Fixed problem with invalid requests including spaces in URL path

* Special function to encode query params

* Fix #include <iomanip>

* Added unescaped charsets to encode_query_param

* Unit tests for encode_query_param

README.md

@@ -5,7 +5,7 @@ cpp-httplib
 
 A C++11 single-file header-only cross platform HTTP/HTTPS library.
 
-It's extremely easy to setup. Just include **httplib.h** file in your code!
+It's extremely easy to setup. Just include the **httplib.h** file in your code!
 
 NOTE: This is a 'blocking' HTTP library. If you are looking for a 'non-blocking' library, this is not the one that you want.
 
@@ -120,24 +120,50 @@ svr.set_file_extension_and_mimetype_mapping("hh", "text/x-h");
 
 The followings are built-in mappings:
 
-| Extension |     MIME Type          |
-| :-------- | :--------------------- |
-| txt       | text/plain             |
-| html, htm | text/html              |
-| css       | text/css               |
-| jpeg, jpg | image/jpg              |
-| png       | image/png              |
-| gif       | image/gif              |
-| svg       | image/svg+xml          |
-| ico       | image/x-icon           |
-| json      | application/json       |
-| pdf       | application/pdf        |
-| js        | application/javascript |
-| wasm      | application/wasm       |
-| xml       | application/xml        |
-| xhtml     | application/xhtml+xml  |
+| Extension  |          MIME Type          |
+| :--------- | :-------------------------- |
+| css        | text/css                    |
+| csv        | text/csv                    |
+| txt        | text/plain                  |
+| vtt        | text/vtt                    |
+| html, htm  | text/html                   |
+| apng       | image/apng                  |
+| avif       | image/avif                  |
+| bmp        | image/bmp                   |
+| gif        | image/gif                   |
+| png        | image/png                   |
+| svg        | image/svg+xml               |
+| webp       | image/webp                  |
+| ico        | image/x-icon                |
+| tif        | image/tiff                  |
+| tiff       | image/tiff                  |
+| jpeg, jpg  | image/jpeg                  |
+| mp4        | video/mp4                   |
+| mpeg       | video/mpeg                  |
+| webm       | video/webm                  |
+| mp3        | audio/mp3                   |
+| mpga       | audio/mpeg                  |
+| weba       | audio/webm                  |
+| wav        | audio/wave                  |
+| otf        | font/otf                    |
+| ttf        | font/ttf                    |
+| woff       | font/woff                   |
+| woff2      | font/woff2                  |
+| 7z         | application/x-7z-compressed |
+| atom       | application/atom+xml        |
+| pdf        | application/pdf             |
+| mjs, js    | application/javascript      |
+| json       | application/json            |
+| rss        | application/rss+xml         |
+| tar        | application/x-tar           |
+| xhtml, xht | application/xhtml+xml       |
+| xslt       | application/xslt+xml        |
+| xml        | application/xml             |
+| gz         | application/gzip            |
+| zip        | application/zip             |
+| wasm       | application/wasm            |
 
-NOTE: These the static file server methods are not thread safe.
+NOTE: These static file server methods are not thread-safe.
 
 ### Logging
 
@@ -171,7 +197,7 @@ svr.Post("/multipart", [&](const auto& req, auto& res) {
 });
 ```
 
-### Receive content with Content receiver
+### Receive content with a content receiver
 
 ```cpp
 svr.Post("/content_receiver",
@@ -198,7 +224,7 @@ svr.Post("/content_receiver",
   });
 ```
 
-### Send content with Content provider
+### Send content with the content provider
 
 ```cpp
 const size_t DATA_CHUNK_SIZE = 4;
@@ -255,7 +281,7 @@ svr.Get("/chunked", [&](const Request& req, Response& res) {
 
 ### 'Expect: 100-continue' handler
 
-As default, the server sends `100 Continue` response for `Expect: 100-continue` header.
+By default, the server sends a `100 Continue` response for an `Expect: 100-continue` header.
 
 ```cpp
 // Send a '417 Expectation Failed' response.
@@ -275,6 +301,7 @@ svr.set_expect_100_continue_handler([](const Request &req, Response &res) {
 
 ```cpp
 svr.set_keep_alive_max_count(2); // Default is 5
+svr.set_keep_alive_timeout(10);  // Default is 5
 ```
 
 ### Timeout
@@ -285,7 +312,7 @@ svr.set_write_timeout(5, 0); // 5 seconds
 svr.set_idle_interval(0, 100000); // 100 milliseconds
 ```
 
-### Set maximum payload length for reading request body
+### Set maximum payload length for reading a request body
 
 ```c++
 svr.set_payload_max_length(1024 * 1024 * 512); // 512MB
@@ -470,7 +497,7 @@ cli.set_read_timeout(5, 0); // 5 seconds
 cli.set_write_timeout(5, 0); // 5 seconds
 ```
 
-### Receive content with Content receiver
+### Receive content with a content receiver
 
 ```c++
 std::string body;
@@ -497,7 +524,7 @@ auto res = cli.Get(
   });
 ```
 
-### Send content with Content provider
+### Send content with a content provider
 
 ```cpp
 std::string body = ...;
@@ -620,7 +647,7 @@ res = cli.Get("/");
 res->status; // 200
 ```
 
-### Use a specitic network interface
+### Use a specific network interface
 
 NOTE: This feature is not available on Windows, yet.
 
