aboutsummaryrefslogtreecommitdiffstats
path: root/lib/inets/src/http_server/httpd_util.erl
AgeCommit message (Collapse)Author
2017-06-14Update copyright yearHans Nilsson
2017-04-05When a non-DST time is passed to the httpd_util:rfc1123_date/1 function, itMartin Cox
causes a case-clause error, as the calender:local_time_to_universal_time_dst/1 can return an empty list, which is not currently handled. When called with an invalid DST time: 1> httpd_util:rfc1123_date({{2017, 03, 26},{1, 0, 0}}). ** exception error: no case clause matching [] in function httpd_util:rfc1123_date/1 (httpd_util.erl, line 334) To alleviate this, simply add a clause to handle the empty list and return the original time in the expected rfc1123 format. This is the approach of other modules which make use of the calender:local_time_to_universal_time_dst/1 function. The formatted date is then returned without error: 2> httpd_util:rfc1123_date({{2017, 03, 26},{1, 0, 0}}). "Sun, 26 Mar 2017 01:00:00 GMT"
2016-03-15update copyright-yearHenrik Nord
2016-01-29Merge branch 'ia/maint/inets/mod_alias/OTP-13248' into maint-18Erlang/OTP
* ia/maint/inets/mod_alias/OTP-13248: inets: Prepare for release inets: Traverse all aliases looking for the longest match inets: Use re instead of inets_regexp # Conflicts: # lib/inets/vsn.mk
2016-01-28inets: Use re instead of inets_regexpIngela Anderton Andin
2015-11-27inets: Add warning header in "chunk trailer" when mod_esi callback times out ↵Ingela Anderton Andin
or fails Also remove legacy debug macros and add help function httpd_util:error_log/2 to avoid code duplication.
2015-11-11inets: httpd - Add possibility to specify socket options for HTTPIngela Anderton Andin
Was already possible for HTTPS. Also remove use of legacy option inet6fb4. IPv6 standard moved away from beeing able to fallback to IPv4 so this option makes little sense, will use inet (Ipv4) as default instead of inet6fb4.
2015-06-18Change license text to APLv2Bruce Yinhe
2015-06-04inets: Add profile optionIngela Anderton Andin
To enable the HTTP server to run in a virtualized environment, where there can be more that one server that has the same bind_address and port, we add a new option profile. The profile name will be used in concatenation with bind_address and port to identify the HTTP server instance. The name profile was chosen as there is a similar concept in the HTTP client where profile names can be used to instantiate client configurations.
2014-03-31inets: Handle all response codes in httpd_util:message/3Ingela Anderton Andin
2011-11-09Initial merge from r13 topic branch. With minimal cleanup.Micael Karlberg
Merge branch 'bmk/inets/httpd/xss_when_erl_encoded/r13/OTP-9655' into bmk/inets/httpd/xss_when_erl_encoded/r14/OTP-9655 Conflicts: lib/inets/doc/src/notes.xml lib/inets/src/http_lib/http_uri.erl lib/inets/src/http_lib/http_util.erl lib/inets/src/http_server/httpd_file.erl lib/inets/src/http_server/httpd_request.erl lib/inets/src/http_server/httpd_request_handler.erl lib/inets/src/http_server/httpd_util.erl lib/inets/src/inets_app/inets.appup.src lib/inets/test/httpc_SUITE.erl lib/inets/test/httpd_SUITE.erl lib/inets/test/httpd_basic_SUITE.erl lib/inets/test/httpd_test_lib.erl lib/inets/vsn.mk
2011-10-26Fixed HTML encode. First *try* to hex decode uri, and thenMicael Karlberg
do the actual html encode. OTP-9655
2011-10-26Fixed hex-decoding.Micael Karlberg
OTP-9655
2011-10-25The XSS prevention methods used was confused if theMicael Karlberg
URL was encoded (hex-encoded). OTP-9655
2011-09-15Updated http-server to make sure URLs in error-messagesMicael Karlberg
are URL-encoded. Added support in http-client to use URL-encoding. Also added the missing include directory for the inets application. OTP-8940 [httpd] Prevent XSS in error pages. Prevent user controlled input from being interpreted as HTML in error pages by encoding the reserved HTML characters. Michael Santos OTP-9124
2011-05-20Update copyright yearsBjörn-Egil Dahlberg
2011-02-22inets: prevent XSS in error pagesMichael Santos
Prevent user controlled input from being interpreted as HTML in error pages by encoding the reserved HTML characters. The reserved character set should be safe for displaying data within the body of HTML pages as outlined here: http://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet Previously, weird URLs were URI encoded in the error page. This worked quite well but the URL would be displayed in the HTML in percent encoded format. There was also a check for URIs that were already escaped (by the browser) that would fail if the browser sent an URI containing a "%", e.g.: w3m "http://localhost:8080/<b>foo</b>?%" Also encode the HTTP method and version, since it's possible they may be manipulated: <b>FOO</b> /index.html HTTP/1.0 GET /index.html <b>foo</b>/1.0 Encode the static messages to prevent characters from being interpreted as HTML such as "heavy load (>~w processes)".
2010-11-29URL-encoding - add support in client and more usage in server. AlsoIngela Anderton Andin
added missing include directory.
2010-08-20inets: Patch 1122Micael Karlberg
OTP-8609 [httpc] Made cookie handling more case insensitive. OTP-8610 [httpc|httpd] Some netscape cookie dates are given with a 2-digit year (e.g. 06 = 2006). OTP-8624 [httpd] Added support (again) for the documented debugging features. See the User's Guide Configuration chapter for more info.
2010-05-27OTP-8609: Problems processing netscape cookies - expireMicael Karlberg
OTP-8610: Problem processing netscape cookies - date OTP-8624: Documented debug options not handled
2009-11-20The R13B03 release.OTP_R13B03Erlang/OTP
generated by cgit v1.2.3 (git 2.25.1) at 2024-07-18 13:09:44 +0000