search

openwrt / uhttpd

[MIRROR] Tiny HTTP server
https://git.openwrt.org/?p=project/uhttpd.git;
10 stars 6 forks source link

uhttpd doesn't strip spaces and tabs from the ends of header values #11

Open kenballus opened 3 months ago

kenballus commented 3 months ago

The HTTP RFCs specify that spaces and tabs on the beginnings and ends of header values are to be stripped. uhttpd correctly handles this for the beginnings of header values, but not for the ends.

For example, if you send the following request to uhttpd:

GET / HTTP/1.1\r\n
Host: whatever\r\n
Test: \t abc \t \r\n
\r\n

...it sees a Test header value of abc \t, but it should see abc.