htsserver: the session id must gate the request body, not the reply

Every field of a POST body is written straight into the one global key store
the templates and the command dispatcher both read, and "command" from there
reaches the engine. The gate ran after that write and compared "sid" against
"_sid" -- but "_sid" is copied into "sid" beforehand so the templates can
render it, so a request that simply omitted the field compared equal to
itself. Only a wrong id was refused; an absent one passed. Clearing the reply
afterwards does not help either, because the dispatcher sits outside the reply
guard.

Authenticate before parsing instead: scan the raw body for "sid", require at
least one occurrence and reject if any of them differs, and drop the body
untouched when it does not match. That leaves the shared template key alone,
and it closes the dispatcher for free.

A refused request also emitted only a Content-length line, since the status
line for that branch was behind _DEBUG. Any client reads that as a protocol
error, which is how test 68 failed rather than reporting the refusal. Send a
403 instead.

Tests 68 and 77 posted without an id, which is what the engine used to accept,
so both now fetch the one the server renders into the form. Test 78 covers
accept, missing, empty and wrong, asserts the 403, and probes the key store
through ${projname} rather than the suppressed reply -- a reply-only assertion
passes even when the write goes through.

Also fix a leak that hung macOS CI: start() runs inside a command
substitution, so its $! never reached the parent and stop() guarded on an
empty variable, leaving one htsserver per call. Test 77 starts four, which is
exactly the four orphans the runner reported while sitting for half an hour
behind a green test log. Take the pid from the PID= line the server already
announces.

Signed-off-by: Xavier Roche <xroche@gmail.com>
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/dependabot.yml

@@ -6,3 +6,9 @@ updates:
     directory: /src
     schedule:
       interval: weekly
+
+  # Keep the workflow action pins current (they only rot manually otherwise).
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/ci.yml

@@ -31,7 +31,7 @@ jobs:
     env:
       CC: ${{ matrix.cc }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -75,7 +75,7 @@ jobs:
     name: build (no python3, Debian buildd)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -119,7 +119,7 @@ jobs:
     name: build (macOS arm64, clang)
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -166,7 +166,7 @@ jobs:
     name: webhttrack smoke (macOS arm64)
     runs-on: macos-14
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -199,7 +199,7 @@ jobs:
     name: build (linux i386, gcc -m32)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -242,7 +242,7 @@ jobs:
     name: sanitize (ASan+UBSan, gcc)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -296,7 +296,7 @@ jobs:
     name: msan (MemorySanitizer, clang)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -344,7 +344,7 @@ jobs:
     name: fuzz (libFuzzer corpus replay, clang)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -383,7 +383,7 @@ jobs:
     name: build (no openssl, --disable-https)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -437,7 +437,7 @@ jobs:
             zlib1g-dev libssl-dev libbrotli-dev libzstd-dev \
             debhelper devscripts lintian fakeroot
 
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -468,7 +468,7 @@ jobs:
     name: distcheck (release tarball)
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 
@@ -493,7 +493,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -537,7 +537,7 @@ jobs:
         tests/*.test
         tools/mkdeb.sh
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Install linters
         run: |
@@ -572,7 +572,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -624,7 +624,7 @@ jobs:
     if: github.event_name == 'pull_request'
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 

.github/workflows/codeql.yml

@@ -26,7 +26,7 @@ jobs:
       # Upload findings to the repo's code-scanning dashboard.
       security-events: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           submodules: recursive
 

.github/workflows/windows-build.yml

@@ -23,8 +23,13 @@ jobs:
       matrix:
         platform: [x64, Win32]
         configuration: [Release]
+    # Redirect vcpkg's default `files` binary cache into the workspace so
+    # actions/cache can persist it. vcpkg builds openssl/brotli/zlib/zstd from
+    # source otherwise, several minutes every run.
+    env:
+      VCPKG_DEFAULT_BINARY_CACHE: ${{ github.workspace }}\vcpkg_cache
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v7
         with:
           submodules: recursive   # coucal lives in src/coucal
 
@@ -44,6 +49,24 @@ jobs:
         shell: pwsh
         run: vcpkg integrate install
 
+      # vcpkg errors if VCPKG_DEFAULT_BINARY_CACHE points at a missing dir, and
+      # actions/cache does not create it on a miss.
+      - name: Create the vcpkg binary cache directory
+        shell: pwsh
+        run: New-Item -ItemType Directory -Force -Path $env:VCPKG_DEFAULT_BINARY_CACHE | Out-Null
+
+      # x-gha is gone (vcpkg-tool #1662 dropped it after GitHub changed the cache
+      # API), so cache the binary archives directly. Keyed on the manifest, which
+      # carries the builtin-baseline, so a Dependabot bump busts it; restore-keys
+      # still seeds the unchanged ports' archives, so only the bumped one rebuilds.
+      - name: Cache vcpkg binary archives
+        uses: actions/cache@v6
+        with:
+          path: ${{ github.workspace }}\vcpkg_cache
+          key: vcpkg-${{ matrix.platform }}-${{ hashFiles('src/vcpkg.json') }}
+          restore-keys: |
+            vcpkg-${{ matrix.platform }}-
+
       # The runner image's vcpkg checkout is pinned to some commit; our manifest's
       # builtin-baseline is usually newer, so `git show <baseline>:versions/...`
       # fails until that commit is local. Fetch exactly the pinned baseline (read
@@ -210,7 +233,7 @@ jobs:
 
       - name: Upload the test logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: engine-tests-${{ matrix.platform }}-${{ matrix.configuration }}
           path: tests/*.log
@@ -218,7 +241,7 @@ jobs:
 
       - name: Upload MSBuild logs
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: msbuild-${{ matrix.platform }}-${{ matrix.configuration }}
           path: msbuild-*.log

configure.ac

@@ -169,7 +169,7 @@ AC_CHECK_TYPE(sa_family_t, [], [AC_DEFINE([sa_family_t], [uint16_t], [sa_family_
 AX_CHECK_ALIGNED_ACCESS_REQUIRED
 
 # check for various headers
-AC_CHECK_HEADERS([execinfo.h])
+AC_CHECK_HEADERS([execinfo.h sys/ioctl.h])
 
 ### zlib
 CHECK_ZLIB()

src/htscharset.c

@@ -390,6 +390,10 @@ HTSEXT_API char *hts_convertStringSystemToUTF8(const char *s, size_t size) {
   return hts_convertStringCPToUTF8(s, size, GetACP());
 }
 
+HTSEXT_API char *hts_convertStringUTF8ToSystem(const char *s, size_t size) {
+  return hts_convertStringCPFromUTF8(s, size, GetACP());
+}
+
 HTSEXT_API void hts_argv_utf8(int *pargc, char ***pargv) {
   int wargc = 0;
   LPWSTR *const wargv = CommandLineToArgvW(GetCommandLineW(), &wargc);

src/htscharset.h

@@ -184,6 +184,12 @@ extern LPWSTR hts_pathToUCS2(const char *path);
  **/
 HTSEXT_API char *hts_convertStringSystemToUTF8(const char *s, size_t size);
 
