lpeg_patterns/http/alpn: Verify that protocol_id meets unique encoding criteria

Author: daurnimator

NEWS

@@ -1,6 +1,7 @@
 UNRELEASED
 
   - http: split into multiple modules
+  - http.alpn: verify that protocol_id meets unique encoding criteria
 
 
 0.5 - 2018-07-15

lpeg_patterns/http/alpn.lua

@@ -1,7 +1,33 @@
 -- RFC 7639
+
+local lpeg = require "lpeg"
 local http_core = require "lpeg_patterns.http.core"
+local util = require "lpeg_patterns.util"
+
+local Cmt = lpeg.Cmt
+local Cs = lpeg.Cs
+local P = lpeg.P
+local R = lpeg.R
+
+--[[ protocol-id is a percent-encoded ALPN protocol name
+  - Octets in the ALPN protocol MUST NOT be percent-encoded if they
+	are valid token characters except "%".
+  - When using percent-encoding, uppercase hex digits MUST be used.
+]]
+
+local valid_chars = http_core.tchar - P"%"
+local upper_hex = R("09", "AF")
+local percent_char = P"%" * (upper_hex * upper_hex / util.read_hex) / string.char
+local percent_encoded = Cmt(percent_char, function(_, _, c)
+	-- check that decoded character would not have been allowed unescaped
+	if not valid_chars:match(c) then
+		return true, c
+	end
+end)
+local percent_replace = Cs((valid_chars + percent_encoded)^0)
+
+local protocol_id = percent_replace
 
-local protocol_id = http_core.token
 local ALPN = http_core.comma_sep_trim(protocol_id, 1)
 
 return {

spec/http_alpn_spec.lua

@@ -0,0 +1,22 @@
+describe("lpeg_patterns.http.alpn", function()
+	local http_alpn = require "lpeg_patterns.http.alpn"
+	local lpeg = require "lpeg"
+	local EOF = lpeg.P(-1)
+	local protocol_id = http_alpn.protocol_id * EOF
+	it("unescapes an ALPN protocol id correctly", function()
+		assert.same("foo", protocol_id:match("foo"))
+		-- percent encoded chars
+		assert.same(" ", protocol_id:match("%20")) -- space
+		assert.same("%", protocol_id:match("%25")) -- %
+	end)
+	it("must not decode to character that didn't need to be escaped", function()
+		assert.same(nil, protocol_id:match("%41")) -- a
+		assert.same(nil, protocol_id:match("%26")) -- &
+	end)
+	it("must be 2 digit hex", function()
+		assert.same(nil, protocol_id:match("%2"))
+	end)
+	it("must be uppercase hex", function()
+		assert.same(nil, protocol_id:match("%1a"))
+	end)
+end)