/* catcrafts.net Copyright (C) 2026 Catcrafts The source code of this website is made available for viewing purposes only. No permission is granted to copy, modify, distribute, or create derivative works. */ // The form layer: urlencoded parsing, the email/country shape checks, and // checkout validation — the gate every order submission passes through. import std; import Catcrafts.Shared; using namespace Catcrafts; namespace { int failures = 0; void Check(bool ok, std::string_view what, std::string_view got = {}) { if (ok) return; ++failures; std::println(std::cerr, "FAIL: {}{}{}", what, got.empty() ? "" : " got: ", got); } } // namespace int main() { using namespace Catcrafts::Form; // ── urlencoded parsing ──────────────────────────────────────────── auto parse = [](std::string_view b) { return ParseUrlEncoded(b); }; auto f = parse("email=a%40b.example&country=NL"); Check(f.has_value(), "form: basic body parses"); if (f) { Check(f->Get("email") == "a@b.example", "form: %40 decodes to @"); Check(f->Get("country") == "NL", "form: second field"); Check(f->Get("missing").empty(), "form: absent field is empty"); Check(!f->Has("missing"), "form: Has() distinguishes absent"); } Check(parse("a=1&&b=2")->Size() == 2, "form: empty segment tolerated"); Check(parse("a=1&")->Size() == 1, "form: trailing & tolerated"); Check(parse("flag")->Has("flag"), "form: valueless key present"); Check(parse("")->Size() == 0, "form: empty body"); Check(parse("q=hello+world")->Get("q") == "hello world", "form: + is space"); Check(parse("q=a%2Bb")->Get("q") == "a+b", "form: %2B is a literal plus"); Check(parse("n=caf%C3%A9")->Get("n") == "café", "form: utf-8 percent-decoding"); Check(parse("n=100%")->Get("n") == "100%", "form: malformed escape passes through"); Check(parse("n=%zz")->Get("n") == "%zz", "form: non-hex escape passes through"); // A repeated field keeps BOTH pairs and Get answers with the first. Most // urlencoded parsers in the wild take the last, so this is pinned rather // than left to the header comment: every refusal in ValidateCheckout reads // its field through Get, and flipping this to "last wins" would silently // hand a second `country=` the final say over where a parcel may go. { auto dup = parse("country=NL&country=RU"); Check(dup->Size() == 2, "form: a repeated field keeps both pairs"); Check(dup->Get("country") == "NL", "form: duplicates resolve to the first"); } // Field NAMES are percent-decoded, not only values — %73 is 's', so // `web%73ite` is the field `website`. The honeypot below is found by its // decoded name and nothing else, so this is what makes the trap closed // against a bot that encodes the key it is trying to avoid. { auto encodedName = parse("web%73ite=spam"); Check(encodedName->Has("website"), "form: a percent-encoded field name decodes"); Check(encodedName->Get("website") == "spam", "form: the value still attaches to the decoded name"); } // A field name is not allowed to be empty — "=x" is malformed, not a field. Check(!parse("=x").has_value(), "form: empty field name rejected"); // Oversized input must be refused outright rather than truncated: acting on // half a form is worse than refusing it. Check(!parse(std::string(kMaxBodyBytes + 1, 'a')).has_value(), "form: oversized body rejected"); Check(!parse("a=" + std::string(kMaxFieldBytes + 1, 'x')).has_value(), "form: oversized field rejected"); // ── email shape ─────────────────────────────────────────────────── Check(LooksLikeEmail("a@b.example"), "email: minimal"); Check(LooksLikeEmail("first.last+tag@sub.domain.example"), "email: tagged, subdomain"); Check(!LooksLikeEmail("no-at-sign"), "email: no @"); Check(!LooksLikeEmail("@domain.example"), "email: empty local part"); Check(!LooksLikeEmail("user@"), "email: empty domain"); Check(!LooksLikeEmail("a@b@c.example"), "email: two @"); Check(!LooksLikeEmail("user@dotless"), "email: dotless domain"); Check(!LooksLikeEmail("user@.example"), "email: domain starts with dot"); Check(!LooksLikeEmail("a b@c.example"), "email: embedded space"); // Header-injection characters must never survive into anything that later // builds an email envelope. Check(!LooksLikeEmail("a@b.example\nBcc: x@y.example"), "email: newline rejected"); Check(!LooksLikeEmail("a@b.example\r\nSubject: x"), "email: CRLF rejected"); Check(!LooksLikeEmail("a,b@c.example"), "email: comma rejected"); Check(!LooksLikeEmail(""), "email: angle brackets rejected"); Check(!LooksLikeEmail(std::string(250, 'a') + "@b.example"), "email: over 254 chars rejected"); // ── country code ────────────────────────────────────────────────── Check(LooksLikeCountryCode("NL"), "country: uppercase"); Check(LooksLikeCountryCode("ca"), "country: lowercase accepted"); Check(!LooksLikeCountryCode("NLD"), "country: three letters rejected"); Check(!LooksLikeCountryCode("N"), "country: one letter rejected"); Check(!LooksLikeCountryCode("N1"), "country: digit rejected"); Check(!LooksLikeCountryCode(""), "country: empty rejected"); Check(Upper("nl") == "NL", "country: normalised to upper"); // ── trimming ────────────────────────────────────────────────────── Check(Trim(" x ") == "x", "trim: spaces"); Check(Trim("\t\r\nx\n") == "x", "trim: tabs and newlines"); Check(Trim(" ").empty(), "trim: all whitespace"); // ── checkout validation ─────────────────────────────────────────── constexpr std::string_view kGoodOrder = "email=a%40b.example&name=Ada&street=Main%20St%201&postal=1234AB&city=Delft&country=nl"; auto validate = [](std::string_view body) { return ValidateCheckout(*ParseUrlEncoded(body)); }; auto good = validate(kGoodOrder); Check(good.Ok(), "checkout: valid submission accepted"); Check(good.value.country == "NL", "checkout: country uppercased"); Check(good.value.street == "Main St 1", "checkout: street decoded and kept"); Check(!validate("name=Ada&street=x&postal=1&city=y&country=NL").Ok(), "checkout: missing email rejected"); Check(!validate("email=a%40b.example&street=x&postal=1&city=y&country=NL").Ok(), "checkout: missing name rejected"); Check(!validate("email=a%40b.example&name=Ada&postal=1&city=y&country=NL").Ok(), "checkout: missing street rejected"); Check(!validate("email=a%40b.example&name=Ada&street=x&city=y&country=NL").Ok(), "checkout: missing postal rejected"); Check(!validate("email=a%40b.example&name=Ada&street=x&postal=1&country=NL").Ok(), "checkout: missing city rejected"); Check(!validate("email=a%40b.example&name=Ada&street=x&postal=1&city=y").Ok(), "checkout: missing country rejected"); Check(!validate("email=nonsense&name=Ada&street=x&postal=1&city=y&country=NL").Ok(), "checkout: bad email rejected"); // Every problem is reported at once — a form that surfaces one error per // submission makes people resubmit to discover the rest. Check(validate("email=&name=&street=&postal=&city=&country=").errors.size() == 6, "checkout: errors accumulate"); // Honeypot: a filled hidden field means a bot. The message must not name // the trap, or it teaches the next one how to pass. auto pot = validate(std::string(kGoodOrder) + "&website=http%3A%2F%2Fspam"); Check(!pot.Ok(), "checkout: honeypot rejects"); Check(pot.errors.size() == 1 && pot.errors[0].message.find("honeypot") == std::string::npos && pot.errors[0].message.find("website") == std::string::npos, "checkout: honeypot failure does not name the trap"); // The same trap with the trigger field's NAME percent-encoded, which is the // obvious way to try to slip past it. It still fails closed only because // ParseUrlEncoded decodes the key before Get looks it up, and the refusal // has to stay identical — a different answer for the encoded spelling would // itself tell a bot which spelling worked. { auto sneaky = validate(std::string(kGoodOrder) + "&web%73ite=http%3A%2F%2Fspam"); Check(!sneaky.Ok(), "checkout: honeypot catches a percent-encoded field name"); Check(sneaky.errors.size() == 1 && sneaky.errors[0].field.empty() && sneaky.errors[0].message == "Submission rejected.", "checkout: the encoded-name trap gives the same single generic refusal"); } Check(!validate("email=a%40b.example&name=" + std::string(200, 'x') + "&street=x&postal=1&city=y&country=NL").Ok(), "checkout: overlong name rejected"); // Colour and quantity: shape checks here, catalogue checks in the handler. Check(validate(std::string(kGoodOrder) + "&color=green&quantity=2").Ok(), "checkout: colour and quantity accepted"); Check(validate(std::string(kGoodOrder) + "&quantity=2").value.quantity == 2, "checkout: quantity parsed"); Check(validate(kGoodOrder).value.quantity == 1, "checkout: quantity defaults to 1"); Check(!validate(std::string(kGoodOrder) + "&quantity=0").Ok(), "checkout: zero quantity rejected"); Check(validate(std::string(kGoodOrder) + "&quantity=9").Ok(), "checkout: bulk quantity welcome"); Check(validate(std::string(kGoodOrder) + "&quantity=99").Ok(), "checkout: the technical ceiling itself is fine"); Check(!validate(std::string(kGoodOrder) + "&quantity=100").Ok(), "checkout: past the technical ceiling rejected"); Check(!validate(std::string(kGoodOrder) + "&quantity=two").Ok(), "checkout: non-numeric quantity rejected"); // "two" fails at the first character, which is the easy half. The hard half // is a valid numeric PREFIX: from_chars consumes what it can, reports // success, and leaves the leftovers to the caller — so the only thing // standing between "2x" and a two-unit charge is the check that parsing // reached the end of the field. Quantity multiplies the unit price into // what the buyer actually pays, so a partial parse is a billing bug. { auto trailing = validate(std::string(kGoodOrder) + "&quantity=2x"); Check(!trailing.Ok(), "checkout: a numeric prefix with trailing junk rejected"); Check(trailing.errors.size() == 1 && trailing.errors[0].field == "quantity", "checkout: the quantity refusal hangs off the quantity field"); // Rejected means rejected, not "keep what we managed to read": the // parsed 2 must not survive into value, because value is what the // handler prices if anything upstream ever ignores Ok(). Check(trailing.value.quantity == 1, "checkout: a rejected quantity resets to 1, not the parsed prefix"); } // from_chars for an integer stops at 'e' and at '.', so left unchecked each // of these would be read as a bare 1 rather than refused — and "1e3" is a // spelling of 1000 that no form control produces. Check(!validate(std::string(kGoodOrder) + "&quantity=1e3").Ok(), "checkout: exponent notation rejected rather than partly read"); Check(!validate(std::string(kGoodOrder) + "&quantity=1.5").Ok(), "checkout: a fractional quantity rejected rather than truncated"); // "-1" parses cleanly all the way to the end, so it survives the prefix // check and is caught by the range floor instead. Check(!validate(std::string(kGoodOrder) + "&quantity=-1").Ok(), "checkout: a negative quantity rejected"); Check(validate(std::string(kGoodOrder) + "&quantity=-1").value.quantity == 1, "checkout: a negative quantity never reaches the record"); // Trim runs before from_chars, so surrounding whitespace is not junk: // "%20" decodes to a space and " 2" trims back to "2". A buyer who pastes // a padded number is not making a hostile submission. Check(validate(std::string(kGoodOrder) + "&quantity=%202").Ok(), "checkout: a leading space on the quantity is trimmed, not rejected"); Check(validate(std::string(kGoodOrder) + "&quantity=%202").value.quantity == 2, "checkout: the trimmed quantity is the one that counts"); Check(!validate(std::string(kGoodOrder) + "&color=" + std::string(40, 'x')).Ok(), "checkout: oversized colour rejected"); // The payment choice. Absent is a form that offered none (one rail // configured, or the no-JS fallback page) and the handler resolves it to // bank — the validator's job is only to refuse a word it does not know // rather than let it fall through to a default the buyer never picked. Check(validate(kGoodOrder).value.payChoice.empty(), "checkout: absent payment choice stays empty"); Check(validate(std::string(kGoodOrder) + "&pay=bank").value.payChoice == Catcrafts::Form::kPayBank, "checkout: bank choice parsed"); Check(validate(std::string(kGoodOrder) + "&pay=crypto").value.payChoice == Catcrafts::Form::kPayCrypto, "checkout: crypto choice parsed"); { auto bogus = validate(std::string(kGoodOrder) + "&pay=free"); Check(!bogus.Ok(), "checkout: unknown payment choice rejected"); Check(bogus.errors.size() == 1 && bogus.errors[0].field == "pay", "checkout: the payment refusal hangs off the payment field"); } // Destinations the shop refuses. Well-formed, real country codes — the // refusal is policy, so it has to survive every spelling the form accepts, // and it must not spill onto other non-EU destinations. auto withCountry = [&](std::string_view cc) { return validate("email=a%40b.example&name=Ada&street=x&postal=1&city=y&country=" + std::string(cc)); }; Check(withCountry("NL").Ok(), "checkout: the home market sells"); Check(withCountry("CH").Ok() && withCountry("AU").Ok() && withCountry("HK").Ok() && withCountry("SG").Ok() && withCountry("RS").Ok() && withCountry("ME").Ok() && withCountry("AL").Ok() && withCountry("XK").Ok() && withCountry("GE").Ok(), "checkout: every cleared destination sells"); Check(!withCountry("JP").Ok() && !withCountry("NZ").Ok(), "checkout: destinations refuted on verification stay refused"); // The default is the point of an allow-list: uncleared, unknown and // never-considered codes all refuse without anyone listing them. Check(!withCountry("US").Ok(), "checkout: US refused"); Check(!withCountry("CA").Ok(), "checkout: CA refused"); Check(!withCountry("us").Ok(), "checkout: lowercase US refused too"); Check(!withCountry("DE").Ok() && !withCountry("GB").Ok() && !withCountry("NO").Ok() && !withCountry("TR").Ok(), "checkout: uncleared destinations refuse"); Check(!withCountry("XX").Ok(), "checkout: a syntactically valid code nobody has cleared refuses"); { auto us = withCountry("US"); Check(us.errors.size() == 1 && us.errors[0].field == "country", "checkout: refusal is a country error, nothing else"); Check(us.errors[0].message == Catcrafts::Form::kRegulatoryMessage, "checkout: refusal gives the regulatory reason"); Check(us.value.country == "US", "checkout: refused country echoed back"); } { // One sentence for every non-sanctions refusal, whatever the underlying // reason was — the buyer cannot act on the difference. auto de = withCountry("DE"); auto tr = withCountry("TR"); Check(de.errors.size() == 1 && tr.errors.size() == 1 && de.errors[0].message == Catcrafts::Form::kRegulatoryMessage && tr.errors[0].message == Catcrafts::Form::kRegulatoryMessage, "checkout: every uncleared destination gets the same sentence"); } // Sanctioned destinations: same gate, different sentence. The message has // to name the law rather than shop policy — a buyer told "Catcrafts does // not sell to Russia" would reasonably email to ask; one told the EU // forbids it knows nothing can be arranged. Check(!withCountry("RU").Ok(), "checkout: RU refused"); Check(!withCountry("BY").Ok(), "checkout: BY refused"); Check(!withCountry("KP").Ok(), "checkout: KP refused"); Check(!withCountry("ru").Ok(), "checkout: lowercase RU refused too"); { auto ru = withCountry("RU"); Check(ru.errors.size() == 1 && ru.errors[0].field == "country", "checkout: sanctions refusal is a country error, nothing else"); Check(ru.errors[0].message == Catcrafts::Form::kSanctionsMessage, "checkout: sanctions refusal names the law, not shop policy"); Check(ru.value.country == "RU", "checkout: sanctioned country echoed back"); } // Sanctions keep their own sentence: a buyer told the generic "email us and // ask" would waste their time on something no amount of paperwork can lift. Check(withCountry("RU").errors[0].message != Catcrafts::Form::kRegulatoryMessage, "checkout: sanctions do not collapse into the regulatory sentence"); // Parameter pollution against the order gate. Every refusal above reads its // field through Fields::Get, which takes the FIRST of a repeated pair, so // appending a second value cannot reopen a destination the first one closed // — kGoodOrder already carries country=nl, and the trailing RU is inert. // The same property protects the number the buyer is charged for. { auto polluted = validate(std::string(kGoodOrder) + "&country=RU"); Check(polluted.Ok(), "checkout: a trailing second country cannot displace the first"); Check(polluted.value.country == "NL", "checkout: the first country is the one validated and stored"); Check(validate(std::string(kGoodOrder) + "&quantity=2&quantity=99").value.quantity == 2, "checkout: a second quantity cannot raise what is charged"); } // The shipping refusals. These are templates rather than plain strings // because the buy page fills the same ones client-side, so the substitution // has to work on both {cc} and {n} — a template that silently kept its // placeholder would ship "up to {n} per order" to a real buyer. { const std::string none = NoShippingMessage("BR"); Check(none.find("BR") != std::string::npos && none.find("{cc}") == std::string::npos, "shipping copy: the uncovered-country message names the country"); const std::string heavy = TooHeavyMessage("JP", 3); Check(heavy.find("JP") != std::string::npos && heavy.find("3") != std::string::npos && heavy.find("{n}") == std::string::npos, "shipping copy: the too-heavy message names the country and the limit"); const std::string nofit = TooHeavyMessage("JP", 0); Check(nofit.find("JP") != std::string::npos && nofit.find("up to") == std::string::npos, "shipping copy: with nothing fitting it does not promise a quantity"); Check(FillShipMessage("{cc} {n} {cc}", "NL", 2) == "NL 2 NL", "shipping copy: every placeholder is filled, not just the first"); // Only the splittable refusal offers a way to order anyway — that // buyer's order works as several smaller ones. The other two are // final: what the carrier can't take, the shop doesn't ship, and a // refusal that invites hand-arranging would promise exactly the // ad-hoc export the shop decided against. Check(heavy.find("orders@catcrafts.net") != std::string::npos, "shipping copy: the splittable refusal names a human to email"); Check(none.find("orders@catcrafts.net") == std::string::npos && nofit.find("orders@catcrafts.net") == std::string::npos, "shipping copy: unshippable refusals are final, no workaround offered"); } // A rejected field must still come back, or the visitor has to retype the // one thing they got wrong — the fastest way to lose a submission. auto rejected = validate("email=notanemail&name=Ada&street=Main%201&postal=1&city=y&country=NLD"); Check(!rejected.Ok(), "checkout: invalid pair rejected"); Check(rejected.value.email == "notanemail", "checkout: invalid email echoed back"); Check(rejected.value.country == "NLD", "checkout: invalid country echoed back as typed"); Check(rejected.value.name == "Ada", "checkout: valid sibling field preserved"); // ── the euro-amount parser ──────────────────────────────────────── // Exact integer parsing for the one amount that ever arrives from a // client (the donation). Same no-floats rule as every money path. Check(ParseEuroAmountToMinor("25") == 2500, "amount: whole euros"); Check(ParseEuroAmountToMinor("12.50") == 1250, "amount: euros and