Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Cheroot clobbers previous lines' values during field line folding #726

Open
1 of 3 tasks
kenballus opened this issue Jul 5, 2024 · 0 comments
Open
1 of 3 tasks
Labels
bug Something is broken triage

Comments

@kenballus
Copy link

❓ I'm submitting a ...

  • 🐞 bug report
  • 🐣 feature request
  • ❓ question about the decisions made in the repository

🐞 Describe the bug. What is the current behavior?
When Cheroot receives a request that uses field line folding, it uses the last line's value instead of concatenating all received lines' values together.

i.e., when Cheroot receives a request like this:

GET / HTTP/1.1\r\n
Host: whatever\r\n
Test: 1\r\n
 2\r\n
 3\r\n
\r\n

...it sees the Test header as having a value of 3, instead of 1 2 3.

❓ What is the motivation / use case for changing the behavior?
This is a logic bug.

πŸ’‘ To Reproduce
Steps to reproduce the behavior:

  1. Run a Cheroot server that echos back received headers (such as this one).
  2. Send it a request with field line folding:
printf 'GET / HTTP/1.1\r\nHost: whatever\r\nTest: a\r\n b\r\n c\r\n\r\n' \
    | timeout 1 nc 172.18.0.19 80 \
    | grep '"headers"' \
    | jq '.["headers"][1][1]' \
    | xargs echo \
    | base64 -d \
    | xxd
  1. See the extracted header value:
00000000: 63                                       c

πŸ’‘ Expected behavior
Cheroot should either have a header value of a b c, a b c, or reject the request.

πŸ“‹ Environment

  • Cheroot version: 10.0.2.dev71+g1ff20b18
  • Python version: 3.11.9
  • OS: Linux 3dd8401f8901 6.9.7-arch1-1 #1 SMP PREEMPT_DYNAMIC Fri, 28 Jun 2024 04:32:50 +0000 x86_64 GNU/Linux
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something is broken triage
Projects
None yet
Development

No branches or pull requests

1 participant