Improper handling of empty `Content-Length` headers

GaloisInc / daedalus

The Daedalus data description language

BSD 3-Clause "New" or "Revised" License

63 stars 11 forks source link

Improper handling of empty `Content-Length` headers #340

Closed kenballus closed 11 months ago

kenballus commented 1 year ago

HTTP-1.1.ddl currently parses Content-Length: \r\n as though it were Content-Length: 0\r\n. The spec says this:

Content-Length = 1*DIGIT

Thus, I would expect an empty CL header should fail to parse. Most web servers refuse to parse empty CL headers. Unless there's something I missed in the spec, I think the grammar should be updated to reject messages containing these invalid headers.

yav commented 11 months ago

@kenballus good catch. I just pushed a version that should fix this, and a few related issues:

I made the same change for the size of chunk, which is in hex, but I assume shouldn't treat empty as 0 either
I made bother of these sizes fail if they would overflowed a 64-bit number, previously they'd just overflow, which is quite wrong. Btw, this might be a good thing to test on other servers, if you haven't already.