cents"); Check(ParseEuroAmountToMinor("12,50") == 1250, "amount: comma decimal mark"); Check(ParseEuroAmountToMinor("2.5") == 250, "amount: one decimal is tenths, not cents"); Check(ParseEuroAmountToMinor("0.01") == 1, "amount: a single cent parses"); Check(ParseEuroAmountToMinor("10000") == 1000000, "amount: the ceiling parses"); Check(!ParseEuroAmountToMinor("").has_value(), "amount: empty rejected"); Check(!ParseEuroAmountToMinor("-5").has_value(), "amount: negative rejected"); Check(!ParseEuroAmountToMinor("1e3").has_value(), "amount: exponent rejected"); Check(!ParseEuroAmountToMinor("1.234").has_value(), "amount: third decimal rejected"); Check(!ParseEuroAmountToMinor("1.2.3").has_value(), "amount: two marks rejected"); Check(!ParseEuroAmountToMinor(".50").has_value(), "amount: bare fraction rejected"); Check(!ParseEuroAmountToMinor("25 EUR").has_value(), "amount: trailing text rejected"); Check(!ParseEuroAmountToMinor("12345678901").has_value(), "amount: oversized rejected"); // ── donation validation ─────────────────────────────────────────── // Its own validator, not checkout with fields waived: nothing ships, so // no address is even asked for, and email is optional — the order page's // capability URL is already the receipt. auto donate = [](std::string_view body) { return ValidateDonation(*ParseUrlEncoded(body)); }; { auto ok = donate("amount=25"); Check(ok.Ok(), "donation: an amount alone is a complete submission"); Check(ok.value.amountMinor == 2500, "donation: the amount lands in cents"); Check(ok.value.quantity == 1, "donation: quantity is always one"); Check(ok.value.email.empty(), "donation: no email means no email"); } Check(donate("amount=12.50&email=a%40b.example").Ok(), "donation: an email may ride along for the confirmation"); Check(donate("amount=12.50&email=a%40b.example").value.amountMinor == 1250, "donation: cents survive alongside the email"); Check(!donate("amount=25&email=nonsense").Ok(), "donation: a present-but-bad email is still refused"); Check(!donate("email=a%40b.example").Ok(), "donation: no amount, no donation"); Check(!donate("amount=nonsense").Ok(), "donation: an unparseable amount is refused"); Check(!donate("amount=0.99").Ok(), "donation: below the €1 floor refused"); Check(donate("amount=1").Ok(), "donation: the €1 floor itself is welcome"); Check(donate("amount=10000").Ok(), "donation: the €10,000 ceiling itself is welcome"); Check(!donate("amount=10000.01").Ok(), "donation: past the ceiling refused"); { // Rejected means rejected: the out-of-range figure must not survive // into value, because value is what the handler charges if anything // upstream ever ignores Ok(). auto big = donate("amount=99999"); Check(big.value.amountMinor == 0, "donation: a refused amount never reaches the record"); Check(big.errors.size() == 1 && big.errors[0].field == "amount", "donation: the refusal hangs off the amount field"); } // The same honeypot as checkout, reported just as namelessly. { auto pot2 = donate("amount=25&website=spam"); Check(!pot2.Ok(), "donation: honeypot rejects"); Check(pot2.errors.size() == 1 && pot2.errors[0].field.empty() && pot2.errors[0].message == "Submission rejected.", "donation: honeypot failure does not name the trap"); } // The payment choice, same rules as checkout. Check(donate("amount=25&pay=crypto").value.payChoice == Catcrafts::Form::kPayCrypto, "donation: crypto choice parsed"); Check(!donate("amount=25&pay=free").Ok(), "donation: unknown payment choice rejected"); // First-wins duplicates protect the amount exactly as they protect // checkout's quantity: a trailing second value cannot raise the charge. Check(donate("amount=25&amount=9999").value.amountMinor == 2500, "donation: a second amount cannot displace the first"); if (failures != 0) { std::println(std::cerr, "{} check(s) failed", failures); return 1; } return 0; }