fix(mem): limit the use of std::vector in middleware code that could execute in the context of a request

Author: mathieucarbou

src/ESPAsyncWebServer.h

@@ -789,14 +789,15 @@ class AsyncHeaderFreeMiddleware : public AsyncMiddleware {
   void keep(const char *name) {
     _toKeep.push_back(name);
   }
+
   void unKeep(const char *name) {
-    _toKeep.erase(std::remove(_toKeep.begin(), _toKeep.end(), name), _toKeep.end());
+    _toKeep.remove(name);
   }
 
   void run(AsyncWebServerRequest *request, ArMiddlewareNext next);
 
 private:
-  std::vector<const char *> _toKeep;
+  std::list<const char *> _toKeep;
 };
 
 // filter out specific headers from the incoming request
@@ -805,14 +806,15 @@ class AsyncHeaderFilterMiddleware : public AsyncMiddleware {
   void filter(const char *name) {
     _toRemove.push_back(name);
   }
+
   void unFilter(const char *name) {
-    _toRemove.erase(std::remove(_toRemove.begin(), _toRemove.end(), name), _toRemove.end());
+    _toRemove.remove(name);
   }
 
   void run(AsyncWebServerRequest *request, ArMiddlewareNext next);
 
 private:
-  std::vector<const char *> _toRemove;
+  std::list<const char *> _toRemove;
 };
 
 // curl-like logging of incoming requests

src/Middleware.cpp

@@ -146,20 +146,22 @@ void AsyncAuthenticationMiddleware::run(AsyncWebServerRequest *request, ArMiddle
 }
 
 void AsyncHeaderFreeMiddleware::run(AsyncWebServerRequest *request, ArMiddlewareNext next) {
-  std::vector<const char *> reqHeaders;
-  request->getHeaderNames(reqHeaders);
-  for (const char *h : reqHeaders) {
+  std::list<const char *> toRemove;
+  for (auto &h : request->getHeaders()) {
     bool keep = false;
     for (const char *k : _toKeep) {
-      if (strcasecmp(h, k) == 0) {
+      if (strcasecmp(h.name().c_str(), k) == 0) {
         keep = true;
         break;
       }
     }
     if (!keep) {
-      request->removeHeader(h);
+      toRemove.push_back(h.name().c_str());
     }
   }
+  for (const char *h : toRemove) {
+    request->removeHeader(h);
+  }
   next();
 }
 

src/WebRequest.cpp

@@ -796,12 +796,11 @@ const AsyncWebHeader *AsyncWebServerRequest::getHeader(size_t num) const {
 }
 
 size_t AsyncWebServerRequest::getHeaderNames(std::vector<const char *> &names) const {
-  const size_t size = _headers.size();
-  names.reserve(size);
+  const size_t size = names.size();
   for (const auto &h : _headers) {
     names.push_back(h.name().c_str());
   }
-  return size;
+  return names.size() - size;
 }
 
 bool AsyncWebServerRequest::removeHeader(const char *name) {