From 4a5f9150d09474099bc1a8711a92ed1fe52203c0 Mon Sep 17 00:00:00 2001 From: Santtu Lakkala Date: Fri, 22 May 2026 11:08:56 +0300 Subject: Fix error body leaks activitypub_post_handler uses custom error responses for 400 and 403. The 400 NULL check was reversed and 403 was missing the check in httpd_connection and both errors were lost and leaked. Add a common custom error gate around all default errors to avoid similar issues in the future. --- httpd.c | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/httpd.c b/httpd.c index 248f5fa..5957cd6 100644 --- a/httpd.c +++ b/httpd.c @@ -600,17 +600,19 @@ void httpd_connection(FILE *f) status = HTTP_STATUS_NOT_FOUND; } - if (status == HTTP_STATUS_FORBIDDEN) - body = xs_str_new("

403 Forbidden (" USER_AGENT ")

"); + if (body == NULL) { + if (status == HTTP_STATUS_FORBIDDEN) + body = xs_str_new("

403 Forbidden (" USER_AGENT ")

"); - if (status == HTTP_STATUS_NOT_FOUND) - body = xs_str_new("

404 Not Found (" USER_AGENT ")

"); + if (status == HTTP_STATUS_NOT_FOUND) + body = xs_str_new("

404 Not Found (" USER_AGENT ")

"); - if (status == HTTP_STATUS_GONE) - body = xs_str_new("

410 Gone (" USER_AGENT ")

"); + if (status == HTTP_STATUS_GONE) + body = xs_str_new("

410 Gone (" USER_AGENT ")

"); - if (status == HTTP_STATUS_BAD_REQUEST && body != NULL) - body = xs_str_new("

400 Bad Request (" USER_AGENT ")

"); + if (status == HTTP_STATUS_BAD_REQUEST) + body = xs_str_new("

400 Bad Request (" USER_AGENT ")

"); + } if (status == HTTP_STATUS_SEE_OTHER) headers = xs_dict_append(headers, "location", body); -- cgit