Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ocsigen_lib.Url.parse: doesn't fail on random string. #106

Open
dannywillems opened this issue Aug 8, 2016 · 5 comments
Open

Ocsigen_lib.Url.parse: doesn't fail on random string. #106

dannywillems opened this issue Aug 8, 2016 · 5 comments

Comments

@dannywillems
Copy link
Member

When sending a random string (for example q7fPbXDbpCLdP5acC7WfCTmeYr2QFnglLhjgCPrYfd), Ocsigen_lib.Url.parse doesn't fail and says nothing.

It would be better to throw an exception in this case.

@vasilisp
Copy link
Contributor

vasilisp commented Aug 8, 2016

That's probably OK. The http:// or https:// is optional, and q7fPbXDbpCLdP5acC7WfCTmeYr2QFnglLhjgCPrYfd looks like a valid hostname without a port and path (both optional). Do you have an example that is definitely not a URL?

@dinosaure
Copy link
Member

May be a good way is to replace Url by ocaml-uri - but, yes lot of works :( ?

@vasilisp
Copy link
Contributor

vasilisp commented Aug 8, 2016

We need to intervene in the Url module (sooner rather than later) to get rid of the Ocamlnet dependency (Netstring_pcre). It may well be the case that ocaml-uri is all we need.

@dinosaure
Copy link
Member

Yes, I know this problem :) . I can try to replace Url_base and Url by ocaml-uri and keep the same interface - to keep the compatibility with Eliom - if you want. But ocaml-uri adds some dependencies (like re, sexplib and stringext). And I think, @balat does not want that - but, may be, I'm wrong.

@dannywillems
Copy link
Member Author

@vasilisp I retried and the function doesn't terminate (I added a print before and after and the after is not printed). I found the issue when I was sending a random string representing a state (in OAuth2) instead of the redirect URL.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants