slavapestov/factor — pull request #1179 by bjourne (2014-10-31 18:56:29+00:00)
Title: Refactor read request

So I was trying to get the http server to server a webapp for me and then I found that it is childs play to break it. By forging malicious requests you can get the server to crash and/or hang. E.g factorcode.org could probably easily be crashed if it is not behind a web proxy.

To fix that, I made a new vocab http.server.requests with all the request parsing moved into there. I've tried to make it safer, eg it shouldn't crash if a `string>number` call fails. The idea is that if someone makes a naughty request, that vocab will throw a `request-error` and the server will log and respond with 400 Bad Request which is consistent with what other web servers do.

Other errors will still be bubbled up like they are now, which I think is nice because then if the web server logs `ERROR`, you know there is a bug in the code, but if it logs `NOTICE httpd-bad-request:` you know the client sent a bogus request.