Sikora <piotr@cloudflare.com>
* Core: added ngx_encode_base64url().Maxim Dounin2014-02-04
|
* Added ngx_filename_cmp() with "/" sorted to the left.Maxim Dounin2013-09-23
| | | | | | | | | | | | | | | | | | | | | | This patch fixes incorrect handling of auto redirect in configurations like: location /0 { } location /a- { } location /a/ { proxy_pass ... } With previously used sorting, this resulted in the following locations tree (as "-" is less than "/"): "/a-" "/0" "/a/" and a request to "/a" didn't match "/a/" with auto_redirect, as it didn't traverse relevant tree node during lookup (it tested "/a-", then "/0", and then falled back to null location). To preserve locale use for non-ASCII characters on case-insensetive systems, libc's tolower() used.
* Win32: Open Watcom C compatibility fixes.Maxim Dounin2013-09-04
| | | | | | | | | Precompiled headers are disabled as they lead to internal compiler errors with long configure lines. Couple of false positive warnings silenced. Various win32 typedefs are adjusted to work with Open Watcom C 1.9 headers. With this patch, it's now again possible to compile nginx using owc386, with options we normally compile on win32 minus ipv6 and ssl.
* Added "const" to ngx_memcpy() with NGX_MEMCPY_LIMIT defined.Maxim Dounin2012-08-03
| | | | | This fixes warning produced during compilation of the ngx_http_geoip_module due to const qualifier being discarded.
* Fix of "%f" format handling.Igor Sysoev2012-04-23
| | | | ngx_sprintf("%.2f", 0.999) incorrectly resulted in "0.100" instead of "1.00".
* Copyright updated.Maxim Konovalov2012-01-18
|
* Added escaping of double quotes in ngx_escape_html().Maxim Dounin2011-11-25
| | | | Patch by Zaur Abasmirzoev.
* Fixed utf8 decode (ticket #25).Maxim Dounin2011-10-13
| | | | Patch by Alexey Kuts.
* Autoindex: escape '?' in file names.Maxim Dounin2011-10-11
| | | | | | | | | | | | | | | | For files with '?' in their names autoindex generated links with '?' not escaped. This resulted in effectively truncated links as '?' indicates query string start. This is an updated version of the patch originally posted at [1]. It introduces generic NGX_ESCAPE_URI_COMPONENT which escapes everything but unreserved characters as per RFC 3986. This approach also renders unneeded special colon processing (as colon is percent-encoded now), it's dropped accordingly. [1] http://nginx.org/pipermail/nginx-devel/2010-February/000112.html Reported by Konstantin Leonov.
* Replaced "can not" with "cannot" and "could not" in a bunch of places.Ruslan Ermilov2011-09-19
| | | | Fixed nearby grammar errors.
* new ngx_http_secure_link_module with secure_link, secure_link_md5, andIgor Sysoev2010-09-02
| | | | secure_link_expires
* escape ";" in argumentsIgor Sysoev2010-07-30
|
* change ngx_http_variable_value_node_t to more generic ngx_str_node_tIgor Sysoev2010-06-23
|
* use ngx_min() and ngx_max()Igor Sysoev2010-05-14
|
* ngx_atofp()Igor Sysoev2010-05-14
|
* fix rounding issues in %f formatIgor Sysoev2010-05-12
|
* use double in %f format to allow %.15f precisionIgor Sysoev2010-05-12
|
* escape ampersand in argument while rewriteIgor Sysoev2010-04-01
|
* fix ngx_utf8_cpystrn(): it did not fully copy utf-8 stringIgor Sysoev2010-01-11
|
* optimize some cycles:Igor Sysoev2009-11-02
| | | | | | *) delete surplus variable; *) on i386/amd64 "while (n) / n--" is smaller than "while (n--)", because the platforms have no postfix operations
* If .domain.com, .sub.domain.com, and .domain-some.com were defined,Igor Sysoev2009-09-12
| | | | | | | | | | then .sub.domain.com was matched by .domain.com: wildcard names hash was built incorrectly due to sorting order issue of "." vs "-". They were sorted as com.domain com.domain-some com.domain.sub while they should be sorted as com.domain com.domain.sub com.domain-some for correct hash building
* style fixIgor Sysoev2009-09-11
|
* fix typoIgor Sysoev2009-08-26
|
* change surplus for() to while()Igor Sysoev2009-06-05
|
* ngx_vslprintf(), ngx_slprintf()Igor Sysoev2009-04-27
|
* backout r2677 and fix ngx_strlcasestrn() againIgor Sysoev2009-04-06
|
* fix ngx_strlcasestrn()Igor Sysoev2009-04-06
|
* ngx_strlcasestrn()Igor Sysoev2009-04-04
|
* %f formatIgor Sysoev2008-11-10
|
* ngx_strlow()Igor Sysoev2008-08-04
|
* rename ngx_utf_...() to ngx_utf8_...()Igor Sysoev2008-07-29
|
* fix utf-8 names in autoindexIgor Sysoev2008-07-25
|
* *) back out r2040Igor Sysoev2008-06-17
| | | | | | *) refactor ngx_palloc() *) introduce ngx_pnalloc() *) additional pool blocks have smaller header
* use ngx_int_t in ngx_sort() callbackIgor Sysoev2008-03-24
|
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-20 14:48:00 +0000