Skip to content

FastHTTP incorrectly handles obs-fold on the first line #1974

@kenballus

Description

@kenballus

When FastHTTP receives a request in which the first header line begins with spaces, it allows the spaces to persist into the header name. This is invalid, because spaces are not permitted in header names.

This can be confirmed by

  1. running a FastHTTP server that echoes header names (like this one),
  2. sending it a request with a header name prefixed with spaces, and extracting the echoed header name:
printf 'GET / HTTP/1.1\r\n  Test: whatever\r\n\r\n' \
  | nc localhost 80 \
  | grep "headers" \
  | jq '.["headers"][0][0]' \
  | xargs echo \
  | base64 -d \
  | xxd
00000000: 2020 5465 7374                             Test

Note that the spaces are still there in the header name.

The correct behavior in this scenario is to reject the request with a 400.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions