8000 Reject some messages a conformant sender would not have sent by DemiMarie · Pull Request #728 · nginx/nginx · GitHub
[go: up one dir, main page]
Skip to content

Reject some messages a conformant sender would not have sent #728

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 21 commits into
base: master
Choose a base branch
from
Draft

Reject some messages a conformant sender would not have sent #728

Changes from 1 commit
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
80b41e1
HTTP: Use common header validation function for HTTP/2 and HTTP/3
DemiMarie Mar 25, 2025
3897c97
Strip leading and trailing whitespace from HTTP field values
DemiMarie Apr 7, 2025
c7d26cc
HTTP/3: Do not allow invalid pseudo-header fields
DemiMarie Mar 21, 2025
17ce4bc
HTTP: Us 8000 e common header code for v2 and v3
DemiMarie Mar 22, 2025
1e30988
HTTP: Reject HTTP/2 and HTTP/3 requests with Transfer-Encoding
DemiMarie Apr 8, 2025
b1c4b07
HTTP: Reject invalid header names
DemiMarie Mar 14, 2025
ae76c64
HTTP: Reject invalid field values
DemiMarie Apr 9, 2025
279ae48
HTTP: Reject hop-by-hop headers in HTTP/2 and HTTP/3 requests
DemiMarie Mar 13, 2025
98d2669
Proxy: Reject Transfer-Encoding or Content-Length trailers
DemiMarie Mar 27, 2025
dab8c0e
HTTP: Do not allow header lines with no colon
DemiMarie Apr 25, 2025
e30ddb7
HTTP: Do not allow multiple CRs before LF
DemiMarie Mar 14, 2025
0d2c875
HTTP: Do not allow request lines to end with bare CR
DemiMarie Mar 16, 2025
1be6976
Reject malformed chunk extensions
DemiMarie Mar 23, 2025
1c0426c
Forbid malformed HTTP/1.1 trailers
DemiMarie Mar 27, 2025
626b1d9
HTTP: Reject trailers involved in framing
DemiMarie Mar 27, 2025
436282f
HTTP: Remove redundant state from chunk parsing
DemiMarie Apr 7, 2025
bb0a2b9
HTTP: Allow rejecting leading and trailing whitespace in HTTP2+ fields
DemiMarie Mar 25, 2025
bd37faf
HTTP: do not allow headers to end with a bare LF
DemiMarie Mar 16, 2025
7032a60
HTTP: do not allow status line to end with bare LF
DemiMarie Mar 16, 2025
9950dfb
Do not allow trailers to end with bare LF
DemiMarie Jun 10, 2025
9b8e4a1
Do not support bad whitespace in chunk extensions
DemiMarie Jun 10, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Forbid malformed HTTP/1.1 trailers 
HTTP/1.1 trailers must follow the same syntax as HTTP headers.
  • Loading branch information
@DemiMarie
DemiMarie committed Jun 10, 2025
commit 1c0426c8c0fd9b521bfc90ba45e5b3767cb1deb0
39 changes: 30 additions & 9 deletions src/http/ngx_http_parse.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2296,7 +2296,8 @@ ngx_http_parse_chunked(ngx_http_request_t *r, ngx_buf_t *b,
sw_after_data_almost_done,
sw_trailer,
sw_trailer_almost_done,
sw_trailer_header,
sw_trailer_name,
sw_trailer_value,
sw_trailer_header_almost_done
} state;

Expand Down Expand Up @@ -2494,7 +2495,11 @@ ngx_http_parse_chunked(ngx_http_request_t *r, ngx_buf_t *b,
case LF:
goto done;
default:
state = sw_trailer_header;
if (ngx_http_token_char(ch)) {
state = sw_trailer_name;
break;
}
goto invalid;
}
break;

Expand All @@ -2504,15 +2509,26 @@ ngx_http_parse_chunked(ngx_http_request_t *r, ngx_buf_t *b,
}
goto invalid;

case sw_trailer_header:
switch (ch) {
case CR:
case sw_trailer_name:
if (ngx_http_token_char(ch)) {
break;
}
if (ch == ':') {
state = sw_trailer_value;
break;
}
goto invalid;

case sw_trailer_value:
if (ngx_http_field_value_char(ch)) {
break;
}
if (ch == CR) {
state = sw_trailer_header_almost_done;
break;
case LF:
state = sw_trailer;
}
break;

/* fall through */

case sw_trailer_header_almost_done:
if (ch == LF) {
Expand Down Expand Up @@ -2553,6 +2569,12 @@ ngx_http_parse_chunked(ngx_http_request_t *r, ngx_buf_t *b,
case sw_chunk_extension_name:
ctx->length = 4 /* =b CR LF */ + min_length;
break;
case sw_trailer_name:
ctx->length = 3 /* : LF LF */;
break;
case sw_trailer_value:
ctx->length = 2 /* LF LF */;
break;
case sw_chunk_extension_value_start:
ctx->length = 3 /* b CR LF */ + min_length;
break;
Expand All @@ -2575,7 +2597,6 @@ ngx_http_parse_chunked(ngx_http_request_t *r, ngx_buf_t *b,
case sw_trailer_almost_done:
ctx->length = 1 /* LF */;
break;
case sw_trailer_header:
case sw_trailer_header_almost_done:
ctx->length = 2 /* LF LF */;
break;
Expand Down
0