[{"data":1,"prerenderedAt":411},["ShallowReactive",2],{"project-28017051":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":34,"aspects":35,"strip":45,"post_text":47,"what":48,"said":57,"maker_in_thread":142,"shape":155,"grid":159,"attempts":372,"same_week":373,"maker_shows":31,"maker_hidden":403,"reader_version":404,"card":405},"28017051","redbean","Micro HTTP server in 22 lines of C","title","Show HN: Micro HTTP server in 22 lines of C","https:\u002F\u002Ftwitter.com\u002Filyakurdyukov\u002Fstatus\u002F1421349901720510465","twitter.com","jpegqs",1627729659,2021,223,100,187,2533,8,"notable","infrastructure","http server","other",[21,24,25,26,27],"micro server","c web server","single file server","cosmopolitan","mixed",-0.169,{"positive":31,"neutral":32,"mixed":33,"critical":32},5,12,1,30,{"performance":36,"execution":39,"idea":41,"design":42,"docs":43,"privacy":44},{"positive":37,"critical":38},2,0,{"positive":38,"critical":40},9,{"positive":37,"critical":38},{"positive":33,"critical":33},{"positive":38,"critical":38},{"positive":38,"critical":37},[38,38,38,38,38,38,31,38,38,46,46,31,46,38,38,38,33,31,33,38,33,33,38,33,38,33,38,38,33,46,33,33,46,31,33,33,33,38,46,46],3,null,{"problem":47,"audience":47,"pricing":47,"motivation":47,"time_to_build":47,"stack":49,"openness":56,"stage":56,"team_size":56},[50],{"value":51,"source":52,"evidence":53},"C","maker",[54],{"id":55},"post","unknown",{"praise":58,"objections":75,"requests":114,"questions":122,"alternatives":127},[59],{"value":60,"source":61,"evidence":62},"Clever, small, and fun demonstration of simplicity","commenter",[63,67,71],{"id":64,"by":65,"text":66},"28019339","codetrotter","The ASCII-art formatted version is pretty nice looking. I was going to say that I don’t however get why the “almost readable version” is weirdly formatted. But then I ran it…",{"id":68,"by":69,"text":70},"28018341","snet0","I was surprised to read that this is actually a totally valid HTTP\u002F1.1 application, according to the RFC. The only thing you need is the status line (http version, status code,…",{"id":72,"by":73,"text":74},"28032176","javajosh","You seem to have written a glorious series of interlocking hacks which yields a small, tight, simple, fast, portable, useful nugget of functionality in a single file. Bravo. I…",[76,95],{"value":77,"source":61,"evidence":78},"HTTP parsing is not actually simple; the sample ignores many spec requirements",[79,83,87,91],{"id":80,"by":81,"text":82},"28018422","nly","No, parsing HTTP\u002F1.x is a nightmare and definitely not simple. It wasn't even particularly well defined until 2014 when the original RFCs were modernized, and even now there are…",{"id":84,"by":85,"text":86},"28019127","darnir","HTTP\u002F1.x is anything but simple. They were under defined and overly complex in many ways. The original RFC was so complex that when reworked, they split it into 6 documents. I've…",{"id":88,"by":89,"text":90},"28020133","kevinoid","I agree. As with many things, it's only simple as long as you ignore the complexities. As they say, the devil's in the details. > this \"server\" only responds to a simple well…",{"id":92,"by":93,"text":94},"28025339","pornel","HTTP\u002F1 is deceptive, because you think \"oh, I'll just read RFC 2616, make a state machine, and I'm done!\". But then writing a browser-compatible HTTP\u002F1 client is a whole another…",{"value":96,"source":61,"evidence":97},"Path traversal and security risks in the server",[98,102,106,110],{"id":99,"by":100,"text":101},"28017998","gberger","I know this is just for fun and not intended for production use. But what could be potential exploits and vulnerabilities in this server?",{"id":103,"by":104,"text":105},"28018056","sneak","GET ..\u002F..\u002F..\u002Fetc\u002Fpasswd",{"id":107,"by":108,"text":109},"28021479","jart","GET %C0%AE%C0%AE\u002F%C0%AE%C0%AE\u002F%C0%AE%C0%AE\u002Fetc\u002Fpasswd",{"id":111,"by":112,"text":113},"28022960","Arch-TK","GET \u002F\u002Fetc\u002Fpasswd HTTP\u002F1.0 I noticed the check for \"\u002F.\" in the path and I chuckled. I think if you strip all leading forward slashes and check for \"\u002F.\" then you may have it be…",[115],{"value":116,"source":61,"evidence":117},"Use safer string functions such as strncpy",[118],{"id":119,"by":120,"text":121},"28018469","jijji","use strncpy() instead of strcpy()",[123],{"value":124,"source":61,"evidence":125},"What are potential exploits and vulnerabilities?",[126],{"id":99,"by":100,"text":101},[128,135],{"value":129,"source":61,"evidence":130},"libmicrohttpd",[131],{"id":132,"by":133,"text":134},"28017630","mianos","Also, if you want to include #include \u003Cmicrohttpd.h> you can write a useful, safe (well tested), http server in a similar number of lines.",{"value":136,"source":61,"evidence":137},"ultra",[138],{"id":139,"by":140,"text":141},"28024103","alanjay","Reminds me of ultra: https:\u002F\u002Fgithub.com\u002FMarquisdeGeek\u002Fultra",{"comments":143,"answered":144,"key":145},11,4,[146,149,152],{"id":147,"text":148},"28018130","I have provided protection against this.",{"id":150,"text":151},"28026708","I made a windows port on github, you can try exploit that. \".\u002F\u002Fmachine:foo\u002Fbar\u002Fbaz\" - will it work if the dot is added at the beginning?",{"id":153,"text":154},"28023388","Good point, I need add something like b[3]='.', an then use b+3 as a path, not b+5, to fix that vulnerability. Update: I fixed this on github.",{"commenters":156,"max_depth":40,"maker_replies":143,"first_comment_mins":157,"lifespan_hours":158},52,99,54,[160,164,167,170,172,175,177,180,183,186,189,191,194,197,200,202,204,207,209,212,215,218,220,223,225,227,230,231,234,236,239,242,245,248,250,252,254,255,256,259,262,265,266,269,272,273,274,275,277,280,281,283,286,287,289,292,295,297,299,301,304,307,311,314,316,320,322,325,329,332,334,335,338,340,343,345,347,352,356,359,362,363,367,370],[161,38,38,162,163,38],"28020345","other\u002Fneutral\u002Fnone","lifthrasiir",[165,38,38,162,166,38],"28021511","ducktective",[168,38,38,162,169,38],"28025032","Trung0246",[171,38,38,162,163,38],"28029886",[173,33,38,162,174,38],"28017950","milansuk",[80,33,38,176,81,38],"commenter\u002Fneutral\u002Fnone",[178,33,38,162,179,38],"28018440","ibraheemdev",[181,33,38,176,182,38],"28019169","hdjjhhvvhga",[184,33,38,176,185,38],"28019693","a-dub",[187,33,38,162,188,38],"28020519","jsjohnst",[190,33,38,176,108,38],"28020761",[192,33,38,162,193,38],"28019373","giancarlostoro",[195,33,31,196,108,38],"28020575","project\u002Fpositive\u002Fperformance",[198,33,38,176,199,38],"28020773","mariusor",[201,33,38,176,108,38],"28021003",[203,33,38,176,199,38],"28021675",[205,33,38,176,206,38],"28021005","ysleepy",[208,33,38,176,108,38],"28021073",[210,33,38,176,211,38],"28023637","cormacrelf",[213,33,46,214,81,38],"28022431","project\u002Fneutral\u002Fexecution",[216,33,38,176,217,38],"28023191","lttlrck",[219,33,46,214,108,38],"28024050",[221,33,46,222,73,38],"28023183","maker\u002Fneutral\u002Fperformance",[224,33,31,196,108,38],"28024028",[72,33,31,226,73,38],"project\u002Fpositive\u002Fidea",[228,33,46,229,108,38