grizzly icon indicating copy to clipboard operation
grizzly copied to clipboard

Enhances validation of HTTP header names

Open carryel opened this issue 5 months ago • 0 comments

RFC 9110 specifies that only the following characters are allowed within header names:

field-name     = token
token          = 1*tchar
tchar          = "!" / "#" / "$" / "%" / "&" / "'" / "*"
                 / "+" / "-" / "." / "^" / "_" / "`" / "|" / "~"
                 / DIGIT / ALPHA
                 ; any VCHAR, except delimiters

Grizzly HTTP does not enforce this rule.

1. I think Grizzly should follow this convention for header names.

Consider the following payload: GET / HTTP/1.1\r\nHost: a\r\nIgnore\r\nMy-Header: m\r\n\r\n.

Grizzly's HTTP parser sees this payload as two requests, like so:

GET / HTTP/1.1\r\n
Host: a\r\n
Ignore\r\nMy-Header: m\r\n
\r\n

However, some HTTP parsers (e.g. Nginx, Libsoup, cpp-httplib) see only request, like so:

GET / HTTP/1.1\r\n
Host: a\r\n
Ignore\r\n
My-Header: m\r\n
\r\n

This happens because these parsers either ignore or permissively parse field-lines with no ':', so they see a My-Header header where Grizzly didn't.

2. I think it would be good for compatibility if, when parsing headers, it ignored incomplete field-lines like other parsers do.

carryel avatar Sep 13 '24 18:09 carryel