parse_url_char asserts on form feed/tab about http-parser HOT 5 CLOSED

Good catch. Anyone want to review bnoordhuis/http-parser@48c4772?

from http-parser.

That fix will break my use of http_parser in an IDS where I'm seeing live urls with form feeds (\f) that actually get processed. Insane, but true.

from http-parser.

How would that work with another parser? Form feeds are not valid URL characters.

from http-parser.

Agree that they are invalid requests, however I see these requests in the wild and would like to parse them. Looks like apache/php have no problem with them for example. Previous versions of http_parser also seemed to handle them.

For a simple example create a phpinfo.php file with

curl "http://localhost/phpinfo.php?formfeed=form^Ffeed" > /tmp/ff

(Replace the ^F with control-V control-F)

vi /tmp/ff and look for formfeed and you will see the form^Ffeed made it

from http-parser.

Fixed in b97fdb0. In non-strict mode (HTTP_PARSER_STRICT=0), tabs and form feeds are allowed in URLs. Thanks for the bug report.

from http-parser.