],"28032441","project\u002Fneutral\u002Fidea",[92,33,38,176,93,38],[232,33,38,176,233,38],"28033224","cookiengineer",[235,33,38,176,233,38],"28033187",[237,33,38,176,238,38],"28021436","strictfp",[240,33,38,176,241,38],"28022041","na85",[243,33,38,162,244,38],"28018550","secondcoming",[246,33,38,162,247,38],"28018770","Arnavion",[84,33,46,249,85,38],"project\u002Fmixed\u002Fnone",[88,33,33,251,89,38],"project\u002Fcritical\u002Fexecution",[64,37,31,253,65,38],"project\u002Fpositive\u002Fdesign",[99,46,46,214,100,38],[103,46,33,251,104,38],[257,46,46,214,258,38],"28018067","asah",[260,46,38,176,261,38],"28018110","jcelerier",[263,46,38,176,264,38],"28019309","junon",[147,46,38,214,11,33],[267,46,33,251,268,38],"28021424","Someone",[270,46,38,176,271,38],"28022473","fao_",[150,46,38,214,11,33],[111,46,33,251,112,38],[153,46,38,214,11,33],[276,46,38,214,11,33],"28026124",[278,46,38,176,279,38],"28021168","NieDzejkob",[107,46,33,251,108,38],[282,46,38,214,11,33],"28023957",[284,46,38,285,11,33],"28018152","maker\u002Fneutral\u002Fnone",[119,46,33,251,120,38],[288,46,38,214,11,33],"28018524",[290,46,38,176,291,38],"28019379","throwaway984393",[293,46,38,176,294,38],"28019906","arp242",[296,46,38,176,291,38],"28020127",[298,46,38,176,108,38],"28021311",[300,46,38,176,120,38],"28022866",[302,46,33,251,303,38],"28020424","Matthias247",[305,46,38,162,306,38],"28021404","SahAssar",[308,144,46,309,310,38],"28019654","project\u002Fneutral\u002Fdocs","SV_BubbleTime",[312,144,38,313,11,33],"28019914","maker\u002Fneutral\u002Fdocs",[315,144,46,313,310,38],"28020013",[317,144,33,318,319,38],"28020589","project\u002Fcritical\u002Fprivacy","formerly_proven",[321,144,33,318,279,38],"28021151",[323,144,38,324,11,33],"28023821","maker\u002Fneutral\u002Fprivacy",[326,144,38,327,328,38],"28024524","commenter\u002Fneutral\u002Fprivacy","irundebian",[330,144,46,331,279,38],"28021122","maker\u002Fneutral\u002Fexecution",[333,144,38,331,11,33],"28023408",[68,31,31,226,69,38],[336,31,33,251,337,38],"28018678","deathanatos",[339,31,38,331,11,33],"28023813",[341,31,38,342,337,38],"28039409","commenter\u002Fneutral\u002Fexecution",[344,31,33,251,89,38],"28020235",[139,346,46,229,140,38],6,[348,349,33,350,351,38],"28021854",7,"project\u002Fcritical\u002Fdesign","LinAGKar",[353,349,38,354,355,38],"28021900","commenter\u002Fneutral\u002Fdesign","phoe-krk",[357,349,38,354,358,38],"28021935","lmilcin",[360,349,38,361,351,38],"28029078","commenter\u002Fcritical\u002Fdesign",[132,18,46,229,133,38],[364,18,38,365,366,38],"28017844","commenter\u002Fneutral\u002Fidea","rijoja",[368,18,38,176,369,38],"28019181","Koshkin",[371,18,46,229,244,38],"28018590",[],[374,379,384,389,394,398],{"id":375,"name":376,"points":377,"category":378},"28012829","Static.wiki",796,"learning_science",{"id":380,"name":381,"points":382,"category":383},"28059291","Till",209,"dev_tools",{"id":385,"name":386,"points":387,"category":388},"27996348","Clockwise",162,"productivity",{"id":390,"name":391,"points":392,"category":393},"28048528","ocean",159,"languages",{"id":395,"name":396,"points":397,"category":20},"28063597","Hookdeck",126,{"id":399,"name":400,"points":401,"category":402},"28037113","Open by Design",118,"creative",false,"v2",{"id":406,"name":5,"line":6,"ai":403,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":407,"top":18,"kw":408,"maker":11,"domain":10,"tier":19,"attempts":38,"strip":409,"url":9,"mix":410,"praise":60,"objection":77,"sub":21},28017051,-0.17,[21,24,25,26,27],"0000005003353000151011010100131135111033",[31,32,33,32],1794036609583]