Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix Content-Length and Transfer-Encoding problems #2518

Merged
merged 1 commit into from
Jan 31, 2024

Conversation

chenBright
Copy link
Contributor

What problem does this PR solve?

Issue Number:

Problem Summary:

  1. RFC 7230 3.3.3规范:Content-Length和Transfer-Encoding: chunked不能一起使用,或者忽略Content-Length。目前brpc使用的http-parser版本比较旧,允许Content-Length和Transfer-Encoding: chunked一起使用,存在请求走私(Request Smuggling)和响应拆分(response splitting)的风险。

  2. RFC 7233 3.3.2规范:有Transfer-Encoding的时候,发送者不能发送Content-Length。

What is changed and the side effects?

Changed:

  1. 引入最新http-parser中Content-Length和Transfer-Encoding相关的代码。解析http包时,默认拒绝同时存在Content-Length和Transfer-Encoding的http包。如果打开开关且Transfer-Encoding的最后一个编码是chunked时,则移除Content-Length,接受该http包。
  2. 组http包时,有Transfer-Encoding,则移除且不添加Content-Length。

Side effects:

  • Performance effects(性能影响):

  • Breaking backward compatibility(向后兼容性):


Check List:

  • Please make sure your changes are compilable(请确保你的更改可以通过编译).
  • When providing us with a new feature, it is best to add related tests(如果你向我们增加一个新的功能, 请添加相关测试).
  • Please follow Contributor Covenant Code of Conduct.(请遵循贡献者准则).

@wwbmmm
Copy link
Contributor

wwbmmm commented Jan 23, 2024

LGTM

@wwbmmm wwbmmm merged commit 09b9600 into apache:master Jan 31, 2024
18 checks passed
@chenBright chenBright deleted the fix_cl_te branch January 31, 2024 06:37
jiangdongzi pushed a commit to jiangdongzi/brpc that referenced this pull request Jan 31, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants