HTTP proxy: insert slash in URL if missing

curl has been accepting URLs using slightly wrong syntax for a long
time, such as when completely missing as slash "http://example.org" or
missing a slash when a query part is given
"http://example.org?q=foobar".

curl would translate these into a legitimate HTTP request to servers,
although as was shown in bug #1206 it was not adjusted properly in the
cases where a HTTP proxy was used.

Test 1213 and 1214 were added to the test suite to verify this fix.

The test HTTP server was adjusted to allow us to specify test number in
the host name only without using any slashes in a given URL.

Bug: http://curl.haxx.se/bug/view.cgi?id=1206
Reported by: ScottJi

1 files changed, 38 insertions, 0 deletions

diff --git a/lib/url.c b/lib/url.c
index a14c0626b..e401ca363 100644
--- a/lib/url.c
+++ b/lib/url.c
@@ -3663,6 +3663,7 @@ static CURLcode parseurlandfillconn(struct SessionHandle *data,
   char protobuf[16];
   const char *protop;
   CURLcode result;
+  bool fix_slash = FALSE;
 
   *prot_missing = FALSE;
 
@@ -3809,12 +3810,14 @@ static CURLcode parseurlandfillconn(struct SessionHandle *data,
     memcpy(path+1, query, hostlen);
 
     path[0]='/'; /* prepend the missing slash */
+    fix_slash = TRUE;
 
     *query=0; /* now cut off the hostname at the ? */
   }
   else if(!path[0]) {
     /* if there's no path set, use a single slash */
     strcpy(path, "/");
+    fix_slash = TRUE;
   }
 
   /* If the URL is malformatted (missing a '/' after hostname before path) we
@@ -3827,6 +3830,41 @@ static CURLcode parseurlandfillconn(struct SessionHandle *data,
        is bigger than the path. Use +1 to move the zero byte too. */
     memmove(&path[1], path, strlen(path)+1);
     path[0] = '/';
+    fix_slash = TRUE;
+  }
+
+
+  /*
+   * "fix_slash" means that the URL was malformatted so we need to generate an
+   * updated version with the new slash inserted at the right place!  We need
+   * the corrected URL when communicating over HTTP proxy and we don't know at
+   * this point if we're using a proxy or not.
+   */
+  if(fix_slash) {
+    char *reurl;
+
+    size_t plen = strlen(path); /* new path, should be 1 byte longer than
+                                   the original */
+    size_t urllen = strlen(data->change.url); /* original URL length */
+
+    reurl = malloc(urllen + 2); /* 2 for zerobyte + slash */
+    if(!reurl)
+      return CURLE_OUT_OF_MEMORY;
+
+    /* copy the prefix */
+    memcpy(reurl, data->change.url, urllen - (plen-1));
+
+    /* append the trailing piece + zerobyte */
+    memcpy(&reurl[urllen - (plen-1)], path, plen + 1);
+
+    /* possible free the old one */
+    if(data->change.url_alloc) {
+      Curl_safefree(data->change.url);
+      data->change.url_alloc = FALSE;
+    }
+
+    data->change.url = reurl;
+    data->change.url_alloc = TRUE; /* free this later */
   }
 
   /*************************************************************