deno
deno copied to clipboard
denoland
HTTP/1.1: Chunked message bodies incorrectly terminated on `\r\n\r\n` instead of `0\r\n\r\n`
Version
deno 1.44.4 (debug, x86_64-unknown-linux-gnu)
v8 12.7.224.9
typescript 5.5.2
Description
Deno HTTP/1.1 servers allow chunked message bodies to be terminated by \r\n\r\n alone (i.e., not 0\r\n\r\n).
To reproduce
- Run a Deno HTTP server that echos back message bodies, such as this one.
- Send it a chunked request that's missing the final chunk-size, and extract the echoed message body:
printf 'POST / HTTP/1.1\r\nHost: whatever\r\nTransfer-Encoding: chunked\r\n\r\n1\r\nZ\r\n\r\n\r\n' \
| timeout 1 nc localhost 80 \
| grep '"body"' \
| jq '.["body"]' \
| xargs echo \
| base64 -d \
| xxd
- Observe that Deno interprets the message body as
Z.
00000000: 5a Z
Suggested fix
Respond 400 to requests with invalid chunked message bodies. This is what nearly all other HTTP implementations do, including AIOHTTP, Apache httpd, Cheroot, FastHTTP, Go net/http, Gunicorn, H2O, HAProxy, Hypercorn, Jetty, Lighttpd, Nginx, Node.js, Puma, Tomcat, Twisted, Uvicorn, and WEBrick do.
