diff --git a/NuGet.config b/NuGet.config
index 1c2f27eb90ce..6f6f3bfde211 100644
--- a/NuGet.config
+++ b/NuGet.config
@@ -6,8 +6,10 @@
+
+
@@ -28,8 +30,10 @@
+
+
diff --git a/eng/Baseline.Designer.props b/eng/Baseline.Designer.props
index d622c72bd232..b4be5b0617cc 100644
--- a/eng/Baseline.Designer.props
+++ b/eng/Baseline.Designer.props
@@ -2,117 +2,117 @@
$(MSBuildAllProjects);$(MSBuildThisFileFullPath)
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
-
+
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
@@ -120,138 +120,138 @@
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
- 8.0.20
+ 8.0.21
-
+
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
-
+
- 8.0.20
+ 8.0.21
-
-
+
+
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
-
-
+
+
- 8.0.20
+ 8.0.21
-
+
- 8.0.20
+ 8.0.21
-
+
- 8.0.20
+ 8.0.21
-
+
- 8.0.20
+ 8.0.21
-
-
+
+
- 8.0.20
+ 8.0.21
-
-
-
+
+
+
- 8.0.20
+ 8.0.21
-
-
+
+
- 8.0.20
+ 8.0.21
-
-
+
+
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
-
-
+
+
@@ -259,7 +259,7 @@
- 8.0.20
+ 8.0.21
@@ -268,51 +268,51 @@
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
-
+
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
- 8.0.20
+ 8.0.21
-
-
+
+
@@ -322,8 +322,8 @@
-
-
+
+
@@ -331,8 +331,8 @@
-
-
+
+
@@ -343,58 +343,58 @@
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
-
-
+
+
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
- 8.0.20
+ 8.0.21
-
+
- 8.0.20
+ 8.0.21
@@ -403,7 +403,7 @@
- 8.0.20
+ 8.0.21
@@ -411,71 +411,71 @@
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
-
+
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
- 8.0.20
+ 8.0.21
-
-
+
+
- 8.0.20
+ 8.0.21
-
-
+
+
- 8.0.20
+ 8.0.21
@@ -491,27 +491,27 @@
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
-
+
- 8.0.20
+ 8.0.21
@@ -520,23 +520,23 @@
- 8.0.20
+ 8.0.21
-
+
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
@@ -545,54 +545,54 @@
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
-
-
+
+
-
-
+
+
-
-
+
+
- 8.0.20
+ 8.0.21
-
-
+
+
-
-
+
+
-
-
+
+
-
-
+
+
@@ -600,83 +600,83 @@
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
- 8.0.20
+ 8.0.21
-
-
-
-
+
+
+
+
- 8.0.20
+ 8.0.21
@@ -685,64 +685,64 @@
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
-
+
- 8.0.20
+ 8.0.21
-
+
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
@@ -764,7 +764,7 @@
- 8.0.20
+ 8.0.21
@@ -786,7 +786,7 @@
- 8.0.20
+ 8.0.21
@@ -802,23 +802,23 @@
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
@@ -826,24 +826,24 @@
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
-
-
-
+
+
+
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
@@ -853,7 +853,7 @@
- 8.0.20
+ 8.0.21
@@ -862,73 +862,73 @@
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
- 8.0.20
+ 8.0.21
-
+
-
+
-
+
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
@@ -957,11 +957,11 @@
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
@@ -979,18 +979,18 @@
- 8.0.20
+ 8.0.21
- 8.0.20
+ 8.0.21
-
+
- 8.0.20
+ 8.0.21
diff --git a/eng/Baseline.xml b/eng/Baseline.xml
index 86b656657f27..6e8226d92653 100644
--- a/eng/Baseline.xml
+++ b/eng/Baseline.xml
@@ -4,110 +4,110 @@ This file contains a list of all the packages and their versions which were rele
Update this list when preparing for a new patch.
-->
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml
index 284cb879b985..0233cc55de62 100644
--- a/eng/Version.Details.xml
+++ b/eng/Version.Details.xml
@@ -9,37 +9,37 @@
-->
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-efcore
- a947fe22902f3f0b921f5dafed9f059eaa4d18c6
+ bd381fa6af1f80b3b6a52739729596cd68b6f5c8
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-efcore
- a947fe22902f3f0b921f5dafed9f059eaa4d18c6
+ bd381fa6af1f80b3b6a52739729596cd68b6f5c8
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-efcore
- a947fe22902f3f0b921f5dafed9f059eaa4d18c6
+ bd381fa6af1f80b3b6a52739729596cd68b6f5c8
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-efcore
- a947fe22902f3f0b921f5dafed9f059eaa4d18c6
+ bd381fa6af1f80b3b6a52739729596cd68b6f5c8
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-efcore
- a947fe22902f3f0b921f5dafed9f059eaa4d18c6
+ bd381fa6af1f80b3b6a52739729596cd68b6f5c8
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-efcore
- a947fe22902f3f0b921f5dafed9f059eaa4d18c6
+ bd381fa6af1f80b3b6a52739729596cd68b6f5c8
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-efcore
- a947fe22902f3f0b921f5dafed9f059eaa4d18c6
+ bd381fa6af1f80b3b6a52739729596cd68b6f5c8
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-efcore
- a947fe22902f3f0b921f5dafed9f059eaa4d18c6
+ bd381fa6af1f80b3b6a52739729596cd68b6f5c8
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
@@ -121,9 +121,9 @@
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
5535e31a712343a63f5d7d796cd874e563e5ac14
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- 574100b692e71fa3426931adf4c1ba42e4ee5213
+ 362ab6669d55a75d51166f01b596c967c734ef4c
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
@@ -185,9 +185,9 @@
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
5535e31a712343a63f5d7d796cd874e563e5ac14
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- 574100b692e71fa3426931adf4c1ba42e4ee5213
+ 362ab6669d55a75d51166f01b596c967c734ef4c
https://github.com/dotnet/source-build-externals
@@ -275,17 +275,17 @@
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
81cabf2857a01351e5ab578947c7403a5b128ad1
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- 574100b692e71fa3426931adf4c1ba42e4ee5213
+ 362ab6669d55a75d51166f01b596c967c734ef4c
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- 574100b692e71fa3426931adf4c1ba42e4ee5213
+ 362ab6669d55a75d51166f01b596c967c734ef4c
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- 574100b692e71fa3426931adf4c1ba42e4ee5213
+ 362ab6669d55a75d51166f01b596c967c734ef4c
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
@@ -316,22 +316,22 @@
Win-x64 is used here because we have picked an arbitrary runtime identifier to flow the version of the latest NETCore.App runtime.
All Runtime.$rid packages should have the same version.
