-
Notifications
You must be signed in to change notification settings - Fork 10.5k
Fix chunked request parsing #64037
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix chunked request parsing #64037
Conversation
/backport to release/10.0 |
Started backporting to release/10.0: https://github.com/dotnet/aspnetcore/actions/runs/18509024636 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Pull Request Overview
This PR fixes chunked request parsing by improving validation of chunk extensions to properly reject malformed requests containing unpaired carriage return (\r) or line feed (\n) characters. The fix ensures HTTP/1.1 chunked transfer encoding follows RFC compliance while maintaining backward compatibility through a configurable switch.
Key changes:
- Enhanced chunk extension parsing to detect and reject invalid newline sequences
- Added comprehensive test coverage for both valid and invalid chunk extension scenarios
- Introduced a configurable switch for backward compatibility with existing behavior
Reviewed Changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.
Show a summary per file
File | Description |
---|---|
ChunkedRequestTests.cs | Adds comprehensive test cases for valid/invalid chunk extensions and edge cases with partial reads |
MessageBodyTests.cs | Updates existing test to use proper CRLF sequence instead of malformed input |
KestrelBadHttpRequestException.cs | Adds new exception case for bad chunk extensions |
RequestRejectionReason.cs | Defines new rejection reason for invalid chunk extensions |
Http1ChunkedEncodingMessageBody.cs | Implements improved chunk extension parsing with RFC compliance and backward compatibility |
CoreStrings.resx | Adds error message for bad chunk extension validation |
src/Servers/Kestrel/test/InMemory.FunctionalTests/ChunkedRequestTests.cs
Show resolved
Hide resolved
src/Servers/Kestrel/Core/src/Internal/Http/Http1ChunkedEncodingMessageBody.cs
Show resolved
Hide resolved
/azp run |
Azure Pipelines successfully started running 3 pipeline(s). |
No description provided.