Parsing issue of Duplicate Chunked Transfer-Encoding

[TUO-Wu]

Describe the bug

Hello, I may have found a bug in aiohttp's parsing of HTTP requests with duplicate chunked Transfer-Encoding. RFC 9112 says these:

A sender MUST NOT apply the chunked transfer coding more than once to a message body (i.e., chunking an already chunked message is not allowed).

A server that receives a request message with a transfer coding it does not understand SHOULD respond with 501 (Not Implemented).

Although the RFC only restricts the sender (A sender MUST NOT apply the chunked transfer coding more than once to a message body), this should imply that duplicate chunked Transfer-Encoding is incorrect. The server may reject the request with 501 (Not Implemented) or 400 (Bad Request). However, aiohttp does not reject such request.

To Reproduce

1. Run aiohttp.
2. Send the following request to aiohttp.

POST / HTTP/1.1\r\n
Host: victim.com\r\n
Transfer-Encoding: chunked, chunked\r\n
\r\n
0\r\n
\r\n

3. Aiohttp does not reject:

$ echo -ne "POST / HTTP/1.1\r\nHost: victim.com\r\nTransfer-Encoding: chunked, chunked\r\n\r\n0\r\n\r\n" | nc 172.18.0.8 80
HTTP/1.1 200 OK
Content-Type: text/plain; charset=utf-8
Content-Length: 161
Date: Thu, 20 Mar 2025 12:12:13 GMT
Server: Python/3.10 aiohttp/4.0.0a2.dev0

{"headers":[["SG9zdA==","dmljdGltLmNvbQ=="],["VHJhbnNmZXItRW5jb2Rpbmc=","Y2h1bmtlZCwgY2h1bmtlZA=="]],"body":"","method":"UE9TVA==","uri":"Lw==","version":"MS4x"}

Expected behavior

The server may reject the request with 501 (Not Implemented) or 400 (Bad Request).

Logs/tracebacks

/

Python Version

$ python --version
Python/3.10

aiohttp Version

$ python -m pip show aiohttp
aiohttp/4.0.0a2.dev0

multidict Version

$ python -m pip show multidict
/

propcache Version

$ python -m pip show propcache
/

yarl Version

$ python -m pip show yarl
/

OS

Ubuntu 11.4.0-1ubuntu1~22.04

Related component

Server

Additional context

No response

Code of Conduct

• [x] I agree to follow the aio-libs Code of Conduct

[Dreamsorcerer]

A server that receives a request message with a transfer coding it does not understand SHOULD respond with 501 (Not Implemented).

We do understand the chunked coding, so this is not relevant.

I believe expected behaviour is either:

• We parse it as chunked once and pop one of the chunked codes from the header (which is close to what happens right now).
• We parse it as chunked twice and produce a parse error.

It probably makes sense to end up with a parse error in this context, so feel free to create a PR to change that, but I feel this is unlikely to get prioritised by a maintainer as the current approach is still a valid approach.