check url scheme

webcc/client.cc

@@ -1,5 +1,7 @@
 #include "webcc/client.h"
 
+#include "boost/algorithm/string.hpp"
+
 #include "webcc/logger.h"
 
 using boost::asio::ip::tcp;
@@ -99,19 +101,24 @@ void Client::DoClose() {
 }
 
 void Client::AsyncConnect() {
-  if (request_->url().scheme() == "https") {
-#if WEBCC_ENABLE_SSL
-    socket_.reset(new SslSocket{ io_context_, ssl_context_ });
-    AsyncResolve("443");
-#else
-    LOG_ERRO("SSL/HTTPS support is not enabled.");
-    error_.Set(Error::kSyntaxError, "SSL/HTTPS is not supported");
-    FinishRequest();
-#endif  // WEBCC_ENABLE_SSL
-  } else {
+  if (boost::iequals(request_->url().scheme(), "http")) {
     socket_.reset(new Socket{ io_context_ });
     AsyncResolve("80");
+    return;
   }
+
+#if WEBCC_ENABLE_SSL
+  if (boost::iequals(request_->url().scheme(), "https")) {
+    socket_.reset(new SslSocket{ io_context_, ssl_context_ });
+    AsyncResolve("443");
+    return;
+  }
+#endif  // WEBCC_ENABLE_SSL
+
+  LOG_ERRO("URL scheme (%s) is not supported",
+           request_->url().scheme().c_str());
+  error_.Set(Error::kSyntaxError, "URL scheme not supported");
+  FinishRequest();
 }
 
 void Client::AsyncResolve(string_view default_port) {

webcc/client_session.cc

@@ -14,6 +14,8 @@
 #endif  // defined(_WIN32) || defined(_WIN64)
 #endif  // WEBCC_ENABLE_SSL
 
+#include "boost/algorithm/string.hpp"
+
 #include "webcc/base64.h"
 #include "webcc/logger.h"
 #include "webcc/url.h"
@@ -193,6 +195,10 @@ ResponsePtr ClientSession::Send(RequestPtr request, bool stream,
     throw Error{ Error::kStateError, "Loop is not running" };
   }
 
+  if (!CheckUrlScheme(request)) {
+    throw Error{ Error::kSyntaxError, "Invalid URL scheme" };
+  }
+
   for (auto& h : headers_.data()) {
     if (!request->HasHeader(h.first)) {
       request->SetHeader(h.first, h.second);
@@ -229,6 +235,20 @@ void ClientSession::InitHeaders() {
   headers_.Set(headers::kConnection, "Keep-Alive");
 }
 
+bool ClientSession::CheckUrlScheme(RequestPtr request) {
+  if (boost::iequals(request->url().scheme(), "http")) {
+    return true;
+  }
+
+#if WEBCC_ENABLE_SSL
+  if (boost::iequals(request->url().scheme(), "https")) {
+    return true;
+  }
+#endif  // WEBCC_ENABLE_SSL
+
+  return false;
+}
+
 ResponsePtr ClientSession::DoSend(RequestPtr request, bool stream,
                                   ProgressCallback callback) {
   const ClientPool::Key key{ request->url() };

webcc/client_session.h

@@ -101,6 +101,9 @@ public:
 private:
   void InitHeaders();
 
+  // Check if the scheme of the request is valid.
+  bool CheckUrlScheme(RequestPtr request);
+
   ResponsePtr DoSend(RequestPtr request, bool stream,
                      ProgressCallback callback);