Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Util] Better URL validation #2545

Merged
merged 2 commits into from
Sep 12, 2021
Merged

[Util] Better URL validation #2545

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a62f88a
[Util] Use C++11 std::regex for validateURL() function
random-zebra Sep 8, 2021
13735da
[QA] Add unit test for validateURL()
random-zebra Sep 8, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions src/test/util_tests.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -969,6 +969,38 @@ BOOST_AUTO_TEST_CASE(test_Capitalize)
BOOST_CHECK_EQUAL(Capitalize("\x00\xfe\xff"), "\x00\xfe\xff");
}

BOOST_AUTO_TEST_CASE(test_validateURL)
{
// Must pass
BOOST_CHECK(validateURL("http://foo.bar"));
BOOST_CHECK(validateURL("https://foo.bar"));
BOOST_CHECK(validateURL("https://foo.bar/"));
BOOST_CHECK(validateURL("http://pivx.foo.bar"));
BOOST_CHECK(validateURL("https://foo.bar/pivx"));
BOOST_CHECK(validateURL("https://foo.bar/pivx/more/"));
BOOST_CHECK(validateURL("https://142.2.3.1"));
BOOST_CHECK(validateURL("https://foo_bar.pivx.com"));
BOOST_CHECK(validateURL("http://foo.bar/?baz=some"));
BOOST_CHECK(validateURL("http://foo.bar/?baz=some&p=364"));

// Must fail
BOOST_CHECK(!validateURL("BlahBlah"));
BOOST_CHECK(!validateURL("foo.bar"));
BOOST_CHECK(!validateURL("://foo.bar"));
BOOST_CHECK(!validateURL("www.foo.bar"));
BOOST_CHECK(!validateURL("http://foo..bar"));
BOOST_CHECK(!validateURL("http:///foo.bar"));
BOOST_CHECK(!validateURL("http:// foo.bar"));
BOOST_CHECK(!validateURL("http://foo .bar"));
BOOST_CHECK(!validateURL("http://foo"));
BOOST_CHECK(!validateURL("http://foo.bar."));
BOOST_CHECK(!validateURL("http://foo.bar.."));
BOOST_CHECK(!validateURL("http://"));
BOOST_CHECK(!validateURL("http://.something.com"));
BOOST_CHECK(!validateURL("http://?something.com"));
BOOST_CHECK(!validateURL("https://foo.bar/?q=Spaces are not encoded"));
}

static void TestOtherThread(fs::path dirname, std::string lockname, bool *result)
{
*result = LockDirectory(dirname, lockname);
Expand Down
26 changes: 12 additions & 14 deletions src/utilstrencodings.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,7 @@
#include <cstring>
#include <errno.h>
#include <limits>
#include <regex>



Expand All @@ -37,27 +38,24 @@ std::string SanitizeString(const std::string& str, int rule)
return strResult;
}

bool validateURL(std::string strURL, std::string& strErr, unsigned int maxSize) {
bool validateURL(std::string strURL)
{
std::string strErr;
return validateURL(strURL, strErr);
}

bool validateURL(std::string strURL, std::string& strErr, unsigned int maxSize)
{
// Check URL size
if (strURL.size() > maxSize) {
strErr = strprintf("Invalid URL: %d exceeds limit of %d characters.", strURL.size(), maxSize);
return false;
}

std::vector<std::string> reqPre;

// Required initial strings; URL must contain one
reqPre.push_back("http://");
reqPre.push_back("https://");

// check fronts
bool found = false;
for (int i=0; i < (int) reqPre.size() && !found; i++) {
if (strURL.find(reqPre[i]) == 0) found = true;
}
if ((!found) && (reqPre.size() > 0)) {
strErr = "Invalid URL, check scheme (e.g. https://)";
// Validate URL
std::regex url_regex("^(https?)://[^\\s/$.?#][^\\s]*[^\\s/.]\\.[^\\s/.][^\\s]*[^\\s.]$");
if (!std::regex_match(strURL, url_regex)) {
strErr = "Invalid URL";
return false;
}

Expand Down
5 changes: 3 additions & 2 deletions src/utilstrencodings.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -45,11 +45,12 @@ std::string SanitizeString(const std::string& str, int rule = SAFE_CHARS_DEFAULT
/**
* Check URL format for conformance for validity to a defined pattern
* @param[in] strURL The string to be processed for validity
* @param[in] stdErr A string that will be loaded with any validation error message
* @param[in] strErr A string that will be loaded with any validation error message
* @param[in] maxSize An unsigned int, defaulted to 64, to restrict the length
* @return A bool, true if valid, false if not (reason in stdErr)
* @return A bool, true if valid, false if not (reason in strErr)
*/
bool validateURL(std::string strURL, std::string& strErr, unsigned int maxSize = 64);
bool validateURL(std::string strURL);

std::vector<unsigned char> ParseHex(const char* psz);
std::vector<unsigned char> ParseHex(const std::string& str);
Expand Down
6 changes: 3 additions & 3 deletions test/functional/rpc_budget.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -63,16 +63,16 @@ def run_test(self):

self.log.info("Test without URL scheme")
scheme = ''
assert_raises_rpc_error(-8, "Invalid URL, check scheme (e.g. https://)", self.nodes[0].preparebudget, name, scheme + url, 1, nextsuperblock, address, 100)
assert_raises_rpc_error(-8, "Invalid URL", self.nodes[0].preparebudget, name, scheme + url, 1, nextsuperblock, address, 100)

self.log.info('Test with invalid URL scheme: ftp://')
scheme = 'ftp://'
assert_raises_rpc_error(-8, "Invalid URL, check scheme (e.g. https://)", self.nodes[0].preparebudget, name, scheme + url, 1, nextsuperblock, address, 100)
assert_raises_rpc_error(-8, "Invalid URL", self.nodes[0].preparebudget, name, scheme + url, 1, nextsuperblock, address, 100)

self.log.info("Test with invalid double character scheme: hhttps://")
scheme = 'hhttps://'
url = 'test.com'
assert_raises_rpc_error(-8, "Invalid URL, check scheme (e.g. https://)", self.nodes[0].preparebudget, name, scheme + url, 1, nextsuperblock, address, 100)
assert_raises_rpc_error(-8, "Invalid URL", self.nodes[0].preparebudget, name, scheme + url, 1, nextsuperblock, address, 100)

self.log.info("Test with valid scheme: http://")
name = 'testvalid1'
Expand Down