-->
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- 574100b692e71fa3426931adf4c1ba42e4ee5213
+ 362ab6669d55a75d51166f01b596c967c734ef4c
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- 574100b692e71fa3426931adf4c1ba42e4ee5213
+ 362ab6669d55a75d51166f01b596c967c734ef4c
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- 574100b692e71fa3426931adf4c1ba42e4ee5213
+ 362ab6669d55a75d51166f01b596c967c734ef4c
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- 574100b692e71fa3426931adf4c1ba42e4ee5213
+ 362ab6669d55a75d51166f01b596c967c734ef4c
https://github.com/dotnet/xdt
@@ -368,9 +368,9 @@
-
+
https://dev.azure.com/dnceng/internal/_git/dotnet-runtime
- 574100b692e71fa3426931adf4c1ba42e4ee5213
+ 362ab6669d55a75d51166f01b596c967c734ef4c
https://github.com/dotnet/winforms
diff --git a/eng/Versions.props b/eng/Versions.props
index f43ced5accd8..0cfb03b4e3b6 100644
--- a/eng/Versions.props
+++ b/eng/Versions.props
@@ -11,7 +11,7 @@
22
- false
+ true
7.1.2
7.*
8.0.2
- 8.0.20
- 8.0.20
- 8.0.20
- 8.0.20
- 8.0.20
- 8.0.20-servicing.25419.14
+ 8.0.21
+ 8.0.21
+ 8.0.21
+ 8.0.21
+ 8.0.21
+ 8.0.21-servicing.25475.13
8.0.0
8.0.1
8.0.0
@@ -93,7 +93,7 @@
8.0.0
8.0.0
8.0.0
- 8.0.20-servicing.25419.14
+ 8.0.21-servicing.25475.13
8.0.1
8.0.1
8.0.1
@@ -109,7 +109,7 @@
8.0.0
8.0.2
8.0.0
- 8.0.20-servicing.25419.14
+ 8.0.21-servicing.25475.13
8.0.1
8.0.1
8.0.2
@@ -129,9 +129,9 @@
8.0.0
8.0.0
8.0.0
- 8.0.20-servicing.25419.14
+ 8.0.21-servicing.25475.13
- 8.0.20-servicing.25419.14
+ 8.0.21-servicing.25475.13
8.0.0
8.0.1
@@ -143,14 +143,14 @@
9.0.0-preview.9.24518.1
9.0.0-preview.9.24518.1
- 8.0.20
- 8.0.20
- 8.0.20
- 8.0.20
- 8.0.20
- 8.0.20
- 8.0.20
- 8.0.20
+ 8.0.21
+ 8.0.21
+ 8.0.21
+ 8.0.21
+ 8.0.21
+ 8.0.21
+ 8.0.21
+ 8.0.21
4.8.0-7.24574.2
4.8.0-7.24574.2
diff --git a/global.json b/global.json
index b8461e46e871..4d4e9d9086f2 100644
--- a/global.json
+++ b/global.json
@@ -1,9 +1,9 @@
{
"sdk": {
- "version": "8.0.120"
+ "version": "8.0.121"
},
"tools": {
- "dotnet": "8.0.120",
+ "dotnet": "8.0.121",
"runtimes": {
"dotnet/x86": [
"$(MicrosoftNETCoreBrowserDebugHostTransportVersion)"
diff --git a/src/Servers/Kestrel/Core/src/CoreStrings.resx b/src/Servers/Kestrel/Core/src/CoreStrings.resx
index 68908731bf54..346b9c8631fe 100644
--- a/src/Servers/Kestrel/Core/src/CoreStrings.resx
+++ b/src/Servers/Kestrel/Core/src/CoreStrings.resx
@@ -737,4 +737,7 @@ For more information on configuring HTTPS see https://go.microsoft.com/fwlink/?l
The client sent a {frameType} frame to a control stream that was too large.
+
+ Bad chunk extension.
+
\ No newline at end of file
diff --git a/src/Servers/Kestrel/Core/src/Internal/Http/Http1ChunkedEncodingMessageBody.cs b/src/Servers/Kestrel/Core/src/Internal/Http/Http1ChunkedEncodingMessageBody.cs
index 78416a213472..0762739223ee 100644
--- a/src/Servers/Kestrel/Core/src/Internal/Http/Http1ChunkedEncodingMessageBody.cs
+++ b/src/Servers/Kestrel/Core/src/Internal/Http/Http1ChunkedEncodingMessageBody.cs
@@ -15,6 +15,7 @@ internal sealed class Http1ChunkedEncodingMessageBody : Http1MessageBody
{
// byte consts don't have a data type annotation so we pre-cast it
private const byte ByteCR = (byte)'\r';
+ private const byte ByteLF = (byte)'\n';
// "7FFFFFFF\r\n" is the largest chunk size that could be returned as an int.
