From 3003aaf9acd9983d336e9b47e1961f7527ab72d4 Mon Sep 17 00:00:00 2001
From: Oleg Olivson <o.olivson@falconvsystems.com>
Date: Wed, 22 Jan 2025 14:18:10 +0100
Subject: [PATCH] fix: harden server error handling

---
 server.go | 5 +++--
 util.go   | 8 +++++++-
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/server.go b/server.go
index 264263d..90ef780 100644
--- a/server.go
+++ b/server.go
@@ -175,8 +175,9 @@ func (srv *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		w.Write([]byte(srv.Ver))
 		return
 	case ".well-known":
-		srv.serveStaticRoute(w, r)
-		return
+		if srv.serveStaticRoute(w, r) {
+			return
+		}
 	case "restconf":
 		op2, p := shift(p, '/')
 		r.URL = p
diff --git a/util.go b/util.go
index fca47cf..83b6a4c 100644
--- a/util.go
+++ b/util.go
@@ -3,6 +3,7 @@ package restconf
 import (
 	"bytes"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"net/url"
@@ -76,7 +77,12 @@ func handleErr(compliance ComplianceOptions, err error, r *http.Request, w http.
 	}
 	fc.Debug.Printf("web request error [%s] %s %s", r.Method, r.URL, err.Error())
 	msg := err.Error()
-	code := fc.HttpStatusCode(err)
+	var code int
+	if errors.Is(err, ErrBadAddress) {
+		code = 400
+	} else {
+		code = fc.HttpStatusCode(err)
+	}
 	if !compliance.SimpleErrorResponse {
 		errResp := errResponse{
 			Type:    "protocol",