Fix race condition in unregister_resource cache invalidation

Move route cache invalidation inside registered_resources_mutex lock
in unregister_resource() to prevent use-after-free when threads
retrieve cached resource pointers during unregistration.

Also invalidate route cache on register_resource() for correctness
when resources are dynamically registered at runtime.

Add threading model documentation to http_request lazy caching.

Author: etr

src/httpserver/http_request.hpp

@@ -427,7 +427,11 @@ class http_request {
      std::string_view get_connection_value(std::string_view key, enum MHD_ValueKind kind) const;
      const http::header_view_map get_headerlike_values(enum MHD_ValueKind kind) const;
 
-     // Cache certain data items on demand so we can consistently return views
+     // http_request objects are owned by a single connection and are not
+    // shared across threads. Lazy caching (path_pieces, args, etc.) is
+    // safe without synchronization under this invariant.
+
+    // Cache certain data items on demand so we can consistently return views
      // over the data. Some things we transform before returning to the user for
      // simplicity (e.g. query_str, requestor), others out of necessity (arg unescaping).
      // Others (username, password, digested_user) MHD returns as char* that we need

src/webserver.cpp

@@ -221,9 +221,12 @@ bool webserver::register_resource(const std::string& resource, http_resource* hr
         if (idx.is_regex_compiled()) {
             registered_resources_regex.insert(map<details::http_endpoint, http_resource*>::value_type(idx, hrm));
         }
+        registered_resources_lock.unlock();
+        invalidate_route_cache();
+        return true;
     }
 
-    return result.second;
+    return false;
 }
 
 bool webserver::start(bool blocking) {
@@ -402,12 +405,20 @@ void webserver::unregister_resource(const string& resource) {
     // family does not matter - it just checks the url_normalized anyhow
     details::http_endpoint he(resource, false, true, regex_checking);
     std::unique_lock registered_resources_lock(registered_resources_mutex);
+
+    // Invalidate cache while holding registered_resources_mutex to prevent
+    // any thread from retrieving dangling resource pointers from the cache
+    // after we erase from the resource maps.
+    {
+        std::lock_guard<std::mutex> cache_lock(route_cache_mutex);
+        route_cache_list.clear();
+        route_cache_map.clear();
+    }
+
     registered_resources.erase(he);
     registered_resources.erase(he.get_url_complete());
     registered_resources_str.erase(he.get_url_complete());
     registered_resources_regex.erase(he);
-    registered_resources_lock.unlock();
-    invalidate_route_cache();
 }
 
 void webserver::ban_ip(const string& ip) {