release: 8.1.2

Author: ShogunPanda

CMakeLists.txt

@@ -1,7 +1,7 @@
 cmake_minimum_required(VERSION 3.5.1)
 cmake_policy(SET CMP0069 NEW)
 
-project(llhttp VERSION 9.2.1)
+project(llhttp VERSION 8.1.2)
 include(GNUInstallDirs)
 
 set(CMAKE_C_STANDARD 99)
@@ -47,9 +47,8 @@ configure_file(
 function(config_library target)
   target_sources(${target} PRIVATE ${LLHTTP_SOURCES} ${LLHTTP_HEADERS})
 
-  target_include_directories(${target} PUBLIC
-    $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}/include>
-    $<INSTALL_INTERFACE:include>
+  target_include_directories(${target} PRIVATE
+      ${CMAKE_CURRENT_SOURCE_DIR}/include
   )
 
   set_target_properties(${target} PROPERTIES
@@ -73,10 +72,9 @@ function(config_library target)
 
   # This is required to work with FetchContent
   install(EXPORT llhttp
-    FILE llhttp-config.cmake
-    NAMESPACE llhttp::
-    DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/llhttp
-  )
+        FILE llhttp-config.cmake
+        NAMESPACE llhttp::
+        DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/llhttp)
 endfunction(config_library target)
 
 if(BUILD_SHARED_LIBS)

README.md

@@ -61,41 +61,33 @@ checks could be performed to get even stricter verification of the llhttp.
 ## Usage
 
 ```C
-#include "stdio.h"
 #include "llhttp.h"
-#include "string.h"
 
-int handle_on_message_complete(llhttp_t* parser) {
-	fprintf(stdout, "Message completed!\n");
-	return 0;
-}
-
-int main() {
-	llhttp_t parser;
-	llhttp_settings_t settings;
+llhttp_t parser;
+llhttp_settings_t settings;
 
-	/*Initialize user callbacks and settings */
-	llhttp_settings_init(&settings);
+/* Initialize user callbacks and settings */
+llhttp_settings_init(&settings);
 
-	/*Set user callback */
-	settings.on_message_complete = handle_on_message_complete;
+/* Set user callback */
+settings.on_message_complete = handle_on_message_complete;
 
-	/*Initialize the parser in HTTP_BOTH mode, meaning that it will select between
-	*HTTP_REQUEST and HTTP_RESPONSE parsing automatically while reading the first
-	*input.
-	*/
-	llhttp_init(&parser, HTTP_BOTH, &settings);
+/* Initialize the parser in HTTP_BOTH mode, meaning that it will select between
+ * HTTP_REQUEST and HTTP_RESPONSE parsing automatically while reading the first
+ * input.
+ */
+llhttp_init(&parser, HTTP_BOTH, &settings);
 
-	/*Parse request! */
-	const char* request = "GET / HTTP/1.1\r\n\r\n";
-	int request_len = strlen(request);
+/* Parse request! */
+const char* request = "GET / HTTP/1.1\r\n\r\n";
+int request_len = strlen(request);
 
-	enum llhttp_errno err = llhttp_execute(&parser, request, request_len);
-	if (err == HPE_OK) {
-		fprintf(stdout, "Successfully parsed!\n");
-	} else {
-		fprintf(stderr, "Parse error: %s %s\n", llhttp_errno_name(err), parser.reason);
-	}
+enum llhttp_errno err = llhttp_execute(&parser, request, request_len);
+if (err == HPE_OK) {
+  /* Successfully parsed! */
+} else {
+  fprintf(stderr, "Parse error: %s %s\n", llhttp_errno_name(err),
+          parser.reason);
 }
 ```
 For more information on API usage, please refer to [src/native/api.h](https://github.com/nodejs/llhttp/blob/main/src/native/api.h).
@@ -287,7 +279,7 @@ protocol support to highly non-compliant clients/server.
 No `HPE_INVALID_HEADER_TOKEN` will be raised for incorrect header values when
 lenient parsing is "on".
 
-**Enabling this flag can pose a security issue since you will be exposed to request smuggling attacks. USE WITH CAUTION!**
+**USE AT YOUR OWN RISK!**
 
 ### `void llhttp_set_lenient_chunked_length(llhttp_t* parser, int enabled)`
 
@@ -300,22 +292,23 @@ conjunction with `Content-Length`.
 This error is important to prevent HTTP request smuggling, but may be less desirable
 for small number of cases involving legacy servers.
 
-**Enabling this flag can pose a security issue since you will be exposed to request smuggling attacks. USE WITH CAUTION!**
+**USE AT YOUR OWN RISK!**
 
 ### `void llhttp_set_lenient_keep_alive(llhttp_t* parser, int enabled)`
 
 Enables/disables lenient handling of `Connection: close` and HTTP/1.0
 requests responses.
 
-Normally `llhttp` would error the HTTP request/response 
-after the request/response with `Connection: close` and `Content-Length`. 
+Normally `llhttp` would error on (in strict mode) or discard (in loose mode)
+the HTTP request/response after the request/response with `Connection: close`
+and `Content-Length`. 
 
 This is important to prevent cache poisoning attacks,
 but might interact badly with outdated and insecure clients. 
 
 With this flag the extra request/response will be parsed normally.
 
-**Enabling this flag can pose a security issue since you will be exposed to poisoning attacks. USE WITH CAUTION!**
+**USE AT YOUR OWN RISK!**
 
 ### `void llhttp_set_lenient_transfer_encoding(llhttp_t* parser, int enabled)`
 
@@ -330,74 +323,14 @@ avoid request smuggling.
 
 With this flag the extra value will be parsed normally.
 
-**Enabling this flag can pose a security issue since you will be exposed to request smuggling attacks. USE WITH CAUTION!**
-
-### `void llhttp_set_lenient_version(llhttp_t* parser, int enabled)`
-
-Enables/disables lenient handling of HTTP version.
-
-Normally `llhttp` would error when the HTTP version in the request or status line
-is not `0.9`, `1.0`, `1.1` or `2.0`.
-With this flag the extra value will be parsed normally.
-
-**Enabling this flag can pose a security issue since you will allow unsupported HTTP versions. USE WITH CAUTION!**
-
-### `void llhttp_set_lenient_data_after_close(llhttp_t* parser, int enabled)`
-
-Enables/disables lenient handling of additional data received after a message ends
-and keep-alive is disabled.
-
-Normally `llhttp` would error when additional unexpected data is received if the message
-contains the `Connection` header with `close` value.
-With this flag the extra data will discarded without throwing an error.
-
-**Enabling this flag can pose a security issue since you will be exposed to poisoning attacks. USE WITH CAUTION!**
-
-### `void llhttp_set_lenient_optional_lf_after_cr(llhttp_t* parser, int enabled)`
-
-Enables/disables lenient handling of incomplete CRLF sequences.
-
-Normally `llhttp` would error when a CR is not followed by LF when terminating the
-request line, the status line, the headers or a chunk header.
-With this flag only a CR is required to terminate such sections.
-
-**Enabling this flag can pose a security issue since you will be exposed to request smuggling attacks. USE WITH CAUTION!**
-
-### `void llhttp_set_lenient_optional_cr_before_lf(llhttp_t* parser, int enabled)`
-
-Enables/disables lenient handling of line separators.
-
-Normally `llhttp` would error when a LF is not preceded by CR when terminating the
-request line, the status line, the headers, a chunk header or a chunk data.
-With this flag only a LF is required to terminate such sections.
-
-**Enabling this flag can pose a security issue since you will be exposed to request smuggling attacks. USE WITH CAUTION!**
-
-### `void llhttp_set_lenient_optional_crlf_after_chunk(llhttp_t* parser, int enabled)`
-
-Enables/disables lenient handling of chunks not separated via CRLF.
-
-Normally `llhttp` would error when after a chunk data a CRLF is missing before
-starting a new chunk.
-With this flag the new chunk can start immediately after the previous one.
-
-**Enabling this flag can pose a security issue since you will be exposed to request smuggling attacks. USE WITH CAUTION!**
-
-### `void llhttp_set_lenient_spaces_after_chunk_size(llhttp_t* parser, int enabled)`
-
-Enables/disables lenient handling of spaces after chunk size.
-
-Normally `llhttp` would error when after a chunk size is followed by one or more spaces are present instead of a CRLF or `;`.
-With this flag this check is disabled.
-
-**Enabling this flag can pose a security issue since you will be exposed to request smuggling attacks. USE WITH CAUTION!**
+**USE AT YOUR OWN RISK!**
 
 ## Build Instructions
 
 Make sure you have [Node.js](https://nodejs.org/), npm and npx installed. Then under project directory run:
 
 ```sh
-npm ci
+npm install
 make
 ```
 
@@ -451,7 +384,7 @@ _Note that using the git repo directly (e.g., via a git repo url and tag) will n
 
 1. Ensure that `Clang` and `make` are in your system path.
 2. Using Git Bash, clone the repo to your preferred location.
-3. Cd into the cloned directory and run `npm ci`
+3. Cd into the cloned directory and run `npm install`
 5. Run `make`
 6. Your `repo/build` directory should now have `libllhttp.a` and `libllhttp.so` static and dynamic libraries.
 7. When building your executable, you can link to these libraries. Make sure to set the build folder as an include path when building so you can reference the declarations in `repo/build/llhttp.h`.