pjfanning opened a new pull request, #1290: URL: https://github.com/apache/pekko-http/pull/1290
cherry pick 7e39060b6643b1a0490fd34cf22de7a5c99f5dd2 #1257 Motivation: The chunk-size parser tolerates whitespace after the size digits (illegal per the spec but seen in the wild, see #1812), but the `WSP` arm recursed with the same accumulated size and then let parsing continue with the next character — including a further hex digit. So a chunk size such as `5 0` was read as `0x50` = 80 bytes, while a proxy that stops at the space reads 5. That discrepancy is a request- smuggling primitive when Pekko HTTP sits behind such a proxy. The comment referencing #1812 intended only trailing whitespace; the implementation skipped interior whitespace too. The `WSP` arm also had no `cursor > offset` guard, so a size field of only spaces parsed as 0. Modification: Thread a `sawWhitespace` flag through `parseSize`. Once whitespace has been seen, a hex digit no longer matches the accumulation arm and falls through to the illegal-character case, so only more whitespace or a terminator may follow. Guard the `WSP` arm with `cursor > offset` so leading whitespace (before any digit) is rejected as well. Result: Trailing whitespace after the chunk size is still tolerated, but whitespace between size digits, and leading whitespace, are rejected with "Illegal character '...' in chunk start" — Pekko HTTP and a fronting proxy can no longer disagree on the chunk size. Tests: - sbt "http-core/testOnly org.apache.pekko.http.impl.engine.parsing.RequestParserCRLFSpec org.apache.pekko.http.impl.engine.parsing.RequestParserLFSpec" - pass (116 tests); two new tests reject `5 0` (interior whitespace) and ` 5` (leading whitespace), and the existing "incorrect but harmless whitespace after chunk size" test still passes. Verified the interior-whitespace test fails with the fix stashed (`5 0` parses as 80 bytes). - sbt http-core/mimaReportBinaryIssues - pass (internal impl.engine.parsing change, no public API). References: Refs #1812 - narrows the whitespace tolerance to trailing whitespace only -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
