as the default filename checks should catch them
as the default filename checks should catch them. Note that "Host: ." is also caught by default due to the check for /./
static int http_parse_host(struct Con *con, struct Httpd_req_data *req){  Vstr_base *data = con->evnt->io_r;  size_t op_pos = req->path_pos;  size_t op_len = req->path_len;    /* check for absolute URIs */  if (VIPREFIX(data, op_pos, op_len, "http://"))  { /* ok, be forward compatible */    size_t tmp = CLEN("http://");        op_len -= tmp; op_pos += tmp;    tmp = vstr_srch_chr_fwd(data, op_pos, op_len, '/');    if (!tmp)    {      HTTP__HDR_SET(req, host, op_pos, op_len);      op_len = 1;      --op_pos;    }    else    { /* found end of host ... */      size_t host_len = tmp - op_pos;            HTTP__HDR_SET(req, host, op_pos, host_len);      op_len -= host_len; op_pos += host_len;    }    assert(VPREFIX(data, op_pos, op_len, "/"));  }  /* HTTP/1.1 requires a host -- allow blank hostnames */  if (req->ver_1_1 && !req->http_hdrs->hdr_host->pos)    return (FALSE);    if (req->http_hdrs->hdr_host->len)  { /* check host looks valid ... header must exist, but can be empty */    size_t pos = req->http_hdrs->hdr_host->pos;    size_t len = req->http_hdrs->hdr_host->len;    size_t tmp = 0;    /* leaving out most checks for ".." or invalid chars in hostnames etc.       as the default filename checks should catch them     */    /*  Check for Host header with extra / ...     * Ie. only allow a single directory name.     *  We could just leave this (it's not a security check, /../ is checked     * for at filepath time), but I feel like being anal and this way there     * aren't multiple urls to a single path. */    if (vstr_srch_chr_fwd(data, pos, len, '/'))      return (FALSE);    if (http__chk_single_crlf(data, pos, len))      return (FALSE);    if ((tmp = vstr_srch_chr_fwd(data, pos, len, ':')))    { /* NOTE: not sure if we have to 400 if the port doesn't match       * or if it's an "invalid" port number (Ie. == 0 || > 65535) */      len -= tmp - pos; pos = tmp;      /* if it's port 80, pretend it's not there */      if (VEQ(data, pos, len, ":80") || VEQ(data, pos, len, ":"))        req->http_hdrs->hdr_host->len -= len;      else      {        len -= 1; pos += 1; /* skip the ':' */        if (vstr_spn_cstr_chrs_fwd(data, pos, len, "0123456789") != len)          return (FALSE);      }    }  }  if (http__chk_single_crlf(data, op_pos, op_len))    return (FALSE);    /* uri#fragment ... craptastic clients pass this and assume it is ignored */  if (req->policy->remove_url_frag)    op_len = vstr_cspn_cstr_chrs_fwd(data, op_pos, op_len, "#");  /* uri?foo ... This is "ok" to pass, however if you move dynamic   * resources to static ones you need to do this */  if (req->policy->remove_url_query)    op_len = vstr_cspn_cstr_chrs_fwd(data, op_pos, op_len, "?");    req->path_pos = op_pos;  req->path_len = op_len;    return (TRUE);}