http_parser: Follow RFC-7230 Sec 3.2.4

RFC-7230 Sec 3.2.4 expressly forbids line-folding in header
field-names.

This change no longer allows obsolete line-folding between the
header field-name and the colon. If HTTP_PARSER_STRICT is unset,
the parser still allows space characters.

Reviewed-By: Fedor Indutny <fedor@indutny.com>
make-http-max-header-size-gyp-configurable
Jeff Pinner 10 years ago committed by Fedor Indutny
parent 11ecb42061
commit 0b43367131

@ -1390,18 +1390,6 @@ size_t http_parser_execute (http_parser *parser,
break; break;
} }
if (ch == CR) {
parser->state = s_header_almost_done;
CALLBACK_DATA(header_field);
break;
}
if (ch == LF) {
parser->state = s_header_field_start;
CALLBACK_DATA(header_field);
break;
}
SET_ERRNO(HPE_INVALID_HEADER_TOKEN); SET_ERRNO(HPE_INVALID_HEADER_TOKEN);
goto error; goto error;
} }

@ -3476,6 +3476,13 @@ main (void)
test_simple(buf, HPE_INVALID_METHOD); test_simple(buf, HPE_INVALID_METHOD);
} }
// illegal header field name line folding
test_simple("GET / HTTP/1.1\r\n"
"name\r\n"
" : value\r\n"
"\r\n",
HPE_INVALID_HEADER_TOKEN);
const char *dumbfuck2 = const char *dumbfuck2 =
"GET / HTTP/1.1\r\n" "GET / HTTP/1.1\r\n"
"X-SSL-Bullshit: -----BEGIN CERTIFICATE-----\r\n" "X-SSL-Bullshit: -----BEGIN CERTIFICATE-----\r\n"

Loading…
Cancel
Save