Repository navigation
Conversation
|
Any thoughts about this? Should we append the rest of the status line (instead of discarding it)? Should we just increase the buffer size (currently 256 bytes) to able to read longer status lines without further changes? Should there be a test case? Or should we just leave this as is? Oh, and of course, which branch should this target? |
Not necessary. The reason phrase only exists with HTTP/1.x and even then it is entirely optional and might be missing.
I'd say 256 is plenty for the status line. However the other headers should be able to support longer values. So if they already do, then making a dynamic allocation for the status line, might also make sense.
Yes, I think there should be. It should test both overly long reason phrases and also an entirely empty one (unless there already is).
What exactly does "as is" refer to? The current situation as it is in “master”? Then no, it is a real bug when the status line spills over into another header. In fact this might even have security implications.
As this is a real bugfix, it should be backported to 8.0.x at the very least. 7.4 might be a stretch. |
The other headers are already properly handled by not using a fixed size buffer. The buffer is only used to read the status line. Increasing the buffer would have helped in this case, but we never can be sure how long a status line actually is, so discarding the rest still would be necessary.
Make sense. I'll add those tests.
ACK |
While the reason-phrase in a HTTP response status line is usually short, there is no actual limit specified by the RFCs. As such, we must not assume that the line fits into the buffer (which is currently 128 bytes large). Since there is no real need to present the complete status line, we simply read and discard the rest of a long line.
TimWolla
left a comment
There was a problem hiding this comment.
Fix and test look good to me, apart from this technicality, consider this an approval.
Co-authored-by: Tim Düsterhus <[email protected]>
Co-authored-by: Tim Düsterhus <[email protected]>
While the reason-phrase in a HTTP response status line is usually
short, there is no actual limit specified by the RFCs. As such, we
must not assume that the line fits into the buffer (which is currently
128 bytes large).
Since there is no real need to present the complete status line, we
simply read and discard the rest of a long line.