From 93f4fe55324a50a9e5d6d5385ca7cadadb83441a Mon Sep 17 00:00:00 2001
From: Andy Green <andy@warmcat.com>
Date: Sun, 16 Sep 2018 14:18:33 +0800
Subject: [PATCH] lws_return_http_status: use /error.css if possible

---
 lib/roles/http/header.c | 21 +++++++++++----------
 scripts/attack.sh       |  4 ++--
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/lib/roles/http/header.c b/lib/roles/http/header.c
index 5bf3d371..0a7d92e0 100644
--- a/lib/roles/http/header.c
+++ b/lib/roles/http/header.c
@@ -338,6 +338,7 @@ lws_return_http_status(struct lws *wsi, unsigned int code,
 	unsigned char *p = pt->serv_buf + LWS_PRE;
 	unsigned char *start = p;
 	unsigned char *end = p + context->pt_serv_buf_size - LWS_PRE;
+	char *body = (char *)start + context->pt_serv_buf_size - 512;
 	int n = 0, m = 0, len;
 	char slen[20];
 
@@ -372,9 +373,15 @@ lws_return_http_status(struct lws *wsi, unsigned int code,
 					 &p, end))
 		return 1;
 
-	len = 35 + (int)strlen(html_body) + sprintf(slen, "%d", code);
-	n = sprintf(slen, "%d", len);
+	len = lws_snprintf(body, 510, "<html><head>"
+		"<meta charset=utf-8 http-equiv=\"Content-Language\" "
+			"content=\"en\"/>"
+		"<link rel=\"stylesheet\" type=\"text/css\" "
+			"href=\"/error.css\"/>"
+		"</head><body><h1>%u</h1>%s</body></html>", code, html_body);
+
 
+	n = sprintf(slen, "%d", len);
 	if (lws_add_http_header_by_token(wsi, WSI_TOKEN_HTTP_CONTENT_LENGTH,
 					 (unsigned char *)slen, n, &p, end))
 		return 1;
@@ -384,7 +391,6 @@ lws_return_http_status(struct lws *wsi, unsigned int code,
 
 #if defined(LWS_WITH_HTTP2)
 	if (wsi->http2_substream) {
-		char *body = (char *)start + context->pt_serv_buf_size - 512;
 
 		/*
 		 * for HTTP/2, the headers must be sent separately, since they
@@ -407,9 +413,6 @@ lws_return_http_status(struct lws *wsi, unsigned int code,
 		 * ... but stash the body and send it as a priority next
 		 * handle_POLLOUT
 		 */
-
-		len = sprintf(body, "<html><body><h1>%u</h1>%s</body></html>",
-			      code, html_body);
 		wsi->http.tx_content_length = len;
 		wsi->http.tx_content_remain = len;
 
@@ -429,11 +432,9 @@ lws_return_http_status(struct lws *wsi, unsigned int code,
 		 * for http/1, we can just append the body after the finalized
 		 * headers and send it all in one go.
 		 */
-		p += lws_snprintf((char *)p, end - p - 1,
-				  "<html><body><h1>%u</h1>%s</body></html>",
-				  code, html_body);
 
-		n = lws_ptr_diff(p, start);
+		n = lws_ptr_diff(p, start) + len;
+		memcpy(p, body, len);
 		m = lws_write(wsi, start, n, LWS_WRITE_HTTP);
 		if (m != n)
 			return 1;
diff --git a/scripts/attack.sh b/scripts/attack.sh
index a6946bbc..3f3a67a5 100755
--- a/scripts/attack.sh
+++ b/scripts/attack.sh
@@ -45,12 +45,12 @@ function check {
 	fi
 	if [ "$1" = "defaultplusforbidden" ] ; then
 	cat $CORPUS > /tmp/plusforb
-	echo -e -n "HTTP/1.0 403 Forbidden\x0d\x0acontent-type: text/html\x0d\x0acontent-length: 38\x0d\x0a\x0d\x0a<html><body><h1>403</h1></body></html>" >> /tmp/plusforb
+	echo -e -n "HTTP/1.0 403 Forbidden\x0d\x0acontent-type: text/html\x0d\x0acontent-length: 173\x0d\x0a\x0d\x0a<html><head><meta charset=utf-8 http-equiv=\"Content-Language\" content=\"en\"/><link rel=\"stylesheet\" type=\"text/css\" href=\"/error.css\"/></head><body><h1>403</h1></body></html>" >> /tmp/plusforb
 		diff /tmp/lwscap /tmp/plusforb > /dev/null
 		if [ $? -ne 0 ] ; then
 			cat $CORPUS > /tmp/plusforb
 
-			echo -e -n "HTTP/1.1 403 Forbidden\x0d\x0acontent-type: text/html\x0d\x0acontent-length: 38\x0d\x0a\x0d\x0a<html><body><h1>403</h1></body></html>" >> /tmp/plusforb
+			echo -e -n "HTTP/1.1 403 Forbidden\x0d\x0acontent-type: text/html\x0d\x0acontent-length: 173\x0d\x0a\x0d\x0a<html><head><meta charset=utf-8 http-equiv=\"Content-Language\" content=\"en\"/><link rel=\"stylesheet\" type=\"text/css\" href=\"/error.css\"/></head><body><h1>403</h1></body></html>" >> /tmp/plusforb
 			diff /tmp/lwscap /tmp/plusforb > /dev/null
 			if [ $? -ne 0 ] ; then
 
-- 
GitLab