-
Notifications
You must be signed in to change notification settings - Fork 1.8k
fix: accept invalid headers with a space #1953
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Make behavior consistent with net/http by allowing header keys and trailers containing spaces without canonicalizing them
I think the fuzzy test run failure is independent of my changes since the previous commit passed. The latest commit is a refactor to fix linter problems. In addition, the failed test - |
No, what the fuzzer found is caused by your changes. Here is the test case from the fuzzer that passes on master but panics on your branch: func TestReadLimitBodyExample(t *testing.T) {
body := []byte{0xa1, 0xfd, 0xdf, 0x77, 0x20, 0x35, 0xa, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x66, 0x65, 0x72, 0x2d, 0x45, 0x6e, 0x63, 0x6f, 0x64, 0x69, 0x6e, 0x67, 0x3a, 0xb0, 0xa, 0xa, 0x30, 0x52, 0xd, 0xa, 0x3a, 0x3a, 0xa, 0x20, 0xa, 0x20, 0x3a, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0xa, 0x20, 0xa, 0x20, 0x89, 0x3a, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0xa, 0x20, 0xa, 0x20, 0x89, 0x3a, 0xa, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0xa, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0xa, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0xa, 0x20, 0xa, 0x20, 0x3a, 0xa, 0x20, 0xa, 0x20, 0xa, 0x20, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0xa, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0xa, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0xa, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0x20, 0x20, 0x3a, 0x3a, 0xa, 0xa, 0x20, 0x20, 0xa, 0x20, 0xa, 0x20, 0x3a, 0x20, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x20, 0x3a, 0x20, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2e}
res := AcquireResponse()
defer ReleaseResponse(res)
_ = res.ReadLimitBody(bufio.NewReader(bytes.NewReader(body)), 24922)
} |
This bug is caused by two issues:
I am trying to minimize the test you provided and write it back as a unit test. |
Thanks! |
Fix #1917
Make behavior consistent with
net/http
by allowing header keys and trailers containing spaces without canonicalizing them.Change the behavior of
headerScanner.next()
. When parsing headers, we do not normalize the header key.In addition, before normalizing the key, check whether the key contains a space. If it does, disable normalization forcibly.