HTTP URL Parsing Fails when CONFIG_HTTP_SERVER_RESOURCE_WILDCARD is enabled and wildcard contains "?"

[EricNRS]

Describe the bug
If CONFIG_HTTP_SERVER_RESOURCE_WILDCARD is enabled and a wildcard containing "?" is used, then compare_strings() will match the "?" in the wildcard and think that it is the parameter list and it will incorrectly match a shorter URL.

For example, if you have the following three resources, then "/logs/" will match resource three instead of the correct resource 2.

HTTP_RESOURCE_DEFINE(log_list, web_service, "/logs", &log_list_resource_detail);              // resource 1, list the log files
HTTP_RESOURCE_DEFINE(log_list_slash, web_service, "/logs/", &log_list_slash_resource_detail); // resource 2, list the log files
HTTP_RESOURCE_DEFINE(log_file_resource, web_service, "/logs/?*", &log_file_resource_detail);  // resource 3, the actual log file

zephyr/subsys/net/lib/http/http_server_core.c

Lines 756 to 761 in 15488be

	if (compare_strings(path, resource->resource) == 0) {
	NET_DBG("Got match for %s", resource->resource);
	*path_len = strlen(resource->resource);
	return resource->detail;
	}

To Reproduce
Enable CONFIG_HTTP_SERVER_RESOURCE_WILDCARD and add the two resources above and then browse to "/logs/".

Expected behavior
Resource handler 2 is called.

Impact
Wrong resource handler is called.

Fix
I have done this fix which works for the use case here, but there may be ramifications that I don't understand, so I will wait to open a PR until some discussion has been made.

EricNRS@a1e97a6

commit a1e97a69a84c6e3ffdf4c8eccd9f927f0220f0ea (HEAD -> 2025-01-20-http1-fnmatch-fail, ericnrs/2025-01-20-http1-fnmatch-fail)
Author: Eric Holmberg <[email protected]>
Date:   Mon Jan 20 00:48:38 2025 +1300

    net: lib: http: fix URL matching when fnmatch wildcards are used
    
    If CONFIG_HTTP_SERVER_RESOURCE_WILDCARD is enabled and a wildcard
    containing "?" is used, then `compare_strings()` will match the "?"
    in the wildcard and think that it is the parameter list and it will
    incorrectly match a shorter URL.
    
    Fixes: 84198
    
    Signed-off-by: Eric Holmberg <[email protected]>

diff --git a/subsys/net/lib/http/http_server_core.c b/subsys/net/lib/http/http_server_core.c
index d5ef4999c77..0bbfed39bf5 100644
--- a/subsys/net/lib/http/http_server_core.c
+++ b/subsys/net/lib/http/http_server_core.c
@@ -751,9 +751,7 @@ struct http_resource_detail *get_resource_detail(const struct http_service_desc
                                *path_len = strlen(resource->resource);
                                return resource->detail;
                        }
-               }
-
-               if (compare_strings(path, resource->resource) == 0) {
+                       } else if (compare_strings(path, resource->resource) == 0) {
                        NET_DBG("Got match for %s", resource->resource);
 
                        *path_len = strlen(resource->resource);

[mrodgers-witekio]

I think this can be fixed for the more general case by changing the compare_strings function so that a ?character is only treated as the end of the string coming from the HTTP request. The string from the resource->resource can only ever be terminated by a NULL character.

I should be able to put together a quick PR later today