@@ -654,7 +681,7 @@ be to set up a signal handler for SIGPIPE to handle or ignore it yourself.
 Compression
 -----------
 
-The server can applie compression to the following MIME type contents:
+The server can apply compression to the following MIME type contents:
 
   * all text types except text/event-stream
   * image/svg+xml
@@ -718,7 +745,7 @@ Include `httplib.h` before `Windows.h` or include `Windows.h` by defining `WIN32
 #include <httplib.h>
 ```
 
-Note: Cygwin on Windows is not supported.
+Note: Windows 8 or lower and Cygwin on Windows are not supported.
 
 License
 -------

test/fuzzing/server_fuzzer.cc

@@ -1,28 +1,26 @@
-#include <memory>
 #include <httplib.h>
+#include <memory>
 
 class FuzzedStream : public httplib::Stream {
- public:
-  FuzzedStream(const uint8_t* data, size_t size)
+public:
+  FuzzedStream(const uint8_t *data, size_t size)
       : data_(data), size_(size), read_pos_(0) {}
 
-  ssize_t read(char* ptr, size_t size) override {
-    if (size + read_pos_ > size_) {
-      size = size_ - read_pos_;
-    }
+  ssize_t read(char *ptr, size_t size) override {
+    if (size + read_pos_ > size_) { size = size_ - read_pos_; }
     memcpy(ptr, data_ + read_pos_, size);
     read_pos_ += size;
-    return size;
+    return static_cast<ssize_t>(size);
   }
 
-  ssize_t write(const char* ptr, size_t size) override {
+  ssize_t write(const char *ptr, size_t size) override {
     response_.append(ptr, size);
     return static_cast<int>(size);
   }
 
-  int write(const char* ptr) { return write(ptr, strlen(ptr)); }
+  ssize_t write(const char *ptr) { return write(ptr, strlen(ptr)); }
 
-  int write(const std::string& s) { return write(s.data(), s.size()); }
+  ssize_t write(const std::string &s) { return write(s.data(), s.size()); }
 
   std::string get_remote_addr() const { return ""; }
 
@@ -37,16 +35,16 @@ class FuzzedStream : public httplib::Stream {
 
   socket_t socket() const override { return 0; }
 
- private:
-  const uint8_t* data_;
+private:
+  const uint8_t *data_;
   size_t size_;
   size_t read_pos_;
   std::string response_;
 };
 
 class FuzzableServer : public httplib::Server {
- public:
-  void ProcessFuzzedRequest(FuzzedStream& stream) {
+public:
+  void ProcessFuzzedRequest(FuzzedStream &stream) {
     bool connection_close = false;
     process_request(stream, /*last_connection=*/false, connection_close,
                     nullptr);
@@ -55,36 +53,36 @@ class FuzzableServer : public httplib::Server {
 
 static FuzzableServer g_server;
 
-extern "C" int LLVMFuzzerInitialize(int* argc, char*** argv) {
+extern "C" int LLVMFuzzerInitialize(int * /*argc*/, char *** /*argv*/) {
   g_server.Get(R"(.*)",
-                [&](const httplib::Request& req, httplib::Response& res) {
+               [&](const httplib::Request & /*req*/, httplib::Response &res) {
+                 res.set_content("response content", "text/plain");
+               });
+  g_server.Post(R"(.*)",
+                [&](const httplib::Request & /*req*/, httplib::Response &res) {
                   res.set_content("response content", "text/plain");
                 });
-  g_server.Post(R"(.*)",
-                 [&](const httplib::Request& req, httplib::Response& res) {
+  g_server.Put(R"(.*)",
+               [&](const httplib::Request & /*req*/, httplib::Response &res) {
+                 res.set_content("response content", "text/plain");
+               });
+  g_server.Patch(R"(.*)",
+                 [&](const httplib::Request & /*req*/, httplib::Response &res) {
                    res.set_content("response content", "text/plain");
                  });
-  g_server.Put(R"(.*)",
-                [&](const httplib::Request& req, httplib::Response& res) {
-                  res.set_content("response content", "text/plain");
-                });
