More checks for printable asciis

gateway/httpgateway.cpp

@@ -20,6 +20,7 @@ SOFTWARE.
 */
 #include "httpgateway.h"
 #include "../logger.h"
+#include <stdexcept>
 HttpGateway::HttpGateway(std::string listenaddr, int port, uint64_t maxPayloadLength)
 {
 	this->listenaddr = listenaddr;
@@ -34,13 +35,9 @@ bool HttpGateway::keepReading()
 
 Request HttpGateway::convertRequest(httplib::Request request)
 {
-
-	for(auto &c : request.target)
+	if(!utils::is_printable_ascii(request.target))
 	{
-		if( !(c >= ' ' && c <= '~'))
-		{
-			throw std::runtime_error("Invalid chars in URI: " + utils::catv(request.target));
-		}
+		throw std::runtime_error("Invalid chars in URI: " + utils::catv(request.target));
 	}
 
 	Request result;
@@ -64,6 +61,12 @@ Request HttpGateway::convertRequest(httplib::Request request)
 
 	if(request.has_header("COOKIE"))
 	{
+		std::string cookie = request.get_header_value("COOKIE");
+		if(!utils::is_printable_ascii(cookie))
+		{
+			/* We better bail */
+			throw std::runtime_error("Cookie with non printable chars sent");
+		}
 		result.initCookies(request.get_header_value("COOKIE"));
 	}
 	result.setIp("127.0.0.1");
@@ -100,8 +103,9 @@ void HttpGateway::work(RequestWorker &worker)
 		}
 		catch (std::exception &e)
 		{
-			snprintf(buf, sizeof(buf), fmt, e.what());
-			Logger::error() << "Exception caught in Httpgateway::work():" << utils::catv(e.what());
+			std::string exception = utils::html_xss(e.what());
+			snprintf(buf, sizeof(buf), fmt, exception.c_str());
+			Logger::error() << "Exception caught in Httpgateway::work():" << utils::html_xss(utils::catv(e.what()));
 		}
 		catch (...)
 		{

utils.cpp

@@ -238,3 +238,16 @@ std::string utils::catv(std::string_view view)
 	}
 	return result;
 }
+
+bool utils::is_printable_ascii(std::string view)
+{
+	for(char c : view)
+	{
+		if( !(c >= ' ' && c <= '~'))
+		{
+			return false;
+		}
+	}
+	return true;
+}
+

utils.h

@@ -93,6 +93,8 @@ template <class T> inline std::string toString(const T &v)
 std::string trim(std::string_view view);
 std::string catv(std::string_view view);
 
+bool is_printable_ascii(std::string view);
+
 
 } // namespace utils
 #endif