Handle some malformed URL requests in ejabberd_http (#2687)

diff --git a/src/ejabberd_http.erl b/src/ejabberd_http.erl
index 65a0c2f5d41738abd15030c7d6b846f0f8c6a122..727b57f8f7a804d48bc493e4d58b3a1428e7946e 100644 (file)
--- a/src/ejabberd_http.erl
+++ b/src/ejabberd_http.erl
@@ -411,11 +411,11 @@ extract_path_query(#state{request_method = Method,
     when Method =:= 'GET' orelse
           Method =:= 'HEAD' orelse
             Method =:= 'DELETE' orelse Method =:= 'OPTIONS' ->
-    case catch url_decode_q_split(Path) of
-       {'EXIT', _} -> {State, false};
-       {NPath, Query} ->
-           LPath = normalize_path([NPE
-                                   || NPE <- str:tokens(path_decode(NPath), <<"/">>)]),
+    case catch url_decode_q_split_normalize(Path) of
+       {'EXIT', Error} ->
+           ?DEBUG("Error decoding URL '~p': ~p", [Path, Error]),
+           {State, false};
+       {LPath, Query} ->
            LQuery = case catch parse_urlencoded(Query) of
                         {'EXIT', _Reason} -> [];
                         LQ -> LQ
@@ -429,11 +429,11 @@ extract_path_query(#state{request_method = Method,
                          sockmod = _SockMod,
                          socket = _Socket} = State)
   when (Method =:= 'POST' orelse Method =:= 'PUT') andalso Len>0 ->
-    case catch url_decode_q_split(Path) of
-        {'EXIT', _} -> {State, false};
-        {NPath, _Query} ->
-            LPath = normalize_path(
-                     [NPE || NPE <- str:tokens(path_decode(NPath), <<"/">>)]),
+    case catch url_decode_q_split_normalize(Path) of
+       {'EXIT', Error} ->
+           ?DEBUG("Error decoding URL '~p': ~p", [Path, Error]),
+           {State, false};
+        {LPath, _Query} ->
            case Method of
                'PUT' ->
                    {State, {LPath, [], Trail}};
@@ -724,6 +724,12 @@ file_format_error(Reason) ->
        Text -> Text
     end.
 
+url_decode_q_split_normalize(Path) ->
+    {NPath, Query} = url_decode_q_split(Path),
+    LPath = normalize_path([NPE
+                   || NPE <- str:tokens(path_decode(NPath), <<"/">>)]),
+    {LPath, Query}.
+
 % Code below is taken (with some modifications) from the yaws webserver, which
 % is distributed under the following license:
 %