-  g_server.Patch(R"(.*)",
-                  [&](const httplib::Request& req, httplib::Response& res) {
-                    res.set_content("response content", "text/plain");
-                  });
-  g_server.Delete(R"(.*)",
-                   [&](const httplib::Request& req, httplib::Response& res) {
-                     res.set_content("response content", "text/plain");
-                   });
-  g_server.Options(R"(.*)",
-                    [&](const httplib::Request& req, httplib::Response& res) {
-                      res.set_content("response content", "text/plain");
-                    });
+  g_server.Delete(
+      R"(.*)", [&](const httplib::Request & /*req*/, httplib::Response &res) {
+        res.set_content("response content", "text/plain");
+      });
+  g_server.Options(
+      R"(.*)", [&](const httplib::Request & /*req*/, httplib::Response &res) {
+        res.set_content("response content", "text/plain");
+      });
   return 0;
 }
 
-extern "C" int LLVMFuzzerTestOneInput(const uint8_t* data, size_t size) {
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {
   FuzzedStream stream{data, size};
   g_server.ProcessFuzzedRequest(stream);
   return 0;
-}
+}

test/gtest/gtest-all.cc

@@ -42,8 +42,9 @@
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wsign-conversion"
 #elif __GNUC__
-#pragma gcc diagnostic push
-#pragma gcc diagnostic ignored "-Wsign-conversion"
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wsign-conversion"
+#pragma GCC diagnostic ignored "-Wconversion"
 #endif
 
 // The following lines pull in the real gtest *.cc files.
@@ -9127,5 +9128,5 @@ const char* TypedTestCasePState::VerifyRegisteredTestNames(
 #if __clang__
 #pragma clang diagnostic pop
 #elif __GNUC__
-#pragma gcc diagnostic pop
+#pragma GCC diagnostic pop
 #endif

test/gtest/gtest.h

@@ -63,8 +63,9 @@
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wsign-compare"
 #elif __GNUC__
-#pragma gcc diagnostic push
-#pragma gcc diagnostic ignored "-Wsign-compare"
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wsign-compare"
+#pragma GCC diagnostic ignored "-Wconversion"
 #endif
 
 // Copyright 2005, Google Inc.
@@ -18353,8 +18354,8 @@ AssertionResult CmpHelperEQ(const char* expected_expression,
 #pragma clang diagnostic push
 #pragma clang diagnostic ignored "-Wsign-compare"
 #elif __GNUC__
-#pragma gcc diagnostic push
-#pragma gcc diagnostic ignored "-Wsign-compare"
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wsign-compare"
 #endif
 
   if (expected == actual) {
@@ -18366,7 +18367,7 @@ AssertionResult CmpHelperEQ(const char* expected_expression,
 #elif __clang__
 #pragma clang diagnostic pop
 #elif __GNUC__
-#pragma gcc diagnostic pop
+#pragma GCC diagnostic pop
 #endif
 
   return EqFailure(expected_expression,
@@ -19564,7 +19565,7 @@ bool StaticAssertTypeEq() {
 #if __clang__
 #pragma clang diagnostic pop
 #elif __GNUC__
-#pragma gcc diagnostic pop
+#pragma GCC diagnostic pop
 #endif
 
 #endif  // GTEST_INCLUDE_GTEST_GTEST_H_

test/test.cc

@@ -2,10 +2,10 @@
 
 #include <gtest/gtest.h>
 
+#include <atomic>
 #include <chrono>
 #include <future>
 #include <thread>
-#include <atomic>
 
 #define SERVER_CERT_FILE "./cert.pem"
 #define SERVER_CERT2_FILE "./cert2.pem"
@@ -46,6 +46,18 @@ TEST(StartupTest, WSAStartup) {
 }
 #endif
 
+TEST(EncodeQueryParamTest, ParseUnescapedChararactersTest){
+  string unescapedCharacters = "-_.!~*'()";
+
+  EXPECT_EQ(detail::encode_query_param(unescapedCharacters), "-_.!~*'()");
+}
+
+TEST(EncodeQueryParamTest, ParseReservedCharactersTest){
+  string reservedCharacters = ";,/?:@&=+$";
+
+  EXPECT_EQ(detail::encode_query_param(reservedCharacters), "%3B%2C%2F%3F%3A%40%26%3D%2B%24");
+}
+
 TEST(TrimTests, TrimStringTests) {
   EXPECT_EQ("abc", detail::trim_copy("abc"));
   EXPECT_EQ("abc", detail::trim_copy("  abc  "));
@@ -930,6 +942,31 @@ TEST(ErrorHandlerTest, ContentLength) {
   ASSERT_FALSE(svr.is_running());
 }
 
+TEST(InvalidFormatTest, StatusCode) {
+  Server svr;
+
+  svr.Get("/hi", [](const Request & /*req*/, Response &res) {
+    res.set_content("Hello World!\n", "text/plain");
+    res.status = 9999; // Status should be a three-digit code...
+  });
+
+  auto thread = std::thread([&]() { svr.listen(HOST, PORT); });
+
+  // Give GET time to get a few messages.
+  std::this_thread::sleep_for(std::chrono::seconds(1));
+
+  {
+    Client cli(HOST, PORT);
+
+    auto res = cli.Get("/hi");
+    ASSERT_FALSE(res);
+  }
+
+  svr.stop();
+  thread.join();
+  ASSERT_FALSE(svr.is_running());
+}
+
 class ServerTest : public ::testing::Test {
 protected:
   ServerTest()
@@ -1676,6 +1713,16 @@ TEST_F(ServerTest, UserDefinedMIMETypeMapping) {
   EXPECT_EQ("abcde", res->body);
 }
 
+TEST_F(ServerTest, StaticFileRange) {
+  auto res = cli_.Get("/dir/test.abcde", {{make_range_header({{2, 3}})}});
+  ASSERT_TRUE(res);
+  EXPECT_EQ(206, res->status);
+  EXPECT_EQ("text/abcde", res->get_header_value("Content-Type"));
+  EXPECT_EQ("2", res->get_header_value("Content-Length"));
+  EXPECT_EQ(true, res->has_header("Content-Range"));
+  EXPECT_EQ(std::string("cd"), res->body);
+}
+
 TEST_F(ServerTest, InvalidBaseDirMount) {
   EXPECT_EQ(false, svr_.set_mount_point("invalid_mount_point", "./www3"));
 }
@@ -1759,7 +1806,8 @@ TEST_F(ServerTest, LongHeader) {
       "@@@@@@@@@@@@@@@@");
 
   auto res = std::make_shared<Response>();
-  auto ret = cli_.send(req, *res);
+  auto error = Error::Success;
+  auto ret = cli_.send(req, *res, error);
 
   ASSERT_TRUE(ret);
   EXPECT_EQ(200, res->status);
@@ -1819,7 +1867,8 @@ TEST_F(ServerTest, TooLongHeader) {
       "@@@@@@@@@@@@@@@@@");
 
   auto res = std::make_shared<Response>();
-  auto ret = cli_.send(req, *res);
+  auto error = Error::Success;
+  auto ret = cli_.send(req, *res, error);
 
   ASSERT_TRUE(ret);
   EXPECT_EQ(200, res->status);
@@ -1908,7 +1957,8 @@ TEST_F(ServerTest, CaseInsensitiveTransferEncoding) {
   req.body = "4\r\ndech\r\nf\r\nunked post body\r\n0\r\n\r\n";
 
   auto res = std::make_shared<Response>();
-  auto ret = cli_.send(req, *res);
+  auto error = Error::Success;
+  auto ret = cli_.send(req, *res, error);
 
   ASSERT_TRUE(ret);
   EXPECT_EQ(200, res->status);
@@ -2125,7 +2175,8 @@ TEST_F(ServerTest, LargeChunkedPost) {
   req.body = chunk + chunk + chunk + chunk + chunk + chunk + "0\r\n\r\n";
 
   auto res = std::make_shared<Response>();
-  auto ret = cli_.send(req, *res);
+  auto error = Error::Success;
+  auto ret = cli_.send(req, *res, error);
 
   ASSERT_TRUE(ret);
   EXPECT_EQ(200, res->status);
@@ -2551,7 +2602,8 @@ TEST_F(ServerTest, HTTP2Magic) {
   req.body = "SM";
 
   auto res = std::make_shared<Response>();
-  auto ret = cli_.send(req, *res);
+  auto error = Error::Success;
+  auto ret = cli_.send(req, *res, error);
 
   ASSERT_TRUE(ret);
   EXPECT_EQ(400, res->status);
@@ -2762,7 +2814,7 @@ TEST_F(ServerTest, Brotli) {
 // Sends a raw request to a server listening at HOST:PORT.
 static bool send_request(time_t read_timeout_sec, const std::string &req,
                          std::string *resp = nullptr) {
-  std::atomic<Error> error(Error::Success);
+  auto error = Error::Success;
 
   auto client_sock =
       detail::create_client_socket(HOST, PORT, false, nullptr,
@@ -2952,6 +3004,12 @@ TEST(ServerRequestParsingTest, InvalidHeaderTextWithExtraCR) {
                    "Content-Type: text/plain\r\n\r");
 }
 
+TEST(ServerRequestParsingTest, InvalidSpaceInURL) {
+  std::string out;
+  test_raw_request("GET /h i HTTP/1.1\r\n\r\n", &out);
+  EXPECT_EQ("HTTP/1.1 400 Bad Request", out.substr(0, 24));
+}
+
 TEST(ServerStopTest, StopServerWithChunkedTransmission) {
   Server svr;