+/**
+ * Convert UTF-8 to the current system codepage. Caller frees; NULL upon error.
+ * This function is WIN32 specific.
+ **/
+HTSEXT_API char *hts_convertStringUTF8ToSystem(const char *s, size_t size);
+
 /**
  * Replace the CRT's ANSI argv by a UTF-8 one decoded from the real UTF-16
  * command line: every char* is UTF-8 on Windows (FOPEN, STAT, ... convert at

src/htsselftest.c

@@ -887,6 +887,66 @@ static int st_charset(httrackp *opt, int argc, char **argv) {
   return 0;
 }
 
+/* Oracle is the raw Win32 two-step this replaces, so a mis-wired direction or
+   a plain copy fails whatever the machine's ACP. */
+static int st_syscharset(httrackp *opt, int argc, char **argv) {
+#ifdef _WIN32
+  static const char *const utf8 = "caf\xC3\xA9 \xE2\x82\xAC"; /* "café €" */
+  const UINT cp = GetACP();
+  const int len = (int) strlen(utf8);
+  WCHAR wide[64], round[64];
+  char want[64];
+  char *sys, *back, *part;
+  int wn, n, lossless;
+
+  (void) opt;
+  (void) argc;
+  (void) argv;
+  wn = MultiByteToWideChar(CP_UTF8, 0, utf8, len, wide,
+                           (int) (sizeof(wide) / sizeof(wide[0])));
+  assertf(wn > 0);
+  n = WideCharToMultiByte(cp, 0, wide, wn, want, (int) sizeof(want) - 1, NULL,
+                          NULL);
+  assertf(n > 0);
+  want[n] = '\0';
+  /* the ACP holds the string only if its bytes decode back to the same UTF-16;
+     lpUsedDefaultChar would miss a best-fit mapping (é to a bare e) */
+  lossless =
+      MultiByteToWideChar(cp, 0, want, n, round,
+                          (int) (sizeof(round) / sizeof(round[0]))) == wn &&
+      memcmp(round, wide, (size_t) wn * sizeof(WCHAR)) == 0;
+
+  sys = hts_convertStringUTF8ToSystem(utf8, (size_t) len);
+  assertf(sys != NULL);
+  assertf(strcmp(sys, want) == 0);
+  assertf(strlen(sys) == (size_t) n); /* NUL-terminated, nothing past it */
+  /* the copy the ASCII fast path returns is a pass on a UTF-8 ACP only */
+  assertf(cp == CP_UTF8 || strcmp(sys, utf8) != 0);
+  /* size bounds the read: a caller-given length, not strlen() */
+  part = hts_convertStringUTF8ToSystem(utf8, 3);
+  assertf(part != NULL && strcmp(part, "caf") == 0);
+  freet(part);
+  part = hts_convertStringUTF8ToSystem(utf8, 0);
+  assertf(part != NULL && *part == '\0');
+  freet(part);
+  if (lossless) {
+    back = hts_convertStringSystemToUTF8(sys, strlen(sys));
+    assertf(back != NULL);
+    assertf(strcmp(back, utf8) == 0);
+    freet(back);
+  }
+  freet(sys);
+  printf("syscharset: acp=%u %s: OK\n", (unsigned) cp,
+         lossless ? "round-trip" : "one-way");
+  return 0;
+#else
+  (void) opt;
+  (void) argc;
+  (void) argv;
+  return 77; /* WIN32-only entry point */
+#endif
+}
+
 static int st_metacharset(httrackp *opt, int argc, char **argv) {
   char *s;
 
@@ -4732,6 +4792,8 @@ static const struct selftest_entry {
     {"mime", "<filename>", "MIME type for a filename", st_mime},
     {"charset", "<charset> <hex:..|string>",
      "convert a string to UTF-8 from a charset", st_charset},
+    {"syscharset", "", "UTF-8 <-> system codepage conversion (WIN32 only)",
+     st_syscharset},
     {"metacharset", "<html>", "extract the <meta> charset from an HTML page",
      st_metacharset},
     {"isutf8", "<hex:..|string>", "is the string valid UTF-8 (1/0)", st_isutf8},

src/htsserver.c

@@ -147,7 +147,8 @@ HTS_UNUSED static int LANG_LIST(const char *path, char *buffer, size_t size);
 // 0- Init the URL catcher with standard port
 
 // smallserver_init(&port,&return_host);
-T_SOC smallserver_init_std(int *port_prox, char *adr_prox, int defaultPort) {
+T_SOC smallserver_init_std(int *port_prox, char *adr_prox, int defaultPort,
+                           const char *bindAddr) {
   T_SOC soc;
 
   if (defaultPort <= 0) {
@@ -160,12 +161,12 @@ T_SOC smallserver_init_std(int *port_prox, char *adr_prox, int defaultPort) {
     int i = 0;
 
     do {
-      soc = smallserver_init(&try_to_listen_to[i], adr_prox);
+      soc = smallserver_init(&try_to_listen_to[i], adr_prox, bindAddr);
       *port_prox = try_to_listen_to[i];
       i++;
     } while((soc == INVALID_SOCKET) && (try_to_listen_to[i] >= 0));
   } else {
-    soc = smallserver_init(&defaultPort, adr_prox);
+    soc = smallserver_init(&defaultPort, adr_prox, bindAddr);
     *port_prox = defaultPort;
   }
   return soc;
@@ -243,9 +244,10 @@ static int my_gethostname(char *h_loc, size_t size) {
 }
 
 // smallserver_init(&port,&return_host);
-T_SOC smallserver_init(int *port, char *adr) {
+T_SOC smallserver_init(int *port, char *adr, const char *bindAddr) {
   T_SOC soc = INVALID_SOCKET;
   char h_loc[256 + 2];
+  SOCaddr server;
 
   commandRunning = commandEnd = commandReturn = commandReturnSet =
     commandEndRequested = 0;
@@ -256,25 +258,23 @@ T_SOC smallserver_init(int *port, char *adr) {
     free(commandReturnCmdl);
   commandReturnCmdl = NULL;
 
-  if (my_gethostname(h_loc, 256) == 0) {   // host name
-    SOCaddr server;
+  SOCaddr_initany(server);
+  if (bindAddr != NULL && *bindAddr != '\0') {
+    /* advertise the bound address, else the URL we print is unreachable */
+    if (strlen(bindAddr) >= sizeof(h_loc) || !gethost(bindAddr, &server)) {
+      return INVALID_SOCKET;
+    }
+    strcpybuff(h_loc, bindAddr);
+  } else if (my_gethostname(h_loc, 256) != 0) { // host name
+    return INVALID_SOCKET;
+  }
 
-    SOCaddr_initany(server);
-    if ((soc =
-         (T_SOC) socket(SOCaddr_sinfamily(server), SOCK_STREAM,
-                        0)) != INVALID_SOCKET) {
-      SOCaddr_initport(server, *port);
-      if (bind(soc, &SOCaddr_sockaddr(server), SOCaddr_size(server)) == 0) {
-        if (listen(soc, 10) >= 0) {
-          strcpy(adr, h_loc);
-        } else {
-#ifdef _WIN32
-          closesocket(soc);
-#else
-          close(soc);
-#endif
-          soc = INVALID_SOCKET;
-        }
+  if ((soc = (T_SOC) socket(SOCaddr_sinfamily(server), SOCK_STREAM, 0)) !=
+      INVALID_SOCKET) {
+    SOCaddr_initport(server, *port);
+    if (bind(soc, &SOCaddr_sockaddr(server), SOCaddr_size(server)) == 0) {
+      if (listen(soc, 10) >= 0) {
+        strcpy(adr, h_loc);
       } else {
 #ifdef _WIN32
         closesocket(soc);
@@ -283,6 +283,13 @@ T_SOC smallserver_init(int *port, char *adr) {
 #endif
         soc = INVALID_SOCKET;
       }
+    } else {
+#ifdef _WIN32
+      closesocket(soc);
+#else
+      close(soc);
+#endif
+      soc = INVALID_SOCKET;
     }
   }
   return soc;
@@ -311,6 +318,51 @@ typedef struct {
   error_redirect = "/server/error.html"; \
 } while(0)
 
+/* Longest "sid" value worth unescaping: the expected one is an md5 hex digest,
+   so anything near this is already invalid and is rejected unread. */
+#define SID_VALUE_MAX 64
+
+/** Does the urlencoded request body present the expected session id?
+    True only if at least one "sid" field is present and every occurrence
+    matches, so it holds whichever one a later last-write-wins parse keeps.
+    Non-destructive: it runs before the body is tokenized in place. */
+static hts_boolean body_sid_is_valid(const char *body, const char *expected) {
+  const char *s = body;
+  hts_boolean seen = HTS_FALSE;
+
+  while (s != NULL && *s != '\0') {
+    const char *const amp = strchr(s, '&');
+    const char *const eq = strchr(s, '=');
+
+    if (eq != NULL && (amp == NULL || eq < amp) && (size_t) (eq - s) == 3 &&
+        strncmp(s, "sid", 3) == 0) {
+      const size_t len = amp != NULL ? (size_t) (amp - eq - 1) : strlen(eq + 1);
+      hts_boolean match = HTS_FALSE;
+
+      if (len < SID_VALUE_MAX) {
+        char raw[SID_VALUE_MAX];
+        String value = STRING_EMPTY;
+
+        memcpy(raw, eq + 1, len);
+        raw[len] = '\0';
+        unescapehttp(raw, &value);
+        /* StringBuff is NULL until written, so an empty value lands here. */
+        if (StringBuff(value) != NULL &&
+            strcmp(StringBuff(value), expected) == 0) {
+          match = HTS_TRUE;
+        }
+        StringFree(value);
+      }
+      if (!match) {
+        return HTS_FALSE;
+      }
+      seen = HTS_TRUE;
+    }
+    s = amp != NULL ? amp + 1 : NULL;
+  }
+  return seen;
+}
+
 int smallserver(T_SOC soc, char *url, char *method, char *data, char *path) {
   int timeout = 30;
   int retour = 0;
@@ -395,6 +447,7 @@ int smallserver(T_SOC soc, char *url, char *method, char *data, char *path) {
     T_SOC soc_c;
     LLint length = 0;
     const char *error_redirect = NULL;
+    hts_boolean denied = HTS_FALSE;
 
     line[0] = '\0';
     buffer[0] = '\0';
@@ -506,6 +559,22 @@ int smallserver(T_SOC soc, char *url, char *method, char *data, char *path) {
         }
       }
 
+      /* Authenticate the body before parsing it: every field it carries is
+         written straight into the global key store below, "command" included,
+         and that one reaches the engine. Checking afterwards cannot work — the
+         damage is already done, and the pre-seeded "sid" above would compare
+         equal to itself for a request that simply omits the field. */
+      if (meth && buffer[0]) {
+        intptr_t expected = 0;
+
+        if (!coucal_readptr(NewLangList, "_sid", &expected) ||
+            !body_sid_is_valid(buffer, (const char *) expected)) {
+          buffer[0] = '\0';
+          meth = 0;
+          denied = HTS_TRUE;
+        }
+      }
+
       /* check variables */
       if (meth && buffer[0]) {
         char *s = buffer;
@@ -526,20 +595,6 @@ int smallserver(T_SOC soc, char *url, char *method, char *data, char *path) {
         }
       }
 
-      /* Error check */
-      {
-        intptr_t adr = 0;
-        intptr_t adr2 = 0;
-
-        if (coucal_readptr(NewLangList, "sid", &adr)) {
-          if (coucal_readptr(NewLangList, "_sid", &adr2)) {
-            if (strcmp((char *) adr, (char *) adr2) != 0) {
-              meth = 0;
-            }
-          }
-        }
-      }
-
       /* Check variables (internal) */
       if (meth) {
         int doLoad = 0;
@@ -903,13 +958,11 @@ int smallserver(T_SOC soc, char *url, char *method, char *data, char *path) {
                 }
               }
               StringMemcat(headers, redir, strlen(redir));
-              {
-                char tmp[256];
-
-                if (strlen(file) < sizeof(tmp) - 32) {
-                  sprintf(tmp, "Location: %s\r\n", newfile);
-                  StringMemcat(headers, tmp, strlen(tmp));
-                }
+              /* client-supplied: a CR/LF here would split the response */
+              if (newfile[strcspn(newfile, "\r\n")] == '\0') {
+                StringCat(headers, "Location: ");
+                StringCat(headers, newfile);
+                StringCat(headers, "\r\n");
               }
               coucal_write(NewLangList, "redirect", (intptr_t) NULL);
             } else if (is_html(file)) {
@@ -1368,6 +1421,11 @@ int smallserver(T_SOC soc, char *url, char *method, char *data, char *path) {
             StringCat(output, error);
           }
         }
+      } else if (denied) {
+        StringCat(headers, "HTTP/1.0 403 Forbidden\r\n"
+                           "Server: httrack small server\r\n"
+                           "Content-type: text/html\r\n");
+        StringCat(output, "Missing or invalid session id.\r\n");
       } else {
 #ifdef _DEBUG
         char error_hdr[] =

src/htsserver.h

@@ -43,8 +43,11 @@ Please visit our Website: http://www.httrack.com
 
 // Fonctions
 void socinput(T_SOC soc, char *s, int max);
-T_SOC smallserver_init_std(int *port_prox, char *adr_prox, int defaultPort);
-T_SOC smallserver_init(int *port, char *adr);
+/* Listen on bindAddr, or every interface if NULL/empty; adr (>= 258 bytes) gets
+   the address to advertise. INVALID_SOCKET on error. */
+T_SOC smallserver_init_std(int *port_prox, char *adr_prox, int defaultPort,
+                           const char *bindAddr);
+T_SOC smallserver_init(int *port, char *adr, const char *bindAddr);
 int smallserver(T_SOC soc, char *url, char *method, char *data, char *path);
 
 #define CATCH_RESPONSE \

src/htsweb.c

@@ -88,7 +88,7 @@ Please visit our Website: http://www.httrack.com
 
 static htsmutex refreshMutex = HTSMUTEX_INIT;
 
-static int help_server(char *dest_path, int defaultPort);
+static int help_server(char *dest_path, int defaultPort, const char *bindAddr);
 extern int commandRunning;
 extern int commandEnd;
 extern int commandReturn;
@@ -153,6 +153,8 @@ int main(int argc, char *argv[]) {
   int ret = 0;
   int defaultPort = 0;
   int parentPid = 0;
+  /* loopback by default: the handler trusts its input; --bind widens it */
+  const char *bindAddr = "127.0.0.1";
 
   printf("Initializing the server..\n");
 
@@ -179,7 +181,8 @@ int main(int argc, char *argv[]) {
   if (argc < 2 || (argc % 2) != 0) {
     fprintf(stderr, "** Warning: use the webhttrack frontend if available\n");
     fprintf(stderr,
-            "usage: %s [--port <port>] [--ppid parent-pid] <path-to-html-root-dir> [key value [key value]..]\n",
+            "usage: %s [--port <port>] [--bind <address>] [--ppid parent-pid] "
+            "<path-to-html-root-dir> [key value [key value]..]\n",
             argv[0]);
     fprintf(stderr, "example: %s /usr/share/httrack/\n", argv[0]);
     return 1;
@@ -267,6 +270,14 @@ int main(int argc, char *argv[]) {
         fprintf(stderr, "couldn't set the port number to %s\n", argv[i + 1]);
         return -1;
       }
+    } else if (strcmp(argv[i], "--bind") == 0 && i + 1 < argc) {
+      /* empty would fall back to every interface, silently undoing the default
+       */
+      if (!strnotempty(argv[i + 1])) {
+        fprintf(stderr, "--bind needs an address\n");
+        return -1;
+      }
+      bindAddr = argv[i + 1];
     } else if (strcmp(argv[i], "--ppid") == 0 && i + 1 < argc) {
       if (sscanf(argv[i + 1], "%u", &parentPid) != 1) {
         fprintf(stderr, "couldn't set the parent PID to %s\n", argv[i + 1]);
@@ -293,7 +304,7 @@ int main(int argc, char *argv[]) {
   }
 
   /* launch */
-  ret = help_server(argv[1], defaultPort);
+  ret = help_server(argv[1], defaultPort, bindAddr);
 
   htsthread_wait_n(background_threads - 1);
   hts_uninit();
@@ -427,11 +438,11 @@ static int webhttrack_runmain(httrackp * opt, int argc, char **argv) {
   return ret;
 }
 
-static int help_server(char *dest_path, int defaultPort) {
+static int help_server(char *dest_path, int defaultPort, const char *bindAddr) {
   int returncode = 0;
   char adr_prox[HTS_URLMAXSIZE * 2];
   int port_prox;
-  T_SOC soc = smallserver_init_std(&port_prox, adr_prox, defaultPort);
+  T_SOC soc = smallserver_init_std(&port_prox, adr_prox, defaultPort, bindAddr);
 
   if (soc != INVALID_SOCKET) {
     char url[HTS_URLMAXSIZE * 2];

src/httrack.c

@@ -68,6 +68,9 @@ static int linput(FILE * fp, char *s, int max);
 #ifdef HAVE_UNISTD_H
 #include <unistd.h>
 #endif
+#ifdef HAVE_SYS_IOCTL_H
+#include <sys/ioctl.h>
+#endif
 #include <ctype.h>
 #if (defined(__linux) && defined(HAVE_EXECINFO_H))
 #include <execinfo.h>
@@ -185,6 +188,43 @@ static void vt_home(void) {
   printf("%s%s", VT_RESET, VT_GOTOXY("1", "0"));
 }
 
+/* Last known terminal geometry; the defaults are the classic VT100 size. */
+static int term_cols = 80;
+static int term_rows = 24;
+
+/* Returns HTS_TRUE if the terminal size changed since the last call. */
+static hts_boolean vt_size_refresh(void) {
+  int cols = 0;
+  int rows = 0;
+
+#ifdef _WIN32
+  CONSOLE_SCREEN_BUFFER_INFO info;
+  const HANDLE console = GetStdHandle(STD_OUTPUT_HANDLE);
+
+  if (console != INVALID_HANDLE_VALUE &&
+      GetConsoleScreenBufferInfo(console, &info)) {
+    cols = info.srWindow.Right - info.srWindow.Left + 1;
+    rows = info.srWindow.Bottom - info.srWindow.Top + 1;
+  }
+#elif defined(TIOCGWINSZ)
+  struct winsize ws;
+
+  if (ioctl(fileno(stdout), TIOCGWINSZ, &ws) == 0) {
+    cols = ws.ws_col;
+    rows = ws.ws_row;
+  }
+#endif
+  if (cols <= 0)
+    cols = 80;
+  if (rows <= 0)
+    rows = 24;
+  if (cols == term_cols && rows == term_rows)
+    return HTS_FALSE;
+  term_cols = cols;
+  term_rows = rows;
+  return HTS_TRUE;
+}
+
 //
 
 /*
@@ -195,7 +235,8 @@ static void vt_home(void) {
 #define STYLE_STATTEXT   VT_UNBOLD
 #define STYLE_STATRESET  VT_UNBOLD
 #define NStatsBuffer     14
-#define MAX_LEN_INPROGRESS 40
+/* Rows the stats block and "Current job" take above the in-progress list. */
+#define NStatsHeaderRows 7
 
 static int use_show;
 static httrackp *global_opt = NULL;
@@ -291,6 +332,7 @@ static int __cdecl htsshow_start(t_hts_callbackarg * carg, httrackp * opt) {
   use_show = 0;
   if (opt->verbosedisplay == HTS_VERBOSE_FULL) {
     use_show = 1;
+    (void) vt_size_refresh();
     vt_clear();
   }
   return 1;
@@ -396,6 +438,10 @@ static int __cdecl htsshow_loop(t_hts_callbackarg * carg, httrackp * opt, lien_b
 
     prev_mytime = mytime;
 
+    /* A resize leaves stale wrapped text on screen: repaint everything. */
+    if (vt_size_refresh())
+      vt_clear();
+
     st[0] = '\0';
     qsec2str(st, stat_time);
     vt_home();
@@ -435,6 +481,13 @@ static int __cdecl htsshow_loop(t_hts_callbackarg * carg, httrackp * opt, lien_b
       //
       t_StatsBuffer StatsBuffer[NStatsBuffer];
 
+      /* Keep the frame within the terminal, or it scrolls the stats away. */
+      const int nstats =
+          min(NStatsBuffer, max(0, term_rows - NStatsHeaderRows));
+      /* URL budget: half the width, i.e. the historical 40 at 80 columns. */
+      const int maxurl =
+          min((int) sizeof(StatsBuffer[0].name) - 1, max(16, term_cols / 2));
+
       {
         int i;
 
@@ -449,10 +502,11 @@ static int __cdecl htsshow_loop(t_hts_callbackarg * carg, httrackp * opt, lien_b
         }
       }
       for(k = 0; k < 2; k++) {  // 0: lien en cours 1: autres liens
-        for(j = 0; (j < 3) && (index < NStatsBuffer); j++) {    // passe de priorité
+        for (j = 0; (j < 3) && (index < nstats); j++) { // passe de priorité
           int _i;
 
-          for(_i = 0 + k; (_i < max(back_max * k, 1)) && (index < NStatsBuffer); _i++) {        // no lien
+          for (_i = 0 + k; (_i < max(back_max * k, 1)) && (index < nstats);
+               _i++) {                                  // no lien
             int i = (back_index + _i) % back_max;       // commencer par le "premier" (l'actuel)
 
             if (back[i].status >= 0) { // signifie "lien actif"
@@ -527,16 +581,14 @@ static int __cdecl htsshow_loop(t_hts_callbackarg * carg, httrackp * opt, lien_b
                   }
                 }
 
-                if ((l = (int) strlen(s)) < MAX_LEN_INPROGRESS)
+                if ((l = (int) strlen(s)) < maxurl)
                   strcpybuff(StatsBuffer[index].name, s);
                 else {
                   // couper
                   StatsBuffer[index].name[0] = '\0';
-                  strncatbuff(StatsBuffer[index].name, s,
-                              MAX_LEN_INPROGRESS / 2 - 2);
+                  strncatbuff(StatsBuffer[index].name, s, maxurl / 2 - 2);
                   strcatbuff(StatsBuffer[index].name, "...");
-                  strcatbuff(StatsBuffer[index].name,
-                             s + l - MAX_LEN_INPROGRESS / 2 + 2);
+                  strcatbuff(StatsBuffer[index].name, s + l - maxurl / 2 + 2);
                 }
 
                 if (back[i].r.totalsize >= 0) { // taille prédéfinie
@@ -597,7 +649,7 @@ static int __cdecl htsshow_loop(t_hts_callbackarg * carg, httrackp * opt, lien_b
       {
         int i;
 
-        for(i = 0; i < NStatsBuffer; i++) {
+        for (i = 0; i < nstats; i++) {
           if (strnotempty(StatsBuffer[i].state)) {
             printf(VT_CLREOL " %s - \t%s%s \t%s / \t%s", StatsBuffer[i].state,
                    StatsBuffer[i].name, StatsBuffer[i].file, int2bytes(&strc,

tests/01_engine-syscharset.test

@@ -0,0 +1,21 @@
+#!/bin/bash
+#
+# UTF-8 <-> system codepage ('httrack -#test=syscharset'), the pair an MBCS GUI
+# uses at the Win32 ANSI entry points. WIN32 only, skipped elsewhere.
+
+set -euo pipefail
+
+rc=0
+out=$(httrack -O /dev/null -#test=syscharset) || rc=$?
+echo "$out"
+
+[ "$rc" = 77 ] && exit 77
+[ "$rc" = 0 ] || exit "$rc"
+
+case "$out" in
+"syscharset: acp="*": OK") ;;
+*)
+    echo "FAIL: unexpected report"
+    exit 1
+    ;;
+esac

tests/68_webhttrack-outdir-charset.test

@@ -60,13 +60,20 @@ test -n "${url:-}" || fail "htsserver did not start: $(cat "${srvlog}")"
 
 # Post a "start" whose -O dir is 'café' in the form's ISO-8859-1 charset.
 "${python}" - "${url}" "${work}" <<'PY'
-import sys, urllib.parse, urllib.request
+import re, sys, urllib.parse, urllib.request
 
 url, work = sys.argv[1], sys.argv[2]
 outdir = work + "/caf\xe9"  # 'café' as the single byte the browser would send
 # Port 1 refuses at once: only the decoded -O dir matters, not the fetch.
 cmd = "httrack --quiet --robots=0 http://127.0.0.1:1/x.html -O " + outdir
-fields = [("path", work), ("projname", "proj"), ("command_do", "start"),
+# The body is refused without the session id the server renders into each form.
+# Note the wizard page is under /server/; a bare /step4.html is the doc page.
+page = urllib.request.urlopen(url + "server/step4.html", timeout=20).read()
+m = re.search(rb'name="sid" value="([0-9a-f]+)"', page)
+if not m:
+    raise SystemExit("no session id in server/step4.html")
+fields = [("sid", m.group(1).decode()),
+          ("path", work), ("projname", "proj"), ("command_do", "start"),
           ("winprofile", "x"), ("command", cmd)]
 body = "&".join("%s=%s" % (k, urllib.parse.quote(v, safe="", encoding="latin-1"))
                 for k, v in fields)

tests/76_cli-resize.test

@@ -0,0 +1,70 @@
+#!/bin/bash
+# #97: a terminal resize must repaint the whole screen, and the frame must
+# follow the new geometry instead of the hardcoded 80x24 one.
+set -eu
+
+: "${top_srcdir:=..}"
+testdir=$(cd "$(dirname "$0")" && pwd)
+# shellcheck source=tests/testlib.sh
+. "${testdir}/testlib.sh"
+server=$(nativepath "${testdir}/local-server.py")
+root=$(nativepath "${testdir}/server-root")
+driver=$(nativepath "${testdir}/pty-resize.py")
+
+if is_windows; then
+    echo "no pty on Windows; skipping" >&2
+    exit 77
+fi
+python=$(find_python) || ! echo "python3 not found; skipping" >&2 || exit 77
+
+tmpdir=$(mktemp -d "${TMPDIR:-/tmp}/httrack_resize.XXXXXX") || exit 1
+serverpid=
+cleanup() {
+    stop_server "$serverpid"
+    rm -rf "$tmpdir"
+}
+trap cleanup EXIT HUP INT QUIT PIPE TERM
+
+serverlog="${tmpdir}/server.log"
+: >"$serverlog"
+"$python" "$server" --root "$root" >"$serverlog" 2>&1 &
+serverpid=$!
+port=
+for _ in $(seq 1 50); do
+    line=$(head -n1 "$serverlog" 2>/dev/null)
+    if test "${line%% *}" == "PORT"; then
+        port="${line#PORT }"
+        break
+    fi
+    kill -0 "$serverpid" 2>/dev/null || {
+        echo "server exited early: $(cat "$serverlog")"
+        exit 1
+    }
+    sleep 0.1
+done
+test -n "$port" || {
+    echo "could not discover server port"
+    exit 1
+}
+
+which httrack >/dev/null || {
+    echo "could not find httrack"
+    exit 1
+}
+
+# Trickled pages under a long path: the display keeps animating while the pty is
+# resized under it, and the URL is truncated at 80 columns but not at 200.
+deep="127.0.0.1:${port}/trickle/deep/a-long-directory-segment/another-long-segment"
+out="${tmpdir}/crawl"
+mkdir "$out"
+rc=0
+# The in-progress rows show host:port, not the scheme.
+"$python" "$driver" "${tmpdir}/pty.raw" "${deep}/p" -- \
+    httrack "http://${deep}/index.html" \
+    -O "$out" -%v --robots=0 --disable-security-limits \
+    --timeout=30 --retries=1 -c4 --max-time 60 || rc=$?
+test "$rc" -eq 0 || {
+    echo "pty capture tail:"
+    tail -c 600 "${tmpdir}/pty.raw" | cat -v
+    exit 1
+}

tests/77_webhttrack-redirect.test

@@ -0,0 +1,185 @@
+#!/bin/bash
+#
+# htsserver's POST redirect: the Location header is built from a client-supplied
+# value, and the listen address is loopback unless --bind widens it.
+
+set -euo pipefail
+
+testdir=$(cd "$(dirname "$0")" && pwd)
+distdir=${top_srcdir:-$(cd "${testdir}/.." && pwd)}
+distdir=$(cd "${distdir}" && pwd)
+# run_with_timeout/kill_tree: timeout(1) is absent on macOS
+# shellcheck source=tests/testlib.sh
+. "${testdir}/testlib.sh"
+
+fail() {
+    echo "FAIL: $*" >&2
+    exit 1
+}
+
+command -v htsserver >/dev/null || fail "no htsserver in PATH"
+command -v python3 >/dev/null || {
+    echo "python3 not found; skipping" >&2
+    exit 77
+}
+
+log=$(mktemp)
+# start() runs inside a command substitution, so its $! never reaches this
+# shell. Take the pid from the server's own announcement instead: a missed kill
+# leaves an orphan holding the CI job open long after the suite has passed.
+srvpid() { sed -n 's/^PID=//p' "${log}" 2>/dev/null | head -1; }
+cleanup() {
+    stop
+    rm -f "${log}"
+}
+trap cleanup EXIT HUP INT QUIT PIPE TERM
+
+freeport() {
+    python3 -c 'import socket
+s = socket.socket()
+s.bind(("127.0.0.1", 0))
+print(s.getsockname()[1])
+s.close()'
+}
+
+# Start htsserver, echo the announced URL. Extra args are passed through.
+start() {
+    local port url
+    port=$(freeport)
+    : >"${log}"
+    (
+        trap '' TERM TTOU
+        exec htsserver "${distdir}/" --port "${port}" "$@" >"${log}" 2>&1
+    ) &
+    for _ in $(seq 1 40); do
+        url=$(sed -n 's/^URL=//p' "${log}" 2>/dev/null) && test -n "${url}" && break
+        sleep 0.25
+    done
+    test -n "${url:-}" || fail "htsserver did not come up: $(cat "${log}")"
+    echo "${url}"
+}
+
+stop() {
+    local pid
+    pid=$(srvpid)
+    test -z "${pid}" || kill -9 "${pid}" 2>/dev/null || true
+}
+
+# The session id gates the request body, so a POST has to carry one. The server
+# renders it into every form, which is where a browser picks it up too.
+scrape_sid() {
+    python3 -c 'import socket, sys
+s = socket.create_connection(("127.0.0.1", int(sys.argv[1])), 10)
+s.settimeout(20)
+s.sendall(b"GET /server/index.html HTTP/1.0\r\nHost: 127.0.0.1\r\n\r\n")
+out = b""
+while True:
+    b = s.recv(65536)
+    if not b:
+        break
+    out += b
+s.close()
+sys.stdout.write(out.decode("latin-1"))' "$1" |
+        sed -n 's/.*name="sid" value="\([0-9a-f]*\)".*/\1/p' | head -1
+}
+
+# POST redirect=$1 to 127.0.0.1:$2 with session id $3, print the raw headers.
+post_redirect() {
+    python3 -c 'import socket, sys, urllib.parse
+body = ("sid=" + sys.argv[3] + "&redirect="
+        + urllib.parse.quote(sys.argv[1], safe=""))
+req = ("POST / HTTP/1.0\r\nHost: 127.0.0.1\r\n"
+       "Content-type: application/x-www-form-urlencoded\r\n"
+       "Content-length: %d\r\n\r\n%s" % (len(body), body))
+s = socket.create_connection(("127.0.0.1", int(sys.argv[2])), 10)
+s.settimeout(20)
+s.sendall(req.encode())
+out = b""
+# stop at the end of the header block: the server need not close the connection,
+# and an unbounded recv() hung the macOS runner for over an hour.
+while b"\r\n\r\n" not in out:
+    b = s.recv(65536)
+    if not b:
+        break
+    out += b
+s.close()
+sys.stdout.write(out.split(b"\r\n\r\n")[0].decode("latin-1"))' "$1" "$2" "$3"
+}
+
+portof() { echo "${1##*:}" | tr -d /; }
+
+# "free"/"inuse"/"unusable": can $1 still be bound on 127.0.0.2? A wildcard
+# listener takes the port on every address, a loopback-only one does not, so
+# this discriminates where the announced URL cannot.
+probe_alias() {
+    python3 -c 'import socket, sys
+s = socket.socket()
+try:
+    s.bind(("127.0.0.2", int(sys.argv[1])))
+except OSError as e:
+    print("unusable" if e.errno in (99, 49, 10049) else "inuse")
+else:
+    print("free")
+finally:
+    s.close()' "$1"
+}
+
+# Non-repeating and not a round number: a truncation, a reorder or a dropped
+# interior byte all stay visible.
+long=$(python3 -c 'print("".join(chr(33 + i % 90) for i in range(4097)))')
+url=$(start)
+port=$(portof "${url}")
+sid=$(scrape_sid "${port}")
+test "${#sid}" -eq 32 || fail "did not scrape a 32-hex sid (got '${sid}')"
+resp=$(post_redirect "${long}" "${port}" "${sid}") ||
+    fail "no response to an oversized redirect value"
+stop
+loc=$(printf '%s' "${resp}" | sed -n 's/^Location: //p' | tr -d '\r')
+test "${loc}" = "${long}" ||
+    fail "oversized redirect not echoed whole (got ${#loc} bytes, want ${#long})"
+
+# CR/LF must suppress the header outright. Sanitising it instead would keep the
+# grep for an injected header quiet while still emitting a mangled Location.
+url=$(start)
+port=$(portof "${url}")
+sid=$(scrape_sid "${port}")
+resp=$(post_redirect '/foo
+X-Injected: pwned' "${port}" "${sid}") || fail "no response to a CRLF redirect value"
+stop
+printf '%s' "${resp}" | grep -qi 'X-Injected' &&
+    fail "CRLF in the redirect value reached the response"
+test "$(printf '%s' "${resp}" | grep -ci '^Location:')" -eq 0 ||
+    fail "CRLF redirect still emitted a Location header"
+test "$(printf '%s' "${resp}" | grep -c '^HTTP/1\.')" -eq 1 ||
+    fail "CRLF redirect did not yield exactly one status line"
+
+# Loopback unless asked otherwise. Assert the socket, not the announcement.
+url=$(start)
+port=$(portof "${url}")
+alias_state=$(probe_alias "${port}")
+stop
+if test "${alias_state}" = unusable; then
+    echo "no 127.0.0.2 alias; skipping the listen-address assertions" >&2
+else
+    test "${alias_state}" = free ||
+        fail "default listen address is not loopback-only (127.0.0.2:${port} taken)"
+    case "${url}" in
+    http://127.0.0.1:*) ;;
+    *) fail "default announcement is not loopback: ${url}" ;;
+    esac
+
+    url=$(start --bind 0.0.0.0)
+    port=$(portof "${url}")
+    alias_state=$(probe_alias "${port}")
+    stop
+    test "${alias_state}" = inuse ||
+        fail "--bind 0.0.0.0 did not take the wildcard (127.0.0.2:${port} ${alias_state})"
+fi
+
+# An empty --bind must not quietly fall back to every interface. Bounded: if it
+# were accepted the server would listen instead of exiting.
+run_with_timeout 15 htsserver "${distdir}/" --bind "" >"${log}" 2>&1 || true
+grep -q -- "--bind needs an address" "${log}" ||
+    fail "empty --bind not refused: $(cat "${log}")"
+
+echo "PASS"

tests/78_webhttrack-sid.test

@@ -0,0 +1,142 @@
+#!/bin/bash
+#
+# htsserver's session id must gate the request body: every field in it is
+# written into the global key store, and "command" from there reaches the engine.
+
+set -euo pipefail
+
+testdir=$(cd "$(dirname "$0")" && pwd)
+distdir=${top_srcdir:-$(cd "${testdir}/.." && pwd)}
+distdir=$(cd "${distdir}" && pwd)
+
+fail() {
+    echo "FAIL: $*" >&2
+    exit 1
+}
+
+command -v htsserver >/dev/null || fail "no htsserver in PATH"
+command -v python3 >/dev/null || {
+    echo "python3 not found; skipping" >&2
+    exit 77
+}
+
+srv=
+log=$(mktemp)
+cleanup() {
+    test -z "${srv}" || kill -9 "${srv}" 2>/dev/null || true
+    rm -f "${log}"
+}
+trap cleanup EXIT HUP INT QUIT PIPE TERM
+
+freeport() {
+    python3 -c 'import socket
+s = socket.socket()
+s.bind(("127.0.0.1", 0))
+print(s.getsockname()[1])
+s.close()'
+}
+
+# Echo the announced URL. Runs in a command substitution, so it is a
+# subshell and cannot export the pid: the caller reads it back with srvpid.
+start() {
+    local port url
+    port=$(freeport)
+    : >"${log}"
+    (
+        trap '' TERM TTOU
+        exec htsserver "${distdir}/" --port "${port}" >"${log}" 2>&1
+    ) &
+    for _ in $(seq 1 40); do
+        url=$(sed -n 's/^URL=//p' "${log}" 2>/dev/null) && test -n "${url}" && break
+        sleep 0.25
+    done
+    test -n "${url:-}" || fail "htsserver did not come up: $(cat "${log}")"
+    echo "${url}"
+}
+
+# The server reports its own pid; the aliveness assertions below hang off it.
+srvpid() { sed -n 's/^PID=//p' "${log}" | head -1; }
+
+alive() { kill -0 "$1" 2>/dev/null; }
+
+portof() { echo "${1##*:}" | tr -d /; }
+
+# Raw request to 127.0.0.1:$1; $2 is the body ("" for a GET of the $3 page,
+# default index). Prints the reply.
+request() {
+    python3 -c 'import socket, sys
+port, body = int(sys.argv[1]), sys.argv[2]
+page = sys.argv[3] if len(sys.argv) > 3 else "index"
+if body:
+    req = ("POST / HTTP/1.0\r\nHost: 127.0.0.1\r\n"
+           "Content-type: application/x-www-form-urlencoded\r\n"
+           "Content-length: %d\r\n\r\n%s" % (len(body), body))
+else:
+    req = ("GET /server/%s.html HTTP/1.0\r\nHost: 127.0.0.1\r\n\r\n" % page)
+s = socket.create_connection(("127.0.0.1", port), 10)
+s.settimeout(30)
+s.sendall(req.encode())
+out = b""
+while True:
+    b = s.recv(65536)
+    if not b:
+        break
+    out += b
+s.close()
+sys.stdout.write(out.decode("latin-1"))' "$1" "$2" ${3+"$3"}
+}
+
+# The server hands the sid to any client in every form; scraping it is the
+# legitimate flow, and it is what makes the accept case below meaningful.
+scrape_sid() {
+    request "$1" "" | sed -n 's/.*name="sid" value="\([0-9a-f]*\)".*/\1/p' | head -1
+}
+
+url=$(start)
+port=$(portof "${url}")
+srv=$(srvpid)
+test -n "${srv}" || fail "htsserver did not report its pid"
+alive "${srv}" || fail "htsserver is not running"
+
+sid=$(scrape_sid "${port}")
+# Control: without a real sid every assertion below would pass vacuously.
+test "${#sid}" -eq 32 || fail "did not scrape a 32-hex sid from the page (got '${sid}')"
+
+# Accept: the legitimate flow still works. "redirect" is the cheapest field
+# with a reply that is visible in the headers.
+resp=$(request "${port}" "sid=${sid}&redirect=/accepted")
+printf '%s' "${resp}" | grep -q '^Location: /accepted' ||
+    fail "a body carrying the correct sid was refused"
+
+# Refuse: missing and wrong. A missing one is the regression under test — the
+# expected value used to be pre-seeded into the compared key, so omitting the
+# field compared equal to itself.
+for bad in "redirect=/nosid" "sid=&redirect=/empty" \
+    "sid=00000000000000000000000000000000&redirect=/wrong"; do
+    resp=$(request "${port}" "${bad}")
+    printf '%s' "${resp}" | grep -q '^Location:' &&
+        fail "body accepted without a valid sid: ${bad}"
+    # A refusal has to be a well-formed reply, not a headerless fragment: the
+    # release build used to emit only Content-length, which reads as a protocol
+    # error to any client and hides the reason.
+    printf '%s' "${resp}" | grep -q '^HTTP/1\.0 403 ' ||
+        fail "refusal was not a 403: ${bad}"
+done
+
+# Suppressing the reply is not the same as refusing the write: the body is
+# applied to one global key store that later requests render from, and the
+# command dispatcher reads it from there. Probe the store itself — step3
+# interpolates ${projname} into its title — rather than the refused reply.
+title() { request "$1" "" step3; }
+
+request "${port}" "projname=UNAUTHWRITE" >/dev/null 2>&1 || true
+title "${port}" | grep -q 'UNAUTHWRITE' &&
+    fail "a body without a valid sid was written to the key store"
+
+# Paired accept case: without it the assertion above passes even if the server
+# simply ignores every body, which would prove nothing.
+request "${port}" "sid=${sid}&projname=AUTHWRITE" >/dev/null 2>&1 || true
+title "${port}" | grep -q 'AUTHWRITE' ||
+    fail "a body carrying the correct sid was not written to the key store"
+
+echo "PASS"

