The tipidee from skarnet

tipidee's Introduction

tipidee - a minimalistic web server
-----------------------------------

 tipidee is a minimalistic HTTP/1.1 web server. It is designed to
run under a super-server like inetd or s6-tcpserver. It supports
most of the HTTP protocol.

 See https://skarnet.org/software/tipidee/ for details.


* Installation
  ------------

 See the INSTALL file.


* Contact information
  -------------------

 Laurent Bercot <ska-skaware at skarnet.org>

 Please use the <skaware at list.skarnet.org> mailing-list for
questions about tipidee.

tipidee's People

Contributors

Stargazers

Watchers

tipidee's Issues

Should zero Content-Length be printed too?

I've written this short CGI script:

#!/bin/sh
echo Status: 307
echo Location: //youtu.be/dQw4w9WgXcQ
echo

On a web browser (Firefox 117.0 to be precise), it seems to hang forever and only redirects the user to the best song in the world if I pkill tipideed.

Running curl -v 'http://localhost:8080/cgi-bin/rick':

*   Trying [::1]:8080...
* connect to ::1 port 8080 failed: Connection refused
*   Trying 127.0.0.1:8080...
* Connected to localhost (127.0.0.1) port 8080
> GET /cgi-bin/rick HTTP/1.1
> Host: localhost:8080
> User-Agent: curl/8.3.0
> Accept: */*
> 
< HTTP/1.1 307 
< Date: Sun, 24 Sep 2023 05:53:41 GMT
< Accept-Ranges: none
< Cache-Control: private
< Content-Security-Policy: default-src 'self'; style-src 'self' 'unsafe-inline';
< Referrer-Policy: no-referrer-when-downgrade
< Server: tipidee/0.0.1.0
< Vary: Accept-Encoding
< X-Content-Type-Options: nosniff
< X-Frame-Options: DENY
< X-XSS-Protection: 1; mode=block
< Location: //youtu.be/dQw4w9WgXcQ
* no chunk, no close, no size. Assume close to signal end
<

Also hangs forever, unless I pkill tipidee, after which curl says: * Closing connection.

I think I found a likely culprit in https://github.com/skarnet/tipidee/blame/fe95ed0a9f701f6ca076b403c0b2bf6cf15a8174/src/tipideed/cgi.c#L284. Removing the if and making it explicitly state Content-Length: 0 seems to make the CGI redirect work, though I'm not sure if it will break something else.

Another kind of related issue is the presence of the local_redirect function; if a CGI script gets a POST request and returns 303, the request type will stay POST and pressing F5 will cause the data to be resubmitted.

Recommend Projects