-
-
Notifications
You must be signed in to change notification settings - Fork 191
Expand file tree
/
Copy patherror_pages.cpp
More file actions
108 lines (93 loc) · 4.37 KB
/
Copy patherror_pages.cpp
File metadata and controls
108 lines (93 loc) · 4.37 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
/*
This file is part of libhttpserver
Copyright (C) 2011-2026 Sebastiano Merlino
This library is free software; you can redistribute it and/or
modify it under the terms of the GNU Lesser General Public
License as published by the Free Software Foundation; either
version 2.1 of the License, or (at your option) any later version.
This library is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
Lesser General Public License for more details.
You should have received a copy of the GNU Lesser General Public
License along with this library; if not, write to the Free Software
Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301
USA
*/
// error_pages behavior service (DR-014 §4.11). Logic moved verbatim out
// of the former detail/webserver_error_pages.cpp; that TU now holds only
// the thin webserver_impl forwarders during the migration.
#include "httpserver/detail/error_pages.hpp"
#include <string>
#include <string_view>
#include "httpserver/constants.hpp"
#include "httpserver/create_webserver.hpp"
#include "httpserver/http_request.hpp"
#include "httpserver/http_response.hpp"
#include "httpserver/http_utils.hpp"
#include "httpserver/detail/dispatch_util.hpp"
#include "httpserver/detail/connection_context.hpp"
namespace httpserver {
using httpserver::http::http_utils;
namespace detail {
http_response error_pages::not_found_page(connection_context* conn) const {
if (config_.not_found_handler != nullptr) {
return config_.not_found_handler(*conn->request);
}
return http_response::string(std::string{constants::NOT_FOUND_ERROR})
.with_status(http_utils::http_not_found);
}
http_response error_pages::method_not_allowed_page(connection_context* conn) const {
if (config_.method_not_allowed_handler != nullptr) {
return config_.method_not_allowed_handler(*conn->request);
}
return http_response::string(std::string{constants::METHOD_ERROR})
.with_status(http_utils::http_method_not_allowed);
}
http_response error_pages::internal_error_page(connection_context* conn,
std::string_view msg,
bool force_our) const {
// The double-fault fallback. Used when the user-supplied
// internal_error_handler itself threw or when the belt-and-suspenders
// site after get_raw_response_with_fallback fires. The body is
// intentionally empty and the message is intentionally ignored.
if (force_our) {
return http_response::empty()
.with_status(http_utils::http_internal_server_error);
}
// Invoke the user handler with the originating message.
if (config_.internal_error_handler != nullptr) {
return config_.internal_error_handler(*conn->request, msg);
}
// The default body is the fixed string "Internal Server Error" to
// avoid CWE-209 information disclosure of e.what() text (which
// routinely embeds file paths, SQL fragments, internal identifiers,
// attacker-influenced input). The originating message is still
// surfaced via the configured log_error callback (see
// log_dispatch_error). Application code that needs the v1 verbose body
// (for development) must opt in via
// create_webserver::expose_exception_messages(true).
const auto status = http_utils::http_internal_server_error;
if (config_.expose_exception_messages) {
return http_response::string(std::string{msg}).with_status(status);
}
return http_response::string(
std::string{constants::INTERNAL_SERVER_ERROR})
.with_status(status);
}
http_response error_pages::run_internal_error_handler_safely(
connection_context* conn,
std::string_view msg) const {
try {
return internal_error_page(conn, msg, /*force_our=*/false);
} catch (...) {
// The user handler itself threw. Log generically and return an
// empty-body 500. No exception escapes from here.
log_dispatch_error(config_,
"internal_error_handler threw; "
"sending hardcoded empty-body 500");
return internal_error_page(conn, "", /*force_our=*/true);
}
}
} // namespace detail
} // namespace httpserver