Tighten the #638 comments

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Xavier Roche <roche@httrack.com>

.github/workflows/codeql.yml

@@ -55,6 +55,9 @@ jobs:
             query-filters:
               - exclude:
                   id: cpp/world-writable-file-creation
+              # Models auth-bypass-by-spoofing; httrack has no auth surface, its +/- crawl filter is a mirror boundary, not a security one.
+              - exclude:
+                  id: cpp/user-controlled-bypass
 
       # Manual build: CodeQL traces the compiler, so build exactly what ships.
       - name: Build

src/htsparse.c

@@ -315,9 +315,18 @@ static void escape_url_parens(char *const s, const size_t size) {
   strlcpybuff(s, buff, size);
 }
 
-/* Strip a default ":80" from lien's authority in place. Any spelling that
-   range-parses to 80 (":80", ":080") is dropped by its matched length, not a
-   hardcoded 3 chars; a value that merely wraps to 80 as an int (#614) stays. */
+/* Default port for lien's scheme (case-insensitive), 80 if absent/unknown; so
+   schemeless and protocol-relative //host links default to 80 (known gap). */
+static int scheme_default_port(const char *lien) {
+  if (strfield(lien, "https:"))
+    return 443;
+  if (strfield(lien, "ftp:"))
+    return 21;
+  return 80;
+}
+
+/* Strip the scheme's own default port (80 http, 443 https, 21 ftp) from lien's
+   authority in place; :80 on https/ftp stays as a real port (#638, #614). */
 void hts_strip_default_port(char *lien, size_t size) {
   char *a;
 
@@ -339,7 +348,8 @@ void hts_strip_default_port(char *lien, size_t size) {
       b++;
     saved = *b;
     *b = '\0';
-    is_default = hts_parse_url_port(a + 1, &port) && port == 80;
+    is_default =
+        hts_parse_url_port(a + 1, &port) && port == scheme_default_port(lien);
     *b = saved;
     if (is_default) { // default port, strip it
       char BIGSTK tempo[HTS_URLMAXSIZE * 2];

src/htsselftest.c

@@ -1589,10 +1589,8 @@ static int st_identabs(httrackp *opt, int argc, char **argv) {
   return 0;
 }
 
-/* Default-port strip (#627): a genuine 80 (any spelling) is removed by its
-   matched length, host preserved; a non-80 port or one that only wraps to 80 as
-   a 32-bit int (#614) is left intact. Guards the old bug where ":080"/":0080"
-   dropped a hardcoded 3 chars and glued the leftover digits onto the host. */
+/* Default-port strip is scheme-aware (#638), overflow-safe (#614): a scheme's
+   own default (any spelling) is dropped, a real port stays; guards #627. */
 static int st_stripport(httrackp *opt, int argc, char **argv) {
   static const struct {
     const char *in, *out;
@@ -1606,6 +1604,13 @@ static int st_stripport(httrackp *opt, int argc, char **argv) {
       {"http://127.0.0.1:8080/x", "http://127.0.0.1:8080/x"},
       {"http://127.0.0.1:4294967376/x", "http://127.0.0.1:4294967376/x"},
       {"http://127.0.0.1/x", "http://127.0.0.1/x"},
+      {"https://127.0.0.1:443/x", "https://127.0.0.1/x"},
+      {"https://127.0.0.1:80/x", "https://127.0.0.1:80/x"},
+      // Scheme match is case-insensitive: HTTPS' default is 443, so :80 stays.
+      {"HTTPS://127.0.0.1:80/x", "HTTPS://127.0.0.1:80/x"},
+      {"ftp://127.0.0.1:21/x", "ftp://127.0.0.1/x"},
+      {"ftp://127.0.0.1:80/x", "ftp://127.0.0.1:80/x"},
+      {"http://127.0.0.1:443/x", "http://127.0.0.1:443/x"},
   };
 
   size_t k;

tests/66_engine-port80-strip.test

@@ -6,6 +6,7 @@ set -euo pipefail
 # Stripping a default :80 from a crawled link used to skip a hardcoded 3 chars
 # (#627): ":080"/":0080" lost only ":80" and glued the rest onto the host
 # (127.0.0.1:080/x -> 127.0.0.10/x), and a value wrapping to 80 as a 32-bit int
-# (#614) was stripped as if it were the default. All assertions live in the
-# engine self-test.
+# (#614) was stripped as if it were the default. The default is scheme-aware
+# (#638): an explicit :80 on https/ftp stays, :443/:21 strip under their own
+# scheme. All assertions live in the engine self-test.
 httrack -O /dev/null -#test=stripport | grep -q "stripport self-test OK"