DO NOT REPLY TO THIS EMAIL, BUT PLEASE POST YOUR BUG· RELATED COMMENTS THROUGH THE WEB INTERFACE AVAILABLE AT <http://issues.apache.org/bugzilla/show_bug.cgi?id=43882>. ANY REPLY MADE TO THIS MESSAGE WILL NOT BE COLLECTED AND· INSERTED IN THE BUG DATABASE.
http://issues.apache.org/bugzilla/show_bug.cgi?id=43882 Summary: Multiple Transfer-Encodings in requests handled improperly Product: Apache httpd-2 Version: 2.2.6 Platform: Other OS/Version: other Status: NEW Severity: normal Priority: P2 Component: Core AssignedTo: [email protected] ReportedBy: [EMAIL PROTECTED] Requests using multiple transfer encodings are handled as if they had no Transfer-Encoding header and no entity body. For example: POST / HTTP/1.1 Transfer-Encoding: gzip,chunked [more headers] [body] Here Apache would treat [body] as if it was the beginning of a new request. This is incorrect, RFC 2616 allows requests of this kind and recommends to respond with Not Implemented if the Transfer-Encoding is not understood; the alternative would be to treat it as if it had "Transfer-Encoding: chunked" and let request handlers remove the other transfer encodings if they so wish though this would probably require some opt-in feature to avoid feeding garbage to unsuspecting handlers. The specific code seems to tbe in http_filters.c ap_http_filter(...) which only goes into BODY_CHUNK mode if "chunked" is the only encoding. There also does not seem to be lexical checking performed on the value. RFC 2616 requires that "chunk" occurs at most once in the value and if it does, occurs at the end of the list. Apache should probably respond with Bad Request if that is not the case (to avoid confusing request handlers taking care of the decoding if that is made an option). -- Configure bugmail: http://issues.apache.org/bugzilla/userprefs.cgi?tab=email ------- You are receiving this mail because: ------- You are the assignee for the bug, or are watching the assignee. --------------------------------------------------------------------- To unsubscribe, e-mail: [EMAIL PROTECTED] For additional commands, e-mail: [EMAIL PROTECTED]
