BUG/MEDIUM: h1: Reject empty Transfer-encoding header
The Transfer-Encoding headers list the transfer coding that have been
applied to the content in order to form the message body. It is a list of
tokens. And as specified by RFC 9110, a token cannot be empty. When several
coding names are specify as a comma-separated value, this case is properly
handled and an error is triggered. However, an empty header value will just
be skipped and no error is triggered. This could be an issue with some buggy
servers.
Now, empty Transfer-Encoding header are rejected too.
This patch must be backported as far as 2.6.
(cherry picked from commit 4a2dd6f3777959187565edd79475091e155e2161)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit 276c0ce8e0cd9a9f9235eda8eeaac1628e135b2f)
Signed-off-by: Willy Tarreau <w@1wt.eu>
(cherry picked from commit 767b68e36728831df36b39e08698d9cf965654b0)
Signed-off-by: Willy Tarreau <w@1wt.eu>
diff --git a/src/h1.c b/src/h1.c
index f4fb742..12e6ed9 100644
--- a/src/h1.c
+++ b/src/h1.c
@@ -129,6 +129,10 @@
char *e, *n;
struct ist word;
+ /* Reject empty header */
+ if (istptr(value) == istend(value))
+ goto fail;
+
h1m->flags |= H1_MF_XFER_ENC;
word.ptr = value.ptr - 1; // -1 for next loop's pre-increment