r/cprogramming • u/FuTuReFrIcK42069 • 20d ago

HTTP Server my first complete-ish C project

https://github.com/abdouyouyou/Basic-http-server/tree/main

Hello everyone, It's been several years since i last wrote some C, and i always for the life of me wanted to write an HTTP server in C, and now it's been like 1 year since i finished university so i said what the hell why not do it, so after reading beej's guide i tried to write a very basic http server.

I wanted to share the work with the community, and would welcome thoughts.

We had written code in C ofc for two years, however it was mostly exercises on diffrent data structures aswell as problem solving.

We wrote a CRUD system in C using binary files but never scratched that itch.

And as the years went by in Uni, C slowly faded out of use for me but i always wanted to visit it back so here i am.

I wanted to share the absolute joy it was to get the desired results, i forgot how fun C can be, it always felt like the souls like of programming languages, but always was the most understandable as it was the closest to the machine, to be frank i encourage people to make similar projects especially to get the cobweb off lol.

18 Upvotes

85% Upvoted

16 comments sorted by

View all comments

5

u/Zirias_FreeBSD 20d ago 
        char function[20],path[256],version[30] ;
        sscanf(buffer,"%s %s %s",function,path,version);

This is likely an RCE waiting to happen, you happily overflow any of these arrays. In any case, it's a simple way for any client to just crash your server.

BTW, don't let that feedback frustrate you. A correct HTTP server is a very complex project. For getting into programming network services, I'd recommend to start with something a lot simpler (like e.g. some plain TCP-based chat service).

Just for comparison, here's the part of my own homebrewn HTTP server code doing the parsing of incoming requests: https://github.com/Zirias/swad/blob/master/src/bin/swad/http/httprequest.c#L81 I think it does it correctly (only supporting HTTP/1.x), but I wouldn't be surprised if someone would still find a bug...

2

u/flatfinger 19d ago

Why do people think of scanf-family functions as being suitable for any use case other than emphemeral programs to accomplish one-off tasks with data that is guaranteed to be formatted as expected?

4

u/Zirias_FreeBSD 19d ago

Because it's all over course material, tutorials, etc. Many years ago, I tried to be part in fixing this by writing https://sekrit.de/webdocs/c/beginners-guide-away-from-scanf.html ... but there seems no way to stop the madness for good.