Perform basic sanity checks in signUp handler

This fixes Issue #69 recorded in the oBIX github repo. The root cause is
that if the href in the signUp device is an empty string, dirname returns
"." and such string should NOT be freed by the application or otherwise
it segfaults.

Before any node is added to the global DOM tree, sanity checks should have
been properly done on its href. Furthermore, as for the signUp handler, all
devices should go to the device lobby.

Valgrind tests passed when trying to sign up a device with following
invalid hrefs:
 . ""
 . " " or "		"
 . "." or ". " or ".."
 . "/"
 . "//"
 . "/."
 . "/obix/outsideofdevicelobby"

Instead of segfaults, oBIX server return an error contract gracefully.
Sure!

I will send another PR with comments in the header for this newly added API, also impose stricter control on the href to have no dot anywhere in the href string. Currently only the dot after the beginning slash is checked, whereas it could be somewhere else later, such as:

/obix/deviceRoot/../

although it won't wipe out the whole device lobby, but it will create a child with href of ".." under /obix/deviceRoot:

[harry@ndclin004 scripts.bk]$ curl localhost/obix/deviceRoot/..
<?xml version="1.0"?>
<obj href="/obix/deviceRoot/..">
  <obj name="ExampleDevice" href="example">
    <obj href="parent">
      <reltime name="time" href="time" val="PT0S" writable="true"/>
      <bool name="reset" href="reset" val="false" writable="true"/>
    </obj>
  </obj>
</obj>
[harry@ndclin004 scripts.bk]$

Which doesn't look tidy at all.

Cheers,
Harry


How did I do? 1-click feedback: https://secure.teamhively.com/welcome/rate/7672
________________________________
From: Tyler Watson [notifications@github.com]
Sent: Tuesday, October 14, 2014 4:16 PM
To: ONEDC/obix
Cc: Harry Cao
Subject: Re: [obix] Perform basic sanity checks in signUp handler (#71)


In src/libs/xml_utils.h:

> @@ -155,4 +155,6 @@ void xml_remove_children(xmlNode *parent);
>  int xml_is_valid_doc(const char *, const char *);
>  #endif
>
> +int xml_href_is_valid(xmlChar *);


Since this is a public API, I would prefer function comments in the header rather than implementation or both. This is for people consuming libobix-devel in the future with just include files may look at comments in the header.

—
Reply to this email directly or view it on GitHub<https://github.com/ONEDC/obix/pull/71/files#r18810517>.


The information contained in this email and any attachments may be confidential. This email and any attachments are also subject to copyright. No part of them may be reproduced, adapted or transmitted without the written permission of the copyright owner. If you are not the intended recipient, any use, interference with, disclosure or copying of this information is unauthorised and prohibited. If you have received this email in error, please immediately advise the sender by return email and delete the message from your system. All email communications to and from NEXTDC Limited are recorded for the purposes of archival and storage.