http-parser
http-parser copied to clipboard
uri-parser allows extra characters after asterisk?
rfc7230 defines asterisk-form:
asterisk-form = "*"
But it seems parse_url_char allows additional characters after reading an asterisk. Note how state changes to s_req_path after encountering an asterisk at the beginning of the parse:
https://github.com/nodejs/http-parser/blob/master/http_parser.c#L505
If I'm reading the code right this means the uri-parser considers */xyz valid even though it does not follow the BNF in rfc7230.