Skip to content

fix(http): reject HTTP/1 responses with non-chunked final Transfer-Encoding - #1109

Open
deepak-pandey2005 wants to merge 1 commit into
cloudflare:mainfrom
deepak-pandey2005:fix/client-te-validation
Open

deepak-pandey2005 wants to merge 1 commit into
cloudflare:mainfrom
deepak-pandey2005:fix/client-te-validation

Conversation

@deepak-pandey2005

Copy link
Copy Markdown

Addresses #1042

Summary

  • Reject HTTP/1 downstream responses when Transfer-Encoding is present but chunked is not the final transfer coding, in accordance with RFC 9112 §6.3.
  • Update test_response_multiple_te_headers_chunked_not_last and add test_response_single_te_header_not_chunked regression tests.

Motivation

Per RFC 9112 §6.3:

"If a Transfer-Encoding header field is present in a response and the chunked transfer coding is not the final encoding, the message body length cannot be determined reliably; the recipient MUST parse or discard the response as an error."

While the server side (HttpSession::validate_request) already enforces !self.is_chunked_encoding(), HttpSession::validate_response in protocols/http/v1/client.rs lacked this check, leading to inconsistent framing handling and potential request/response desynchronization risks.

Design

  • In HttpSession::validate_response: if resp_header.headers.contains_key(header::TRANSFER_ENCODING) and !self.is_chunked_encoding(), immediately return Error::e_explain(InvalidHTTPHeader, "non-chunked final Transfer-Encoding").
  • Align client-side behavior with existing server-side validation.

Tests

  • Updated test_response_multiple_te_headers_chunked_not_last to assert InvalidHTTPHeader error.
  • Added test_response_single_te_header_not_chunked to verify single non-chunked TE headers.
  • All 83 pingora-core HTTP/1 client unit tests pass.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant