pjfanning opened a new pull request, #1257: URL: https://github.com/apache/pekko-http/pull/1257
### Motivation The chunked-body parser tolerates whitespace after the chunk-size digits (illegal per RFC 7230 but seen in the wild — see #1812), but the `WSP` arm recursed with the same accumulated `size` and then let parsing continue with the next character, **including a further hex digit**: ```scala case c if CharacterClasses.HEXDIG(c) => parseSize(cursor + 1, size * 16 + CharUtils.hexValue(c)) ... case c if CharacterClasses.WSP(c) => parseSize(cursor + 1, size) // see issue #1812 ``` So a chunk size of `5 0` was parsed as `0x50` = **80 bytes**, whereas a proxy that stops at the space reads **5**. That size discrepancy is a request-smuggling primitive when Pekko HTTP sits behind such a proxy. The `#1812` comment intended only *trailing* whitespace tolerance; the code skipped *interior* whitespace as well. The `WSP` arm also lacked a `cursor > offset` guard, so a size field of only spaces parsed as 0. ### Modification Thread a `sawWhitespace` flag through `parseSize`: - Once whitespace has been seen, the hex-digit accumulation arm is guarded off (`HEXDIG(c) && !sawWhitespace`), so a subsequent hex digit falls through to the illegal-character case — only more whitespace or a terminator (`;`, CRLF, LF) may follow. - The `WSP` arm now requires `cursor > offset`, so leading whitespace before any digit is rejected too. Trailing whitespace after a complete size is unchanged (still tolerated). ### Result `5 0` and ` 5` are now rejected with `Illegal character '...' in chunk start`, while `5<SP><SP>\r\n` (trailing BWS) still parses. Pekko HTTP and a fronting proxy can no longer disagree on the chunk size. ### Tests - `sbt "http-core/testOnly org.apache.pekko.http.impl.engine.parsing.RequestParserCRLFSpec org.apache.pekko.http.impl.engine.parsing.RequestParserLFSpec"` — pass (116 tests). Two new tests reject `5 0` (interior whitespace) and ` 5` (leading whitespace); the existing "incorrect but harmless whitespace after chunk size" (#1812) test still passes. Verified the interior-whitespace test fails with the fix stashed (`5 0` parses as 80 bytes). - `sbt http-core/mimaReportBinaryIssues` — pass (internal `impl.engine.parsing` change, no public API). - Native `scalafmt` on the changed files — clean. ### References Refs #1812 - narrows the whitespace tolerance to trailing whitespace only 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
