arturobernalg opened a new pull request, #732: URL: https://github.com/apache/httpcomponents-core/pull/732
The name of a received header was taken as is, up to the colon. Against real classic and async servers, master answered `200 OK` and exposed the names `Foo Bar`, `X\x01Y`, `Foo\x7f`, `Foo\x09Bar` and `Foo;x`. A recipient that parses names differently, such as a proxy in front of or behind HttpCore, can be made to disagree with it about which header was sent. `BufferedHeader` and `BasicLineParser` now reject a name that is not a `token` (RFC 9110 section 5.6.2) with the `ParseException` they already throw for a malformed header, which both message parsers turn into a 400 or a failed message. The check is one pass over the name. With the change the same requests get `400 Bad Request` and `X-Good_1.a` still gets 200. Whitespace before the colon and obs-fold are handled as before. Compatibility: a peer that sends names with characters such as `@`, `[` or spaces now gets a 400 from a server, and a client now fails a response carrying such a name, where it used to be accepted. Dropping the offending header instead of failing the message on the lax parser would be the alternative. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
