19012184297

Committed 02 Nov 2025 12:22PM UTC coverage: 90.675% (+0.004%) from 90.671%

Build # 19012184297

Build Type

Pull #4995

github

Committed by

web-flow

Commit Message

Merge c55c7458b into f656d0ef9

Pull Request Pull Request #4995: Reduce/Fix cppcheck warnings in utils directory

Run Details

100460 of 110791 relevant lines covered (90.68%)

12226434.86 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

67.97

/src/lib/utils/http_util/http_util.cpp

/*
* Sketchy HTTP client
* (C) 2013,2016 Jack Lloyd
*     2017 René Korthaus, Rohde & Schwarz Cybersecurity
*
* Botan is released under the Simplified BSD License (see license.txt)
*/

#include <botan/internal/http_util.h>

#include <botan/mem_ops.h>
#include <botan/internal/fmt.h>
#include <botan/internal/mem_utils.h>
#include <botan/internal/parsing.h>
#include <botan/internal/socket.h>
#include <botan/internal/stl_util.h>
#include <iomanip>
#include <sstream>

namespace Botan::HTTP {

namespace {

/*
* Connect to a host, write some bytes, then read until the server
* closes the socket.
*/
std::string http_transact(std::string_view hostname,
                          std::string_view service,
                          std::string_view message,
                          std::chrono::milliseconds timeout) {
   std::unique_ptr<OS::Socket> socket;

   const std::chrono::system_clock::time_point start_time = std::chrono::system_clock::now();

   try {
      socket = OS::open_socket(hostname, service, timeout);
      if(!socket) {
         throw Not_Implemented("No socket support enabled in build");
      }
   } catch(std::exception& e) {
      throw HTTP_Error(fmt("HTTP connection to {} failed: {}", hostname, e.what()));
   }

   // Blocks until entire message has been written
   socket->write(as_span_of_bytes(message));

   if(std::chrono::system_clock::now() - start_time > timeout) {
      throw HTTP_Error("Timeout during writing message body");
   }

   std::ostringstream oss;
   std::vector<uint8_t> buf(DefaultBufferSize);
   while(true) {
      const size_t got = socket->read(buf.data(), buf.size());
      if(got == 0) {  // EOF
         break;
      }

      if(std::chrono::system_clock::now() - start_time > timeout) {
         throw HTTP_Error("Timeout while reading message body");
      }

      oss.write(cast_uint8_ptr_to_char(buf.data()), static_cast<std::streamsize>(got));
   }

   return oss.str();
}

bool needs_url_encoding(char c) {
   if(c >= 'A' && c <= 'Z') {
      return false;
   }
   if(c >= 'a' && c <= 'z') {
      return false;
   }
   if(c >= '0' && c <= '9') {
      return false;
   }
   if(c == '-' || c == '_' || c == '.' || c == '~') {
      return false;
   }
   return true;
}

}  // namespace

std::string url_encode(std::string_view in) {
   std::ostringstream out;

   for(auto c : in) {
      if(needs_url_encoding(c)) {
         out << '%' << std::uppercase << std::hex << std::setfill('0') << std::setw(2) << static_cast<int>(c);
         out << std::dec << std::nouppercase;  // reset flags
      } else {
         out << c;
      }
   }

   return out.str();
}

std::ostream& operator<<(std::ostream& o, const Response& resp) {
   o << "HTTP " << resp.status_code() << " " << resp.status_message() << "\n";
   for(const auto& h : resp.headers()) {
      o << "Header '" << h.first << "' = '" << h.second << "'\n";
   }
   o << "Body " << std::to_string(resp.body().size()) << " bytes:\n";
   o.write(cast_uint8_ptr_to_char(resp.body().data()), resp.body().size());
   return o;
}

Response http_sync(const http_exch_fn& http_transact,
                   std::string_view verb,
                   std::string_view url,
                   std::string_view content_type,
                   const std::vector<uint8_t>& body,
                   size_t allowable_redirects) {
   if(url.empty()) {
      throw HTTP_Error("URL empty");
   }

   const auto protocol_host_sep = url.find("://");
   if(protocol_host_sep == std::string::npos) {
      throw HTTP_Error(fmt("Invalid URL '{}'", url));
   }

   const auto host_loc_sep = url.find('/', protocol_host_sep + 3);

   const auto [hostname, location, service] = [&]() {
      std::string host;
      std::string loc;
      std::string svc;

      if(host_loc_sep == std::string::npos) {
         host = url.substr(protocol_host_sep + 3);
         loc = "/";
      } else {
         host = url.substr(protocol_host_sep + 3, host_loc_sep - protocol_host_sep - 3);
         loc = url.substr(host_loc_sep);
      }

      const auto port_sep = host.find(':');
      if(port_sep == std::string::npos) {
         svc = "http";
         // hostname not modified
      } else {
         svc = host.substr(port_sep + 1, std::string::npos);
         host.resize(port_sep);  // Keep only hostname part, remove port number
      }

      return std::tuple(host, loc, svc);
   }();

   std::ostringstream outbuf;
   outbuf << verb << " " << location << " HTTP/1.0\r\n";
   outbuf << "Host: " << hostname << "\r\n";

   if(verb == "GET") {
      outbuf << "Accept: */*\r\n";
      outbuf << "Cache-Control: no-cache\r\n";
   } else if(verb == "POST") {
      outbuf << "Content-Length: " << body.size() << "\r\n";
   }

   if(!content_type.empty()) {
      outbuf << "Content-Type: " << content_type << "\r\n";
   }
   outbuf << "Connection: close\r\n\r\n";
   outbuf.write(cast_uint8_ptr_to_char(body.data()), body.size());

   std::istringstream io(http_transact(hostname, service, outbuf.str()));

   std::string line1;
   std::getline(io, line1);
   if(!io || line1.empty()) {
      throw HTTP_Error("No response");
   }

   std::stringstream response_stream(line1);
   std::string http_version;
   unsigned int status_code = 0;
   std::string status_message;

   response_stream >> http_version >> status_code;

   std::getline(response_stream, status_message);

   if(!response_stream || !http_version.starts_with("HTTP/")) {
      throw HTTP_Error("Not an HTTP response");
   }

   std::map<std::string, std::string> headers;
   std::string header_line;
   while(std::getline(io, header_line) && header_line != "\r") {
      auto sep = header_line.find(": ");
      if(sep == std::string::npos || sep > header_line.size() - 2) {
         throw HTTP_Error(fmt("Invalid HTTP header '{}'", header_line));
      }
      const std::string key = header_line.substr(0, sep);

      if(sep + 2 < header_line.size() - 1) {
         const std::string val = header_line.substr(sep + 2, (header_line.size() - 1) - (sep + 2));
         headers[key] = val;
      }
   }

   if(status_code == 301 && headers.contains("Location")) {
      if(allowable_redirects == 0) {
         throw HTTP_Error("HTTP redirection count exceeded");
      }
      return GET_sync(headers["Location"], allowable_redirects - 1);
   }

   std::vector<uint8_t> resp_body;
   std::vector<uint8_t> buf(4096);
   while(io.good()) {
      io.read(cast_uint8_ptr_to_char(buf.data()), buf.size());
      const size_t got = static_cast<size_t>(io.gcount());
      resp_body.insert(resp_body.end(), buf.data(), &buf[got]);
   }

   auto cl_hdr = headers.find("Content-Length");
   if(cl_hdr != headers.end()) {
      const std::string header_size = cl_hdr->second;
      if(resp_body.size() != to_u32bit(header_size)) {
         throw HTTP_Error(fmt("Content-Length disagreement, header says {} got {}", header_size, resp_body.size()));
      }
   }

   return Response(status_code, status_message, resp_body, headers);
}

Response http_sync(std::string_view verb,
                   std::string_view url,
                   std::string_view content_type,
                   const std::vector<uint8_t>& body,
                   size_t allowable_redirects,
                   std::chrono::milliseconds timeout) {
   auto transact_with_timeout = [timeout](
                                   std::string_view hostname, std::string_view service, std::string_view message) {
      return http_transact(hostname, service, message, timeout);
   };

   return http_sync(transact_with_timeout, verb, url, content_type, body, allowable_redirects);
}

Response GET_sync(std::string_view url, size_t allowable_redirects, std::chrono::milliseconds timeout) {
   return http_sync("GET", url, "", std::vector<uint8_t>(), allowable_redirects, timeout);
}

Response POST_sync(std::string_view url,
                   std::string_view content_type,
                   const std::vector<uint8_t>& body,
                   size_t allowable_redirects,
                   std::chrono::milliseconds timeout) {
   return http_sync("POST", url, content_type, body, allowable_redirects, timeout);
}

