networking · intermediate · ~25 min
Robust delimited parsing with bounds-checked copies.
Given an HTTP request line GET /path/here HTTP/1.1\r\n, implement
int http_parse_request_line(const char *line, char *method, size_t mlen, char *path, size_t plen);
On success returns 1, copies method (uppercase letters) into method and the path into path. Returns 0 on malformed input (missing space, missing HTTP/, etc.).
The HTTP request line is where a web server first decides what to do. Every nginx, every Node http module, every Go http.Server starts with this exact parse — and historical RCE bugs (Apache Range, nginx alias) hide here.
A line like METHOD PATH HTTP/1.x[\r\n].
See API.
Method <= 16 bytes. Path <= 1024 bytes. Reject anything longer.
#include <stddef.h>
int http_parse_request_line(const char *line, char *method, size_t mlen, char *path, size_t plen) { /* TODO */ return 0; }
Reading past \r\n; accepting lowercase methods (per RFC, methods are case-sensitive — uppercase by convention); buffer overrun by trusting the path length.
Path with query string ?foo=bar. Method OPTIONS. Missing path.
O(line length).
Solve this exercise in the browser editor — compile and run against the test harness, no setup required.