fix: address 11 high/medium severity bugs #1

Merged

theo merged 1 commit from kai/liveserver:main into main

2026-07-10 18:56:41 +00:00

kai commented

2026-07-10 18:54:05 +00:00

Contributor

#5 Config.h: fix requestChunkSize typo 4069 -> 4096

#2 Response.cpp: correct misleading 'for writing' error message to 'for reading' in sendFile()

#3 Response.cpp: set finalized=true immediately after hasSent=true in the streaming path
so the flag is consistent even if an exception fires mid-stream; also remove the
redundant seekg(0, end) in the non-streaming else-branch

#4 WebSocket.cpp: implement RFC 6455 message fragmentation in receive()
Previously any frame with FIN=0 caused a 1002 close. Now continuation frames
(opcode 0x0) are accumulated until FIN=1; control frames (ping/pong/close) may
be interleaved and are dispatched immediately; total accumulated size is checked
against maxFrameSize to prevent memory exhaustion.

#1 Server.cpp: silent catch(...) on request parsing now sends 400 and returns
instead of silently continuing with an invalid request object

#7 Server.cpp: isKeepAlive() now parses the HTTP version from the request line
and defaults to close for HTTP/1.0 clients instead of always defaulting to keep-alive

#8 Server.cpp: remove the weak find('..') path traversal check; isWithinDirectory()
already uses weakly_canonical for definitive traversal protection per file access

#10 Server.cpp: signal handler now only stores the atomic globalShutdownRequested
flag (async-signal-safe); requestGlobalShutdown() with its mutex and close() calls
is invoked from the main accept loop instead; accept() failure also checks
globalShutdownRequested to break out cleanly on EINTR

#6 main.cpp: fix --poll error message to say 'at least 50ms' matching the < 50 check

#9 main.cpp: remove misleading changedPath="" before fallback return in hasChanged();
the caller already default-initialises changedPath and the comment clarifies intent

#5 Config.h: fix requestChunkSize typo 4069 -> 4096 #2 Response.cpp: correct misleading 'for writing' error message to 'for reading' in sendFile() #3 Response.cpp: set finalized=true immediately after hasSent=true in the streaming path so the flag is consistent even if an exception fires mid-stream; also remove the redundant seekg(0, end) in the non-streaming else-branch #4 WebSocket.cpp: implement RFC 6455 message fragmentation in receive() Previously any frame with FIN=0 caused a 1002 close. Now continuation frames (opcode 0x0) are accumulated until FIN=1; control frames (ping/pong/close) may be interleaved and are dispatched immediately; total accumulated size is checked against maxFrameSize to prevent memory exhaustion. #1 Server.cpp: silent catch(...) on request parsing now sends 400 and returns instead of silently continuing with an invalid request object #7 Server.cpp: isKeepAlive() now parses the HTTP version from the request line and defaults to close for HTTP/1.0 clients instead of always defaulting to keep-alive #8 Server.cpp: remove the weak find('..') path traversal check; isWithinDirectory() already uses weakly_canonical for definitive traversal protection per file access #10 Server.cpp: signal handler now only stores the atomic globalShutdownRequested flag (async-signal-safe); requestGlobalShutdown() with its mutex and close() calls is invoked from the main accept loop instead; accept() failure also checks globalShutdownRequested to break out cleanly on EINTR #6 main.cpp: fix --poll error message to say 'at least 50ms' matching the < 50 check #9 main.cpp: remove misleading changedPath="" before fallback return in hasChanged(); the caller already default-initialises changedPath and the comment clarifies intent

kai added 1 commit

2026-07-10 18:54:05 +00:00

fix: address 11 high/medium severity bugs

Forgejo CMake CI / build (clang, clang++) (pull_request) Successful in 38s

Details

Forgejo CMake CI / build (gcc, g++) (pull_request) Successful in 42s

Details

6b7578a74f

#5 Config.h: fix requestChunkSize typo 4069 -> 4096

#2 Response.cpp: correct misleading 'for writing' error message to 'for reading' in sendFile()

#3 Response.cpp: set finalized=true immediately after hasSent=true in the streaming path
so the flag is consistent even if an exception fires mid-stream; also remove the
redundant seekg(0, end) in the non-streaming else-branch

#4 WebSocket.cpp: implement RFC 6455 message fragmentation in receive()
Previously any frame with FIN=0 caused a 1002 close. Now continuation frames
(opcode 0x0) are accumulated until FIN=1; control frames (ping/pong/close) may
be interleaved and are dispatched immediately; total accumulated size is checked
against maxFrameSize to prevent memory exhaustion.

#1 Server.cpp: silent catch(...) on request parsing now sends 400 and returns
instead of silently continuing with an invalid request object

#7 Server.cpp: isKeepAlive() now parses the HTTP version from the request line
and defaults to close for HTTP/1.0 clients instead of always defaulting to keep-alive

#8 Server.cpp: remove the weak find('..') path traversal check; isWithinDirectory()
already uses weakly_canonical for definitive traversal protection per file access

#10 Server.cpp: signal handler now only stores the atomic globalShutdownRequested
flag (async-signal-safe); requestGlobalShutdown() with its mutex and close() calls
is invoked from the main accept loop instead; accept() failure also checks
globalShutdownRequested to break out cleanly on EINTR

#6 main.cpp: fix --poll error message to say 'at least 50ms' matching the < 50 check

#9 main.cpp: remove misleading changedPath="" before fallback return in hasChanged();
the caller already default-initialises changedPath and the comment clarifies intent