response: Limit response header size

client.go

@@ -131,6 +131,9 @@ func (c *Client) Do(ctx context.Context, req *Request) (*Response, error) {
 		conn.Close()
 		return nil, ctx.Err()
 	case r := <-res:
+		if r.err != nil {
+			conn.Close()
+		}
 		return r.resp, r.err
 	}
 }
@@ -174,9 +177,9 @@ func (c *Client) dialContext(ctx context.Context, network, addr string) (net.Con
 }
 
 func (c *Client) verifyConnection(cs tls.ConnectionState, hostname string) error {
-	cert := cs.PeerCertificates[0]
 	// See if the client trusts the certificate
 	if c.TrustCertificate != nil {
+		cert := cs.PeerCertificates[0]
 		return c.TrustCertificate(hostname, cert)
 	}
 	return nil

doc.go

@@ -29,10 +29,10 @@ Servers should be configured with certificates:
 	}
 	server.GetCertificate = certificates.Get
 
-ServeMux is a Gemini request multiplexer.
-ServeMux can handle requests for multiple hosts and schemes.
+Mux is a Gemini request multiplexer.
+Mux can handle requests for multiple hosts and schemes.
 
-	mux := &gemini.ServeMux{}
+	mux := &gemini.Mux{}
 	mux.HandleFunc("example.com", func(ctx context.Context, w gemini.ResponseWriter, r *gemini.Request) {
 		fmt.Fprint(w, "Welcome to example.com")
 	})

examples/auth.go

@@ -30,7 +30,7 @@ func main() {
 		log.Fatal(err)
 	}
 
-	mux := &gemini.ServeMux{}
+	mux := &gemini.Mux{}
 	mux.HandleFunc("/", profile)
 	mux.HandleFunc("/username", changeUsername)
 

examples/server.go

@@ -22,7 +22,7 @@ func main() {
 		log.Fatal(err)
 	}
 
-	mux := &gemini.ServeMux{}
+	mux := &gemini.Mux{}
 	mux.Handle("/", gemini.FileServer(os.DirFS("/var/www")))
 
 	server := &gemini.Server{

examples/stream.go

@@ -21,7 +21,7 @@ func main() {
 		log.Fatal(err)
 	}
 
-	mux := &gemini.ServeMux{}
+	mux := &gemini.Mux{}
 	mux.HandleFunc("/", stream)
 
 	server := &gemini.Server{

fs.go

@@ -151,7 +151,8 @@ func serveFile(w ResponseWriter, r *Request, fsys fs.FS, name string, redirect b
 		}
 
 		// Use contents of index.gmi if present
-		index, err := fsys.Open(path.Join(name, indexPage))
+		name = path.Join(name, indexPage)
+		index, err := fsys.Open(name)
 		if err == nil {
 			defer index.Close()
 			istat, err := index.Stat()

gemini.go

@@ -11,8 +11,6 @@ func init() {
 	mime.AddExtensionType(".gemini", "text/gemini")
 }
 
-var crlf = []byte("\r\n")
-
 // Errors.
 var (
 	ErrInvalidRequest  = errors.New("gemini: invalid request")
@@ -22,3 +20,15 @@ var (
 	// when the response status code does not permit a body.
 	ErrBodyNotAllowed = errors.New("gemini: response status code does not allow body")
 )
+
+var crlf = []byte("\r\n")
+
+func trimCRLF(b []byte) ([]byte, bool) {
+	// Check for CR
+	if len(b) < 2 || b[len(b)-2] != '\r' {
+		return nil, false
+	}
+	// Trim CRLF
+	b = b[:len(b)-2]
+	return b, true
+}

io.go

@@ -1,7 +1,6 @@
 package gemini
 
 import (
-	"bufio"
 	"context"
 	"io"
 )
@@ -75,30 +74,3 @@ func (nopReadCloser) Read(p []byte) (int, error) {
 func (nopReadCloser) Close() error {
 	return nil
 }
-
-type bufReadCloser struct {
-	br *bufio.Reader // used until empty
-	io.ReadCloser
-}
-
-func newBufReadCloser(br *bufio.Reader, rc io.ReadCloser) io.ReadCloser {
-	body := &bufReadCloser{ReadCloser: rc}
-	if br.Buffered() != 0 {
-		body.br = br
-	}
-	return body
-}
-
-func (b *bufReadCloser) Read(p []byte) (n int, err error) {
-	if b.br != nil {
-		if n := b.br.Buffered(); len(p) > n {
-			p = p[:n]
-		}
-		n, err = b.br.Read(p)
-		if b.br.Buffered() == 0 {
-			b.br = nil
-		}
-		return n, err
-	}
-	return b.ReadCloser.Read(p)
-}

mux.go

@@ -10,7 +10,7 @@ import (
 	"sync"
 )
 
-// ServeMux is a Gemini request multiplexer.
+// Mux is a Gemini request multiplexer.
 // It matches the URL of each incoming request against a list of registered
 // patterns and calls the handler for the pattern that
 // most closely matches the URL.
@@ -55,17 +55,17 @@ import (
 // scheme of "gemini".
 //
 // If a subtree has been registered and a request is received naming the
-// subtree root without its trailing slash, ServeMux redirects that
+// subtree root without its trailing slash, Mux redirects that
 // request to the subtree root (adding the trailing slash). This behavior can
 // be overridden with a separate registration for the path without
-// the trailing slash. For example, registering "/images/" causes ServeMux
+// the trailing slash. For example, registering "/images/" causes Mux
 // to redirect a request for "/images" to "/images/", unless "/images" has
 // been registered separately.
 //
-// ServeMux also takes care of sanitizing the URL request path and
+// Mux also takes care of sanitizing the URL request path and
 // redirecting any request containing . or .. elements or repeated slashes
 // to an equivalent, cleaner URL.
-type ServeMux struct {
+type Mux struct {
 	mu sync.RWMutex
 	m  map[muxKey]Handler
 	es []muxEntry // slice of entries sorted from longest to shortest
@@ -106,7 +106,7 @@ func cleanPath(p string) string {
 
 // Find a handler on a handler map given a path string.
 // Most-specific (longest) pattern wins.
-func (mux *ServeMux) match(key muxKey) Handler {
+func (mux *Mux) match(key muxKey) Handler {
 	// Check for exact match first.
 	if r, ok := mux.m[key]; ok {
 		return r
@@ -134,7 +134,7 @@ func (mux *ServeMux) match(key muxKey) Handler {
 // This occurs when a handler for path + "/" was already registered, but
 // not for path itself. If the path needs appending to, it creates a new
 // URL, setting the path to u.Path + "/" and returning true to indicate so.
-func (mux *ServeMux) redirectToPathSlash(key muxKey, u *url.URL) (*url.URL, bool) {
+func (mux *Mux) redirectToPathSlash(key muxKey, u *url.URL) (*url.URL, bool) {
 	mux.mu.RLock()
 	shouldRedirect := mux.shouldRedirectRLocked(key)
 	mux.mu.RUnlock()
@@ -146,8 +146,8 @@ func (mux *ServeMux) redirectToPathSlash(key muxKey, u *url.URL) (*url.URL, bool
 
 // shouldRedirectRLocked reports whether the given path and host should be redirected to
 // path+"/". This should happen if a handler is registered for path+"/" but
-// not path -- see comments at ServeMux.
-func (mux *ServeMux) shouldRedirectRLocked(key muxKey) bool {
+// not path -- see comments at Mux.
+func (mux *Mux) shouldRedirectRLocked(key muxKey) bool {
 	if _, exist := mux.m[key]; exist {
 		return false
 	}
@@ -177,7 +177,7 @@ func getWildcard(hostname string) (string, bool) {
 // the path is not in its canonical form, the handler will be an
 // internally-generated handler that redirects to the canonical path. If the
 // host contains a port, it is ignored when matching handlers.
-func (mux *ServeMux) Handler(r *Request) Handler {
+func (mux *Mux) Handler(r *Request) Handler {
 	scheme := r.URL.Scheme
 	host := r.URL.Hostname()
 	path := cleanPath(r.URL.Path)
@@ -212,14 +212,14 @@ func (mux *ServeMux) Handler(r *Request) Handler {
 
 // ServeGemini dispatches the request to the handler whose
 // pattern most closely matches the request URL.
-func (mux *ServeMux) ServeGemini(ctx context.Context, w ResponseWriter, r *Request) {
+func (mux *Mux) ServeGemini(ctx context.Context, w ResponseWriter, r *Request) {
 	h := mux.Handler(r)
 	h.ServeGemini(ctx, w, r)
 }
 
 // Handle registers the handler for the given pattern.
 // If a handler already exists for pattern, Handle panics.
-func (mux *ServeMux) Handle(pattern string, handler Handler) {
+func (mux *Mux) Handle(pattern string, handler Handler) {
 	if pattern == "" {
 		panic("gemini: invalid pattern")
 	}
@@ -294,6 +294,6 @@ func appendSorted(es []muxEntry, e muxEntry) []muxEntry {
 }
 
 // HandleFunc registers the handler function for the given pattern.
-func (mux *ServeMux) HandleFunc(pattern string, handler HandlerFunc) {
+func (mux *Mux) HandleFunc(pattern string, handler HandlerFunc) {
 	mux.Handle(pattern, handler)
 }

mux_test.go

@@ -10,7 +10,7 @@ type nopHandler struct{}
 
 func (*nopHandler) ServeGemini(context.Context, ResponseWriter, *Request) {}
 
-func TestServeMuxMatch(t *testing.T) {
+func TestMuxMatch(t *testing.T) {
 	type Match struct {
 		URL string
 		Ok  bool
@@ -292,7 +292,7 @@ func TestServeMuxMatch(t *testing.T) {
 
 	for i, test := range tests {
 		h := &nopHandler{}
-		var mux ServeMux
+		var mux Mux
 		mux.Handle(test.Pattern, h)
 
 		for _, match := range tests[i].Matches {

request.go

@@ -51,26 +51,25 @@ func NewRequest(rawurl string) (*Request, error) {
 // for specialized applications; most code should use the Server
 // to read requests and handle them via the Handler interface.
 func ReadRequest(r io.Reader) (*Request, error) {
-	// Read URL
+	// Limit request size
 	r = io.LimitReader(r, 1026)
 	br := bufio.NewReaderSize(r, 1026)
-	rawurl, err := br.ReadString('\r')
+	b, err := br.ReadBytes('\n')
 	if err != nil {
+		if err == io.EOF {
+			return nil, ErrInvalidRequest
+		}
 		return nil, err
 	}
-	// Read terminating line feed
-	if b, err := br.ReadByte(); err != nil {
-		return nil, err
-	} else if b != '\n' {
+	// Read URL
+	rawurl, ok := trimCRLF(b)
+	if !ok {
 		return nil, ErrInvalidRequest
 	}
-	// Trim carriage return
-	rawurl = rawurl[:len(rawurl)-1]
-	// Validate URL
-	if len(rawurl) > 1024 {
+	if len(rawurl) == 0 {
 		return nil, ErrInvalidRequest
 	}
-	u, err := url.Parse(rawurl)
+	u, err := url.Parse(string(rawurl))
 	if err != nil {
 		return nil, err
 	}

request_test.go

@@ -2,7 +2,6 @@ package gemini
 
 import (
 	"bufio"
-	"io"
 	"net/url"
 	"strings"
 	"testing"
@@ -36,25 +35,25 @@ func TestReadRequest(t *testing.T) {
 		},
 		{
 			Raw: "\r\n",
-			URL: &url.URL{},
+			Err: ErrInvalidRequest,
 		},
 		{
 			Raw: "gemini://example.com\n",
-			Err: io.EOF,
+			Err: ErrInvalidRequest,
 		},
 		{
 			Raw: "gemini://example.com",
-			Err: io.EOF,
+			Err: ErrInvalidRequest,
 		},
 		{
 			// 1030 bytes
 			Raw: maxURL + "xxxxxx",
-			Err: io.EOF,
+			Err: ErrInvalidRequest,
 		},
 		{
 			// 1027 bytes
 			Raw: maxURL + "x" + "\r\n",
-			Err: io.EOF,
+			Err: ErrInvalidRequest,
 		},
 		{
 			// 1024 bytes

response.go

@@ -10,7 +10,7 @@ import (
 )
 
 // The default media type for responses.
-const defaultMediaType = "text/gemini; charset=utf-8"
+const defaultMediaType = "text/gemini"
 
 // Response represents the response from a Gemini request.
 //
@@ -44,52 +44,56 @@ type Response struct {
 // ReadResponse reads a Gemini response from the provided io.ReadCloser.
 func ReadResponse(r io.ReadCloser) (*Response, error) {
 	resp := &Response{}
-	br := bufio.NewReader(r)
 
-	// Read the status
-	statusB := make([]byte, 2)
-	if _, err := br.Read(statusB); err != nil {
+	// Limit response header size
+	lr := io.LimitReader(r, 1029)
+	// Wrap the reader to remove the limit later on
+	wr := &struct{ io.Reader }{lr}
+	br := bufio.NewReader(wr)
+
+	// Read response header
+	b, err := br.ReadBytes('\n')
+	if err != nil {
+		if err == io.EOF {
+			return nil, ErrInvalidResponse
+		}
 		return nil, err
 	}
-	status, err := strconv.Atoi(string(statusB))
+	if len(b) < 3 {
+		return nil, ErrInvalidResponse
+	}
+
+	// Read the status
+	status, err := strconv.Atoi(string(b[:2]))
 	if err != nil {
 		return nil, ErrInvalidResponse
 	}
 	resp.Status = Status(status)
 
 	// Read one space
-	if b, err := br.ReadByte(); err != nil {
-		return nil, err
-	} else if b != ' ' {
+	if b[2] != ' ' {
 		return nil, ErrInvalidResponse
 	}
 
 	// Read the meta
-	meta, err := br.ReadString('\r')
-	if err != nil {
-		return nil, err
-	}
-	// Trim carriage return
-	meta = meta[:len(meta)-1]
-	// Ensure meta is less than or equal to 1024 bytes
-	if len(meta) > 1024 {
+	meta, ok := trimCRLF(b[3:])
+	if !ok {
 		return nil, ErrInvalidResponse
 	}
-	if resp.Status.Class() == StatusSuccess && meta == "" {
-		// Use default media type
-		meta = defaultMediaType
-	}
-	resp.Meta = meta
-
-	// Read terminating newline
-	if b, err := br.ReadByte(); err != nil {
-		return nil, err
-	} else if b != '\n' {
+	if len(meta) == 0 || len(meta) > 1024 {
 		return nil, ErrInvalidResponse
 	}
+	resp.Meta = string(meta)
 
 	if resp.Status.Class() == StatusSuccess {
-		resp.Body = newBufReadCloser(br, r)
+		// Use unlimited reader
+		wr.Reader = r
+
+		type readCloser struct {
+			io.Reader
+			io.Closer
+		}
+		resp.Body = readCloser{br, r}
 	} else {
 		resp.Body = nopReadCloser{}
 		r.Close()
@@ -142,8 +146,8 @@ func (r *Response) WriteTo(w io.Writer) (int64, error) {
 // has returned.
 type ResponseWriter interface {
 	// SetMediaType sets the media type that will be sent by Write for a
-	// successful response. If no media type is set, a default of
-	// "text/gemini; charset=utf-8" will be used.
+	// successful response. If no media type is set, a default media type of
+	// "text/gemini" will be used.
 	//
 	// Setting the media type after a call to Write or WriteHeader has
 	// no effect.
@@ -154,7 +158,7 @@ type ResponseWriter interface {
 	// If WriteHeader has not yet been called, Write calls WriteHeader with
 	// StatusSuccess and the media type set in SetMediaType before writing the data.
 	// If no media type was set, Write uses a default media type of
-	// "text/gemini; charset=utf-8".
+	// "text/gemini".
 	Write([]byte) (int, error)
 
 	// WriteHeader sends a Gemini response header with the provided
@@ -175,7 +179,6 @@ type ResponseWriter interface {
 
 type responseWriter struct {
 	bw          *bufio.Writer
-	cl          io.Closer
 	mediatype   string
 	wroteHeader bool
 	bodyAllowed bool

response_test.go

@@ -65,15 +65,15 @@ func TestReadWriteResponse(t *testing.T) {
 		},
 		{
 			Raw: "",
-			Err: io.EOF,
+			Err: ErrInvalidResponse,
 		},
 		{
 			Raw: "10 Search query",
-			Err: io.EOF,
+			Err: ErrInvalidResponse,
 		},
 		{
 			Raw: "20 text/gemini\nHello, world!",
-			Err: io.EOF,
+			Err: ErrInvalidResponse,
 		},
 		{
 			Raw: "20 text/gemini\rHello, world!",
@@ -81,7 +81,7 @@ func TestReadWriteResponse(t *testing.T) {
 		},
 		{
 			Raw: "20 text/gemini\r",
-			Err: io.EOF,
+			Err: ErrInvalidResponse,
 		},
 		{
 			Raw: "abcdefghijklmnopqrstuvwxyz",

status.go

@@ -6,6 +6,7 @@ type Status int
 // Gemini status codes.
 const (
 	StatusInput                    Status = 10
+	StatusSensitiveInput           Status = 11
 	StatusSuccess                  Status = 20
 	StatusRedirect                 Status = 30
 	StatusPermanentRedirect        Status = 31
@@ -36,6 +37,8 @@ func (s Status) String() string {
 	switch s {
 	case StatusInput:
 		return "Input"
+	case StatusSensitiveInput:
+		return "Sensitive input"
 	case StatusSuccess:
 		return "Success"
 	case StatusRedirect: