Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

style: re-verbosify HTTP commentary #3273

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

style: re-verbosify HTTP commentary #3273

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
13 changes: 9 additions & 4 deletions gunicorn/http/message.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -178,16 +178,17 @@ def set_body_reader(self):
elif name == "TRANSFER-ENCODING":
# T-E can be a list
# https://datatracker.ietf.org/doc/html/rfc9112#name-transfer-encoding
vals = [v.strip() for v in value.split(',')]
for val in vals:
te_split_at_comma = [v.strip() for v in value.split(',')]
# N.B. we might have split in the middle of quoted transfer-parameter
for val in te_split_at_comma:
if val.lower() == "chunked":
# DANGER: transfer codings stack, and stacked chunking is never intended
if chunked:
raise InvalidHeader("TRANSFER-ENCODING", req=self)
chunked = True
elif val.lower() == "identity":
# does not do much, could still plausibly desync from what the proxy does
# safe option: nuke it, its never needed
# safe option: reject, its never needed
if chunked:
raise InvalidHeader("TRANSFER-ENCODING", req=self)
elif val.lower() in ('compress', 'deflate', 'gzip'):
Expand All @@ -196,18 +197,22 @@ def set_body_reader(self):
raise InvalidHeader("TRANSFER-ENCODING", req=self)
self.force_close()
else:
# DANGER: this not only rejects unknown encodings, but also
# leftovers from not splitting at transfer-coding boundary
raise UnsupportedTransferCoding(value)

if chunked:
# two potentially dangerous cases:
# a) CL + TE (TE overrides CL.. only safe if the recipient sees it that way too)
# b) chunked HTTP/1.0 (always faulty)
if self.version < (1, 1):
# framing wonky, see RFC 9112 Section 6.1
# framing is faulty
# https://datatracker.ietf.org/doc/html/rfc9112#section-6.1-16
raise InvalidHeader("TRANSFER-ENCODING", req=self)
if content_length is not None:
# we cannot be certain the message framing we understood matches proxy intent
# -> whatever happens next, remaining input must not be trusted
# https://datatracker.ietf.org/doc/html/rfc9112#section-6.1-15
raise InvalidHeader("CONTENT-LENGTH", req=self)
self.body = Body(ChunkedReader(self, self.unreader))
elif content_length is not None:
Expand Down
Loading