filter: do not modify deniedurl cgi parameter

Keep the modifications (which are needed for key lookup) inside the
lookup routine. This includes e.g. lower casing the URL. This way
can pass the exact original request string to our block page script.
This also changes the way 'www123.' is stripped from the request.

1 files changed, 18 insertions, 4 deletions

diff --git a/blob.c b/blob.c
index 8f630c2..f2a80f6 100644
--- a/blob.c
+++ b/blob.c
@@ -1,3 +1,6 @@
+#include <ctype.h>
+#include <string.h>
+
 #include "blob.h"
 
 /* RFC 3986 section 2.3 Unreserved Characters (January 2005) */
@@ -162,6 +165,20 @@ void blob_push(blob_t *b, blob_t d)
 	}
 }
 
+void blob_push_lower(blob_t *b, blob_t d)
+{
+	int i;
+
+	if (b->len < d.len) {
+		*b = BLOB_NULL;
+		return;
+	}
+	for (i = 0; i < d.len; i++)
+		b->ptr[i] = tolower(d.ptr[i]);
+	b->ptr += d.len;
+	b->len -= d.len;
+}
+
 void blob_push_byte(blob_t *b, unsigned char byte)
 {
 	if (b->len) {
@@ -219,9 +236,6 @@ void blob_push_urldecode(blob_t *to, blob_t url)
 	do {
 		blob_pull_matching(&url, BLOB_STR("/"));
 		b = blob_pull_cspn(&url, BLOB_STR("/"));
-		if (blob_is_null(url) && blob_is_null(b))
-			break;
-
 		if (blob_is_null(b) || blob_cmp(b, BLOB_STR(".")) == 0) {
 			/* skip '.' or two consecutive / */
 		} else if (blob_cmp(b, BLOB_STR("..")) == 0) {
@@ -232,7 +246,7 @@ void blob_push_urldecode(blob_t *to, blob_t url)
 			blob_push_byte(to, '/');
 			blob_push(to, b);
 		}
-	} while (1);
+	} while (!blob_is_null(url));
 }
 
 void blob_push_urlencode(blob_t *to, blob_t url)