| 48 | } |
| 49 | |
| 50 | void HttpHandler::ProcessRequest( |
| 51 | const WaitGroup::Ptr& waitGroup, |
| 52 | HttpApiRequest& request, |
| 53 | HttpApiResponse& response, |
| 54 | boost::asio::yield_context& yc |
| 55 | ) |
| 56 | { |
| 57 | Dictionary::Ptr node = m_UrlTree; |
| 58 | std::vector<HttpHandler::Ptr> handlers; |
| 59 | |
| 60 | request.DecodeUrl(); |
| 61 | auto& path (request.Url()->GetPath()); |
| 62 | |
| 63 | for (std::vector<String>::size_type i = 0; i <= path.size(); i++) { |
| 64 | Array::Ptr current_handlers = node->Get("handlers"); |
| 65 | |
| 66 | if (current_handlers) { |
| 67 | ObjectLock olock(current_handlers); |
| 68 | for (HttpHandler::Ptr current_handler : current_handlers) { |
| 69 | handlers.push_back(current_handler); |
| 70 | } |
| 71 | } |
| 72 | |
| 73 | Dictionary::Ptr children = node->Get("children"); |
| 74 | |
| 75 | if (!children) { |
| 76 | node.reset(); |
| 77 | break; |
| 78 | } |
| 79 | |
| 80 | if (i == path.size()) |
| 81 | break; |
| 82 | |
| 83 | node = children->Get(path[i]); |
| 84 | |
| 85 | if (!node) |
| 86 | break; |
| 87 | } |
| 88 | |
| 89 | std::reverse(handlers.begin(), handlers.end()); |
| 90 | |
| 91 | try { |
| 92 | request.DecodeParams(); |
| 93 | } catch (const std::exception& ex) { |
| 94 | HttpUtility::SendJsonError(response, request.Params(), 400, "Invalid request body: " + DiagnosticInformation(ex, false)); |
| 95 | return; |
| 96 | } |
| 97 | |
| 98 | bool processed = false; |
| 99 | |
| 100 | /* |
| 101 | * HandleRequest may throw a permission exception. |
| 102 | * DO NOT return a specific permission error. This |
| 103 | * allows attackers to guess from words which objects |
| 104 | * do exist. |
| 105 | */ |
| 106 | try { |
| 107 | for (const HttpHandler::Ptr& handler : handlers) { |
nothing calls this directly
no test coverage detected