}  // namespace Botan::HTTP

1	/*
2	* Sketchy HTTP client
3	* (C) 2013,2016 Jack Lloyd
4	* 2017 René Korthaus, Rohde & Schwarz Cybersecurity
5	*
6	* Botan is released under the Simplified BSD License (see license.txt)
7	*/
8
9	#include <botan/internal/http_util.h>
10
11	#include <botan/mem_ops.h>
12	#include <botan/internal/fmt.h>
13	#include <botan/internal/mem_utils.h>
14	#include <botan/internal/parsing.h>
15	#include <botan/internal/socket.h>
16	#include <botan/internal/stl_util.h>
17	#include <iomanip>
18	#include <sstream>
19
20	namespace Botan::HTTP {
21
22	namespace {
23
24	/*
25	* Connect to a host, write some bytes, then read until the server
26	* closes the socket.
27	*/
28	std::string http_transact(std::string_view hostname,	1✔
29	std::string_view service,
30	std::string_view message,
31	std::chrono::milliseconds timeout) {
32	std::unique_ptr<OS::Socket> socket;	1✔
33
34	const std::chrono::system_clock::time_point start_time = std::chrono::system_clock::now();	1✔
35
36	try {	1✔
37	socket = OS::open_socket(hostname, service, timeout);	1✔
38	if(!socket) {	1✔
39	throw Not_Implemented("No socket support enabled in build");	×
40	}
41	} catch(std::exception& e) {	×
42	throw HTTP_Error(fmt("HTTP connection to {} failed: {}", hostname, e.what()));	×
43	}	×
44
45	// Blocks until entire message has been written
46	socket->write(as_span_of_bytes(message));	1✔
47
48	if(std::chrono::system_clock::now() - start_time > timeout) {	1✔
49	throw HTTP_Error("Timeout during writing message body");	×
50	}
51
52	std::ostringstream oss;	1✔
53	std::vector<uint8_t> buf(DefaultBufferSize);	1✔
54	while(true) {	2✔
55	const size_t got = socket->read(buf.data(), buf.size());	2✔
56	if(got == 0) { // EOF	2✔
57	break;
58	}
59
60	if(std::chrono::system_clock::now() - start_time > timeout) {	1✔
61	throw HTTP_Error("Timeout while reading message body");	×
62	}
63
64	oss.write(cast_uint8_ptr_to_char(buf.data()), static_cast<std::streamsize>(got));	1✔
65	}
66
67	return oss.str();	1✔
68	}	1✔
69
70	bool needs_url_encoding(char c) {	×
71	if(c >= 'A' && c <= 'Z') {	×
72	return false;
73	}
74	if(c >= 'a' && c <= 'z') {
75	return false;
76	}
77	if(c >= '0' && c <= '9') {
78	return false;
79	}
80	if(c == '-' \|\| c == '_' \|\| c == '.' \|\| c == '~') {
81	return false;
82	}
83	return true;
84	}
85
86	} // namespace
87
88	std::string url_encode(std::string_view in) {	×
89	std::ostringstream out;	×
90
91	for(auto c : in) {	×
92	if(needs_url_encoding(c)) {	×
93	out << '%' << std::uppercase << std::hex << std::setfill('0') << std::setw(2) << static_cast<int>(c);	×
94	out << std::dec << std::nouppercase; // reset flags	×
95	} else {
96	out << c;	×
97	}
98	}
99
100	return out.str();	×
101	}	×
102
103	std::ostream& operator<<(std::ostream& o, const Response& resp) {	×
104	o << "HTTP " << resp.status_code() << " " << resp.status_message() << "\n";	×
105	for(const auto& h : resp.headers()) {	×
106	o << "Header '" << h.first << "' = '" << h.second << "'\n";	×
107	}
108	o << "Body " << std::to_string(resp.body().size()) << " bytes:\n";	×
109	o.write(cast_uint8_ptr_to_char(resp.body().data()), resp.body().size());	×
110	return o;	×
111	}
112
113	Response http_sync(const http_exch_fn& http_transact,	1✔
114	std::string_view verb,
115	std::string_view url,
116	std::string_view content_type,
117	const std::vector<uint8_t>& body,
118	size_t allowable_redirects) {
119	if(url.empty()) {	1✔
120	throw HTTP_Error("URL empty");	×
121	}
122
123	const auto protocol_host_sep = url.find("://");	1✔
124	if(protocol_host_sep == std::string::npos) {	1✔
125	throw HTTP_Error(fmt("Invalid URL '{}'", url));	×
126	}
127
128	const auto host_loc_sep = url.find('/', protocol_host_sep + 3);	1✔
129
130	const auto [hostname, location, service] = [&]() {	1✔
131	std::string host;	1✔
132	std::string loc;	1✔
133	std::string svc;	1✔
134
135	if(host_loc_sep == std::string::npos) {	1✔
136	host = url.substr(protocol_host_sep + 3);	1✔
137	loc = "/";	1✔
138	} else {
139	host = url.substr(protocol_host_sep + 3, host_loc_sep - protocol_host_sep - 3);	×
140	loc = url.substr(host_loc_sep);	×
141	}
142
143	const auto port_sep = host.find(':');	1✔
144	if(port_sep == std::string::npos) {	1✔
145	svc = "http";	1✔
146	// hostname not modified
147	} else {
148	svc = host.substr(port_sep + 1, std::string::npos);	×
149	host.resize(port_sep); // Keep only hostname part, remove port number	×
150	}
151
152	return std::tuple(host, loc, svc);	1✔
153	}();	2✔
154
155	std::ostringstream outbuf;	1✔
156	outbuf << verb << " " << location << " HTTP/1.0\r\n";	1✔
157	outbuf << "Host: " << hostname << "\r\n";	1✔
158
159	if(verb == "GET") {	1✔
160	outbuf << "Accept: /\r\n";	×
161	outbuf << "Cache-Control: no-cache\r\n";	×
162	} else if(verb == "POST") {	1✔
163	outbuf << "Content-Length: " << body.size() << "\r\n";	1✔
164	}
165
166	if(!content_type.empty()) {	1✔
167	outbuf << "Content-Type: " << content_type << "\r\n";	1✔
168	}
169	outbuf << "Connection: close\r\n\r\n";	1✔
170	outbuf.write(cast_uint8_ptr_to_char(body.data()), body.size());	1✔
171
172	std::istringstream io(http_transact(hostname, service, outbuf.str()));	3✔
173
174	std::string line1;	1✔
175	std::getline(io, line1);	1✔
176	if(!io \|\| line1.empty()) {	1✔
177	throw HTTP_Error("No response");	×
178	}
179
180	std::stringstream response_stream(line1);	1✔
181	std::string http_version;	1✔
182	unsigned int status_code = 0;	1✔
183	std::string status_message;	1✔
184
185	response_stream >> http_version >> status_code;	1✔
186
187	std::getline(response_stream, status_message);	1✔
188
189	if(!response_stream \|\| !http_version.starts_with("HTTP/")) {	2✔
190	throw HTTP_Error("Not an HTTP response");	×
191	}
192
193	std::map<std::string, std::string> headers;	1✔
194	std::string header_line;	1✔
195	while(std::getline(io, header_line) && header_line != "\r") {	8✔
196	auto sep = header_line.find(": ");	7✔
197	if(sep == std::string::npos \|\| sep > header_line.size() - 2) {	7✔
198	throw HTTP_Error(fmt("Invalid HTTP header '{}'", header_line));	×
199	}
200	const std::string key = header_line.substr(0, sep);	7✔
201
202	if(sep + 2 < header_line.size() - 1) {	7✔
203	const std::string val = header_line.substr(sep + 2, (header_line.size() - 1) - (sep + 2));	7✔
204	headers[key] = val;	14✔
205	}	7✔
206	}	7✔
207
208	if(status_code == 301 && headers.contains("Location")) {	1✔
209	if(allowable_redirects == 0) {	×
210	throw HTTP_Error("HTTP redirection count exceeded");	×
211	}
212	return GET_sync(headers["Location"], allowable_redirects - 1);	×
213	}
214
215	std::vector<uint8_t> resp_body;	1✔
216	std::vector<uint8_t> buf(4096);	1✔
217	while(io.good()) {	1✔
218	io.read(cast_uint8_ptr_to_char(buf.data()), buf.size());	1✔
219	const size_t got = static_cast<size_t>(io.gcount());	1✔
220	resp_body.insert(resp_body.end(), buf.data(), &buf[got]);	2✔
221	}
222
223	auto cl_hdr = headers.find("Content-Length");	1✔
224	if(cl_hdr != headers.end()) {	1✔
225	const std::string header_size = cl_hdr->second;	1✔
226	if(resp_body.size() != to_u32bit(header_size)) {	1✔
227	throw HTTP_Error(fmt("Content-Length disagreement, header says {} got {}", header_size, resp_body.size()));	×
228	}
229	}	1✔
230
231	return Response(status_code, status_message, resp_body, headers);	1✔
232	}	2✔
233
234	Response http_sync(std::string_view verb,	1✔
235	std::string_view url,
236	std::string_view content_type,
237	const std::vector<uint8_t>& body,
238	size_t allowable_redirects,
239	std::chrono::milliseconds timeout) {
240	auto transact_with_timeout = [timeout](	2✔
241	std::string_view hostname, std::string_view service, std::string_view message) {
242	return http_transact(hostname, service, message, timeout);	1✔
243	};	1✔
244
245	return http_sync(transact_with_timeout, verb, url, content_type, body, allowable_redirects);	2✔
246	}
247
248	Response GET_sync(std::string_view url, size_t allowable_redirects, std::chrono::milliseconds timeout) {	×
249	return http_sync("GET", url, "", std::vector<uint8_t>(), allowable_redirects, timeout);	×
250	}
251
252	Response POST_sync(std::string_view url,	1✔
253	std::string_view content_type,
254	const std::vector<uint8_t>& body,
255	size_t allowable_redirects,
256	std::chrono::milliseconds timeout) {
257	return http_sync("POST", url, content_type, body, allowable_redirects, timeout);	1✔
258	}
259
260	} // namespace Botan::HTTP

randombit / botan / 19012184297

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous