Don't allow ASCII control character in URLs (#790)

* Don't allow ASCII control character in URLs

* Add tests

1 files changed, 15 insertions, 0 deletions

diff --git a/uri.go b/uri.go
index c9a81d4..9d64db8 100644
--- a/uri.go
+++ b/uri.go
@@ -263,6 +263,10 @@ func (u *URI) Parse(host, uri []byte) {
 func (u *URI) parse(host, uri []byte, isTLS bool) {
 	u.Reset()
 
+	if stringContainsCTLByte(uri) {
+		return
+	}
+
 	if len(host) == 0 || bytes.Contains(uri, strColonSlashSlash) {
 		scheme, newHost, newURI := splitHostURI(host, uri)
 		u.scheme = append(u.scheme, scheme...)
@@ -581,3 +585,14 @@ func (u *URI) parseQueryArgs() {
 	u.queryArgs.ParseBytes(u.queryString)
 	u.parsedQueryArgs = true
 }
+
+// stringContainsCTLByte reports whether s contains any ASCII control character.
+func stringContainsCTLByte(s []byte) bool {
+	for i := 0; i < len(s); i++ {
+		b := s[i]
+		if b < ' ' || b == 0x7f {
+			return true
+		}
+	}
+	return false
+}