Skip to content

Fix UnsupportedOperationException in readTrailingHeaders (#16412)#16453

Merged
normanmaurer merged 1 commit intonetty:5.0from
chrisvest:5.0-read-trailers
Mar 13, 2026
Merged

Fix UnsupportedOperationException in readTrailingHeaders (#16412)#16453
normanmaurer merged 1 commit intonetty:5.0from
chrisvest:5.0-read-trailers

Conversation

@chrisvest
Copy link
Copy Markdown
Member

Motivation:

When a chunked HTTP message contains a trailer field with a folded value (obs-fold continuation line starting with SP or HT), readTrailingHeaders threw UnsupportedOperationException. This happened because the folding logic called List.set() on the list returned by
trailingHeaders().getAll(), which is an AbstractList implementation that does not override set().

Modifications:

Changed readTrailingHeaders in HttpObjectDecoder to accumulate folded continuation lines into the instance-level value field, mirroring the pattern already used by readHeaders. The previous header is now flushed via trailingHeaders().add() only once its complete value is assembled, eliminating the need to mutate the list returned by getAll(). Forbidden trailer fields (Content-Length, Transfer-Encoding, Trailer) are filtered at flush time, consistent with the previous behaviour.

Added tests to HttpRequestDecoderTest and HttpResponseDecoderTest covering:

  • A single trailer field
  • A folded trailer field with multiple SP and HT continuation lines, followed by a non-folded trailer to verify isolation between fields
  • Forbidden trailer fields interleaved with a valid one, with a forbidden field placed last to exercise the post-loop flush path

Result:

Chunked HTTP messages with folded trailer values are now decoded correctly instead of throwing UnsupportedOperationException.

(cherry picked from commit 9a85f9f)

Motivation:

When a chunked HTTP message contains a trailer field with a folded value
(obs-fold continuation line starting with SP or HT), readTrailingHeaders
threw UnsupportedOperationException. This happened because the folding
logic called List.set() on the list returned by
trailingHeaders().getAll(), which is an AbstractList implementation that
does not override set().

Modifications:

Changed readTrailingHeaders in HttpObjectDecoder to accumulate folded
continuation lines into the instance-level `value` field, mirroring the
pattern already used by readHeaders. The previous header is now flushed
via trailingHeaders().add() only once its complete value is assembled,
eliminating the need to mutate the list returned by getAll(). Forbidden
trailer fields (Content-Length, Transfer-Encoding, Trailer) are filtered
at flush time, consistent with the previous behaviour.

Added tests to HttpRequestDecoderTest and HttpResponseDecoderTest
covering:
- A single trailer field
- A folded trailer field with multiple SP and HT continuation lines,
followed by a non-folded trailer to verify isolation between fields
- Forbidden trailer fields interleaved with a valid one, with a
forbidden field placed last to exercise the post-loop flush path

Result:

Chunked HTTP messages with folded trailer values are now decoded
correctly instead of throwing UnsupportedOperationException.

(cherry picked from commit 9a85f9f)
@chrisvest chrisvest added this to the 5.0.0.Final milestone Mar 12, 2026
@normanmaurer normanmaurer merged commit e1a4d73 into netty:5.0 Mar 13, 2026
12 of 13 checks passed
@chrisvest chrisvest deleted the 5.0-read-trailers branch March 13, 2026 19:01
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants