The GitHub Actions job "Validate and test" on pekko-http.git/raw-request-uri-validation has succeeded. Run started by GitHub user pjfanning (triggered by pjfanning).
Head commit for run: 9c0908813cc50b45b2bd4fd47250648c5b39d134 / PJ Fanning <[email protected]> Require a custom HTTP method name to be a token Motivation: The request line has two application-supplied parts, and the previous commit validated one of them. `HttpMethod.custom` checked only that the name was non-empty, and the HTTP/1.1 renderer writes it into the request line as given (`r ~~ method ~~ ' '`), so a name carrying a space, CR or LF ended the method early and let the rest be read as the target, the protocol or a header. Over HTTP/2 the same name becomes `:method`, where the HPACK guard drops a field carrying CR, LF or NUL and sends a malformed request. Modification: Require the name to be a token (RFC 9110 section 5.6.2) in both `custom` overloads that construct a method, using the parser's own `tchar` class; the single-argument overload and the Java `HttpMethods.custom` delegate to them. The server never constructs a method from wire bytes -- it looks the parsed token up among the registered custom methods -- so only application code is affected. Document the constraint at the custom method section of the model docs, and correct the HTTP/2 renderer's comment on `Raw-Request-URI`, which still said the value was taken on trust. Result: Neither part of the request line an application can supply can carry a character that would corrupt it, and neither can reach the HPACK guard's silent drop of a pseudo-header. Tests: - `HttpMethodsSpec` gains two cases: every tchar and two real-world custom methods are accepted; a request-line injection, CR+LF, tab, NUL, DEL, `/`, `:`, a non-ASCII character, the empty string and the five-argument overload are each rejected, and the message names the offending character. The rejecting case fails with the validation reverted. - sbt "http-core/testOnly ...HttpMethodsSpec ...HeaderSpec ...RequestParserCRLFSpec ...HttpHeaderSpec ...RequestRendererSpec" - 191 pass (the last three register custom methods). - sbt "http-core/mimaReportBinaryIssues" - pass. - native scalafmt clean. References: Refs #1280 Report URL: https://github.com/apache/pekko-http/actions/runs/34592321621 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
