diff options
| author | Andy Pan <panjf2000@gmail.com> | 2024-02-04 14:50:42 +0800 |
|---|---|---|
| committer | Damien Neil <dneil@google.com> | 2024-02-14 22:23:32 +0000 |
| commit | 48d899dcdbed4534ed942f7ec2917cf86b18af22 (patch) | |
| tree | 196df55cdf5bb33e1a6ef890f5967beace4ee239 /src/net/http/serve_test.go | |
| parent | d90a57ffe8ad8f3cb0137822a768ae48cf80a09d (diff) | |
| download | go-48d899dcdbed4534ed942f7ec2917cf86b18af22.tar.xz | |
net/http: reject requests with invalid Content-Length headers
According to RFC 9110 and RFC 9112, invalid "Content-Length" headers
might involve request smuggling or response splitting, which could
also cause security failures. Currently, `net/http` ignores all
"Content-Length" headers when there is a "Transfer-Encoding" header and
forward the message anyway while other mainstream HTTP implementations
such as Apache Tomcat, Nginx, HAProxy, Node.js, Deno, Tornado, etc. reject
invalid Content-Length headers regardless of the presence of a
"Transfer-Encoding" header and only forward chunked-encoding messages
with either valid "Content-Length" headers or no "Content-Length" headers.
Fixes #65505
Change-Id: I73af2ee0785137e56c7546a4cce4a5c5c348dbc5
Reviewed-on: https://go-review.googlesource.com/c/go/+/561075
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Bryan Mills <bcmills@google.com>
Reviewed-by: Damien Neil <dneil@google.com>
Diffstat (limited to 'src/net/http/serve_test.go')
| -rw-r--r-- | src/net/http/serve_test.go | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/src/net/http/serve_test.go b/src/net/http/serve_test.go index 301a9fdc4b..9324e0bfc8 100644 --- a/src/net/http/serve_test.go +++ b/src/net/http/serve_test.go @@ -4819,6 +4819,12 @@ func TestServerValidatesHeaders(t *testing.T) { // See RFC 7230, Section 3.2. {": empty key\r\n", 400}, + // Requests with invalid Content-Length headers should be rejected + // regardless of the presence of a Transfer-Encoding header. + // Check out RFC 9110, Section 8.6 and RFC 9112, Section 6.3.3. + {"Content-Length: notdigits\r\n", 400}, + {"Content-Length: notdigits\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\n", 400}, + {"foo: foo foo\r\n", 200}, // LWS space is okay {"foo: foo\tfoo\r\n", 200}, // LWS tab is okay {"foo: foo\x00foo\r\n", 400}, // CTL 0x00 in value is bad |