elixir-mint / mint / 6f91efe05cc1abf0cfad78ed2efc5f28b99a7a97-PR-533

91%

main: 91%

Pull #533

github

Validate the target of promised requests

A PUSH_PROMISE was accepted as long as its :scheme and :authority were
non-empty and its :path started with "/", so promises with
:authority "user@localhost" or "localhost:abc", :path "/a b" or
"/a#fragment", or :scheme "1https" were returned as :push_promise
responses. RFC 9113 8.4.1 has the client reset a promised stream whose
request is malformed with PROTOCOL_ERROR.

The :scheme is checked against the RFC 3986 3.1 scheme grammar.

The :authority is parsed as RFC 3986 3.2 [ userinfo "@" ] host
[ ":" port ], where the host is an IP-literal or a reg-name and the port
is zero or more digits. An IP-literal is an IPvFuture or an IPv6
address, optionally followed by "%25" and an RFC 6874 zone ID made of
unreserved and percent-encoded characters. The IPv6 address must be made
of HEXDIG, ":" and "." characters and is then checked with
:inet.parse_ipv6strict_address/1, which on its own accepts a zone ID
after a bare "%" and signs in embedded IPv4 octets. RFC 9113 8.3.1
forbids userinfo for the http and https schemes, and RFC 9110 4.2.1 and
4.2.2 forbid an empty host for them, so ":443" or "@localhost" is
rejected for those schemes. Both checks compare the scheme
case-insensitively, and other schemes keep accepting userinfo and an
empty host. An :authority that is entirely empty is rejected for every
scheme, as before.

The :path is checked as an RFC 9110 absolute-path with an optional
query (RFC 9113 8.3.1), made of pchar, "/" and "?" characters with valid
percent-encoding.

39 of 41 new or added lines in 1 file covered. (95.12%)

1824 of 2014 relevant lines covered (90.57%)

726.63 hits per line