Add normalization the URI before cdniuc validation in URI Signing

plugins/experimental/uri_signing/Makefile.inc

@@ -23,6 +23,7 @@ experimental_uri_signing_uri_signing_la_SOURCES = \
   experimental/uri_signing/jwt.c                  \
   experimental/uri_signing/match.c                \
   experimental/uri_signing/parse.c                \
+  experimental/uri_signing/normalize.c            \
   experimental/uri_signing/timing.c
 
 experimental_uri_signing_uri_signing_la_LIBADD = @LIBJANSSON@ @LIBCJOSE@ @LIBPCRE@ -lm -lcrypto
@@ -39,4 +40,5 @@ experimental_uri_signing_test_uri_signing_SOURCES = \
     experimental/uri_signing/cookie.c \
     experimental/uri_signing/config.c \
     experimental/uri_signing/timing.c \
+    experimental/uri_signing/normalize.c \
     experimental/uri_signing/match.c

plugins/experimental/uri_signing/common.h

@@ -28,6 +28,7 @@ void PrintToStdErr(const char *fmt, ...);
 
 #else
 
+#include "ts/ts.h"
 #define PluginDebug(...) TSDebug("uri_signing", PLUGIN_NAME " " __VA_ARGS__)
 #define PluginError(...) PluginDebug(__VA_ARGS__), TSError(PLUGIN_NAME " " __VA_ARGS__)
 

plugins/experimental/uri_signing/jwt.c

@@ -19,6 +19,7 @@
 #include "common.h"
 #include "jwt.h"
 #include "match.h"
+#include "normalize.h"
 #include "ts/ts.h"
 #include <jansson.h>
 #include <cjose/cjose.h>
@@ -161,14 +162,26 @@ jwt_validate(struct jwt *jwt)
 bool
 jwt_check_uri(const char *cdniuc, const char *uri)
 {
-  static const char CONT_URI_STR[]         = "uri";
-  static const char CONT_URI_PATTERN_STR[] = "uri-pattern";
-  static const char CONT_URI_REGEX_STR[]   = "uri-regex";
+  static const char CONT_URI_HASH_STR[]  = "hash";
+  static const char CONT_URI_REGEX_STR[] = "regex";
 
   if (!cdniuc || !*cdniuc || !uri) {
     return false;
   }
 
+  /* Normalize the URI */
+  int uri_ct  = strlen(uri);
+  int buff_ct = uri_ct + 2;
+  int err;
+  char normal_uri[buff_ct];
+
+  memset(normal_uri, 0, buff_ct);
+  err = normalize_uri(uri, uri_ct, normal_uri, buff_ct);
+
+  if (err) {
+    return false;
+  }
+
   const char *kind = cdniuc, *container = cdniuc;
   while (*container && *container != ':') {
     ++container;
@@ -179,23 +192,17 @@ jwt_check_uri(const char *cdniuc, const char *uri)
   ++container;
 
   size_t len = container - kind;
-  PluginDebug("Comparing with match kind \"%.*s\" on \"%s\" to \"%s\"", (int)len - 1, kind, container, uri);
+  PluginDebug("Comparing with match kind \"%.*s\" on \"%s\" to normalized URI \"%s\"", (int)len - 1, kind, container, normal_uri);
   switch (len) {
-  case sizeof CONT_URI_STR:
-    if (!strncmp(CONT_URI_STR, kind, len - 1)) {
-      return !strcmp(container, uri);
-    }
-    PluginDebug("Expected kind %s, but did not find it in \"%.*s\"", CONT_URI_STR, (int)len - 1, kind);
-    break;
-  case sizeof CONT_URI_PATTERN_STR:
-    if (!strncmp(CONT_URI_PATTERN_STR, kind, len - 1)) {
-      return match_glob(container, uri);
+  case sizeof CONT_URI_HASH_STR:
+    if (!strncmp(CONT_URI_HASH_STR, kind, len - 1)) {
+      return match_hash(container, normal_uri);
     }
-    PluginDebug("Expected kind %s, but did not find it in \"%.*s\"", CONT_URI_PATTERN_STR, (int)len - 1, kind);
+    PluginDebug("Expected kind %s, but did not find it in \"%.*s\"", CONT_URI_HASH_STR, (int)len - 1, kind);
     break;
   case sizeof CONT_URI_REGEX_STR:
     if (!strncmp(CONT_URI_REGEX_STR, kind, len - 1)) {
-      return match_regex(container, uri);
+      return match_regex(container, normal_uri);
     }
     PluginDebug("Expected kind %s, but did not find it in \"%.*s\"", CONT_URI_REGEX_STR, (int)len - 1, kind);
     break;

plugins/experimental/uri_signing/match.c

@@ -23,7 +23,7 @@
 #include <string.h>
 
 bool
-match_glob(const char *needle, const char *haystack)
+match_hash(const char *needle, const char *haystack)
 {
   return false;
 }

plugins/experimental/uri_signing/match.h

@@ -17,5 +17,5 @@
  */
 
 #include <stdbool.h>
-bool match_glob(const char *needle, const char *haystack);
+bool match_hash(const char *needle, const char *haystack);
 bool match_regex(const char *pattern, const char *uri);