Skip to content

reject unrecognized Transfer-Encoding in httpGetLength - #208

Open
tanjiroK-coder wants to merge 1 commit into
OpenPrinting:masterfrom
tanjiroK-coder:http-transfer-encoding-strict
Open

tanjiroK-coder wants to merge 1 commit into
OpenPrinting:masterfrom
tanjiroK-coder:http-transfer-encoding-strict

Conversation

@tanjiroK-coder

Copy link
Copy Markdown
Contributor

Transfer-Encoding not recognized as chunked falls back to Content-Length

_httpUpdate keeps trailing whitespace on header values and httpGetLength only matches a Transfer-Encoding of exactly chunked, so Transfer-Encoding: chunked (trailing space) or two Transfer-Encoding headers (joined to chunked, chunked) are framed by Content-Length instead. A front end that follows RFC 9112 sees a chunked body, while a libcups server (ippeveprinter, PAPPL) reads Content-Length bytes and parses the rest of the chunk as the next request on the connection (TE.CL request smuggling).

Repro against master: POST with Transfer-Encoding: chunked , Content-Length: 4 and a chunk containing GET /smuggled HTTP/1.1. The body comes back as the 4 bytes 23\r\n and the next httpReadRequest returns GET /smuggled. With this change trailing OWS is trimmed (RFC 9110 section 5.5) and any other Transfer-Encoding is treated as a bad length rather than ignored (RFC 9112 section 6.1). The new testhttp cases fail 3 of 4 on master and pass here; the tools tests still pass.

@michaelrsweet michaelrsweet self-assigned this Nov 7, 2026
@michaelrsweet michaelrsweet added the investigating Investigating the issue label Nov 7, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

investigating Investigating the issue

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants