| 1785 | } |
| 1786 | |
| 1787 | static bool request_passes_http_security(cbm_http_server_t *srv, cbm_http_conn_t *c, |
| 1788 | const cbm_http_req_t *req) { |
| 1789 | if (req->http_minor == 1 && req->host[0] == '\0') { |
| 1790 | cbm_http_replyf(c, 400, "", "%s", "{\"error\":\"Host header required\"}"); |
| 1791 | return false; |
| 1792 | } |
| 1793 | if (req->host[0] != '\0' && !host_is_this_server(req->host, srv->port)) { |
| 1794 | cbm_http_replyf(c, 403, "", "%s", "{\"error\":\"forbidden host\"}"); |
| 1795 | return false; |
| 1796 | } |
| 1797 | if (req->origin[0] != '\0' && |
| 1798 | (req->host[0] == '\0' || !origin_is_same_server(req->origin, srv->port) || |
| 1799 | !origin_matches_host(req->origin, req->host, srv->port))) { |
| 1800 | cbm_http_replyf(c, 403, "", "%s", "{\"error\":\"forbidden origin\"}"); |
| 1801 | return false; |
| 1802 | } |
| 1803 | update_cors(req, srv->port); |
| 1804 | bool is_post = strcmp(req->method, "POST") == 0; |
| 1805 | if (route_is_protected(req->path) && is_post && !content_type_is_json(req->content_type)) { |
| 1806 | cbm_http_replyf(c, 415, g_cors_json, "%s", "{\"error\":\"application/json required\"}"); |
| 1807 | return false; |
| 1808 | } |
| 1809 | return true; |
| 1810 | } |
| 1811 | |
| 1812 | static void dispatch_request(cbm_http_server_t *srv, cbm_http_conn_t *c, |
| 1813 | const cbm_http_req_t *req) { |
no test coverage detected