arturobernalg opened a new pull request, #733: URL: https://github.com/apache/httpcomponents-core/pull/733
A message with both headers may indicate request smuggling or response splitting and "ought to be handled as an error" (RFC 9112 section 6.1). `DefaultContentLengthStrategy` let `Transfer-Encoding` win, and the message kept both headers. Against real servers on master, a request with `Content-Length: 6`, `Transfer-Encoding: chunked` and a pipelined GET: the classic server answered 200 and the handler saw both headers; the async server served both requests. A classic client accepted a response carrying both headers. `determineLength` now throws `ProtocolException` when both are present: the server answers 400 with `Connection: close`, the handler is not called, and the client fails the response. The async server did not answer a message whose framing could not be determined, it dropped the connection (for instance for `Transfer-Encoding: gzip`). A small package-private hook in the HTTP/1 duplexer lets `ServerHttp1StreamDuplexer` terminate the exchange as it does for parse errors, so it now responds as the classic server does, 400 here and 501 for an unsupported coding. The "before" figures for the gzip case come from a raw-socket reproducer, the new tests were not run against the unmodified tree. Tests: unit tests for the strategy and raw-socket integration tests for the classic and the async server, over plain HTTP and TLS. Compatibility: both headers together are a protocol violation that well-known clients and servers do not emit, but I have not surveyed real ones. The check also applies to responses and to messages written by a handler or proxy that sets both headers, which would now get a `ProtocolException`; such a proxy would need to drop Content-Length when forwarding. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