tests/Makefile.am

@@ -4,6 +4,7 @@
 EXTRA_DIST = $(TESTS) crawl-test.sh run-all-tests.sh check-network.sh \
 	proxy-https-server.py socks5-server.py proxy-connect-server.py \
 	proxytestlib.py tls-stall-server.py warc-validate.py wacz-validate.py \
+	pty-resize.py \
 	local-crawl.sh local-server.py testlib.sh server.crt server.key \
 	server-root/simple/basic.html server-root/simple/link.html \
 	server-root/stripquery/index.html server-root/stripquery/a.html \
@@ -77,6 +78,7 @@ TESTS = \
 	01_engine-status.test \
 	01_engine-stripquery.test \
 	01_engine-strsafe.test \
+	01_engine-syscharset.test \
 	01_engine-topindex.test \
 	01_engine-urlhack.test \
 	01_engine-unescape-bounds.test \
@@ -167,6 +169,9 @@ TESTS = \
 	73_local-warc.test \
 	74_local-warc-wacz.test \
 	74_local-warc-verbatim.test \
-	75_engine-longpath-posix.test
+	75_engine-longpath-posix.test \
+	76_cli-resize.test \
+	77_webhttrack-redirect.test \
+	78_webhttrack-sid.test
 
 CLEANFILES = check-network_sh.cache

tests/local-server.py

@@ -457,6 +457,9 @@ def _big_sitemap(port):
     ).encode()
 
 
+DEEPDIR = "/trickle/deep/a-long-directory-segment/another-long-segment"
+
+
 class Handler(SimpleHTTPRequestHandler):
     # Quieter logging; the launcher captures httrack's own log anyway.
     def log_message(self, fmt, *args):
@@ -1461,6 +1464,11 @@ class Handler(SimpleHTTPRequestHandler):
     def route_trickle_index(self):
         self.send_bin_index()
 
+    # #97: a path long enough that the CLI in-progress column truncates it at 80
+    # columns but not at 200. Its own index: /trickle/ is asserted on elsewhere.
+    def route_deeptrickle_index(self):
+        self.send_html('\t<a href="p0.bin">p0</a>\n\t<a href="p1.bin">p1</a>\n')
+
     def route_trickle_page(self):
         self.send_response(200)
         self.send_header("Content-Type", "application/octet-stream")
@@ -1646,6 +1654,9 @@ class Handler(SimpleHTTPRequestHandler):
         "/trickle/p5.bin": route_trickle_page,
         "/trickle/p6.bin": route_trickle_page,
         "/trickle/p7.bin": route_trickle_page,
+        DEEPDIR + "/index.html": route_deeptrickle_index,
+        DEEPDIR + "/p0.bin": route_trickle_page,
+        DEEPDIR + "/p1.bin": route_trickle_page,
         "/dcancel/index.html": route_dcancel_index,
         "/dcancel/p0.bin": route_dcancel_page,
         "/dcancel/p1.bin": route_dcancel_page,

tests/pty-resize.py

@@ -0,0 +1,130 @@
+#!/usr/bin/env python3
+"""Drive httrack on a pty and check the animated display follows the terminal.
+
+Usage: pty-resize.py <capture-file> <long-url-prefix> -- <cmd> [args...]
+"""
+import fcntl
+import os
+import pty
+import select
+import signal
+import struct
+import subprocess
+import sys
+import termios
+import time
+
+CLEAR = b"\033[2J"
+FRAME = b"\033[1;1f"  # every refresh homes here before painting the stats
+LIVE = b"Bytes saved"
+
+
+class Term:
+    def __init__(self, argv, capture):
+        self.capture = capture
+        self.buf = bytearray()
+        self.master, slave = pty.openpty()
+        self.resize(24, 80)
+        self.proc = subprocess.Popen(
+            argv, stdin=slave, stdout=slave, stderr=slave, start_new_session=True
+        )
+        os.close(slave)
+
+    def resize(self, rows, cols):
+        fcntl.ioctl(
+            self.master, termios.TIOCSWINSZ, struct.pack("HHHH", rows, cols, 0, 0)
+        )
+
+    def _read(self, timeout):
+        ready, _, _ = select.select([self.master], [], [], timeout)
+        if not ready:
+            return b""
+        try:
+            return os.read(self.master, 65536)
+        except OSError:
+            return b""
+
+    def pump(self, seconds):
+        """Read for the given window; return only the bytes read during it."""
+        mark = len(self.buf)
+        end = time.monotonic() + seconds
+        while time.monotonic() < end:
+            self.buf += self._read(0.1)
+        return bytes(self.buf[mark:])
+
+    def wait_for(self, pattern, timeout):
+        mark = len(self.buf)
+        end = time.monotonic() + timeout
+        while time.monotonic() < end:
+            self.buf += self._read(0.1)
+            if pattern in bytes(self.buf[mark:]):
+                return True
+            if self.proc.poll() is not None:
+                break
+        return False
+
+    def alive(self):
+        return self.proc.poll() is None
+
+    def close(self):
+        if self.alive():
+            os.killpg(self.proc.pid, signal.SIGKILL)
+        self.proc.wait()
+        os.close(self.master)
+        with open(self.capture, "wb") as fp:
+            fp.write(self.buf)
+
+
+def frame_heights(chunk):
+    """Newline count of each complete frame in the chunk."""
+    return [f.count(b"\n") for f in chunk.split(FRAME)[1:-1]]
+
+
+def main():
+    capture, long_url = sys.argv[1], sys.argv[2].encode()
+    argv = sys.argv[sys.argv.index("--") + 1 :]
+    term = Term(argv, capture)
+    failures = []
+
+    def check(cond, msg):
+        if not cond:
+            failures.append(msg)
+        return cond
+
+    try:
+        if not check(term.wait_for(LIVE, 15), "the display never started"):
+            return 1
+
+        # Steady state: a repaint here would mask any resize-driven one below.
+        idle = term.pump(1.0)
+        check(CLEAR not in idle, "repaint without a resize")
+        check(long_url not in idle, "long URL not truncated at 80 columns")
+
+        term.resize(24, 120)
+        check(term.wait_for(CLEAR, 3), "no repaint after a width-only resize")
+        check(CLEAR not in term.pump(1.0), "repaint kept firing after the resize")
+
+        term.resize(10, 120)
+        check(term.wait_for(CLEAR, 3), "no repaint after a height-only resize")
+        heights = frame_heights(term.pump(1.0))
+        check(heights, "no frame after the height change")
+        check(
+            all(h <= 9 for h in heights),
+            "frame overflows a 10-row terminal: %s" % heights,
+        )
+
+        term.resize(24, 200)
+        check(term.wait_for(CLEAR, 3), "no repaint after growing the terminal")
+        check(long_url in term.pump(1.0), "long URL still truncated at 200 columns")
+
+        check(term.alive(), "httrack died mid-run (exit %s)" % term.proc.poll())
+    finally:
+        term.close()
+
+    for msg in failures:
+        print("FAIL: %s" % msg)
+    return 1 if failures else 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())