private const int MaxChunkPrefixBytes = 10;
@@ -26,6 +27,8 @@ internal sealed class Http1ChunkedEncodingMessageBody : Http1MessageBody
private readonly Pipe _requestBodyPipe;
private ReadResult _readResult;
+ private static readonly bool InsecureChunkedParsing = AppContext.TryGetSwitch("Microsoft.AspNetCore.Server.Kestrel.EnableInsecureChunkedRequestParsing", out var value) && value;
+
public Http1ChunkedEncodingMessageBody(Http1Connection context, bool keepAlive)
: base(context, keepAlive)
{
@@ -343,15 +346,31 @@ private void ParseChunkedPrefix(in ReadOnlySequence buffer, out SequencePo
KestrelBadHttpRequestException.Throw(RequestRejectionReason.BadChunkSizeData);
}
+ // https://www.rfc-editor.org/rfc/rfc9112#section-7.1
+ // chunk = chunk-size [ chunk-ext ] CRLF
+ // chunk-data CRLF
+
+ // https://www.rfc-editor.org/rfc/rfc9112#section-7.1.1
+ // chunk-ext = *( BWS ";" BWS chunk-ext-name
+ // [BWS "=" BWS chunk-ext-val] )
+ // chunk-ext-name = token
+ // chunk-ext-val = token / quoted-string
private void ParseExtension(ReadOnlySequence buffer, out SequencePosition consumed, out SequencePosition examined)
{
- // Chunk-extensions not currently parsed
- // Just drain the data
- examined = buffer.Start;
+ // Chunk-extensions parsed for \r\n and throws for unpaired \r or \n.
do
{
- SequencePosition? extensionCursorPosition = buffer.PositionOf(ByteCR);
+ SequencePosition? extensionCursorPosition;
+ if (InsecureChunkedParsing)
+ {
+ extensionCursorPosition = buffer.PositionOf(ByteCR);
+ }
+ else
+ {
+ extensionCursorPosition = buffer.PositionOfAny(ByteCR, ByteLF);
+ }
+
if (extensionCursorPosition == null)
{
// End marker not found yet
@@ -359,9 +378,10 @@ private void ParseExtension(ReadOnlySequence buffer, out SequencePosition
examined = buffer.End;
AddAndCheckObservedBytes(buffer.Length);
return;
- };
+ }
var extensionCursor = extensionCursorPosition.Value;
+
var charsToByteCRExclusive = buffer.Slice(0, extensionCursor).Length;
var suffixBuffer = buffer.Slice(extensionCursor);
@@ -376,7 +396,9 @@ private void ParseExtension(ReadOnlySequence buffer, out SequencePosition
suffixBuffer = suffixBuffer.Slice(0, 2);
var suffixSpan = suffixBuffer.ToSpan();
- if (suffixSpan[1] == '\n')
+ if (InsecureChunkedParsing
+ ? (suffixSpan[1] == ByteLF)
+ : (suffixSpan[0] == ByteCR && suffixSpan[1] == ByteLF))
{
// We consumed the \r\n at the end of the extension, so switch modes.
_mode = _inputLength > 0 ? Mode.Data : Mode.Trailer;
@@ -385,13 +407,22 @@ private void ParseExtension(ReadOnlySequence buffer, out SequencePosition
examined = suffixBuffer.End;
AddAndCheckObservedBytes(charsToByteCRExclusive + 2);
}
- else
+ else if (InsecureChunkedParsing)
{
+ examined = buffer.Start;
// Don't consume suffixSpan[1] in case it is also a \r.
buffer = buffer.Slice(charsToByteCRExclusive + 1);
consumed = extensionCursor;
AddAndCheckObservedBytes(charsToByteCRExclusive + 1);
}
+ else
+ {
+ consumed = suffixBuffer.End;
+ examined = suffixBuffer.End;
+
+ // We have \rX or \nX, that's an invalid extension.
+ KestrelBadHttpRequestException.Throw(RequestRejectionReason.BadChunkExtension);
+ }
} while (_mode == Mode.Extension);
}
diff --git a/src/Servers/Kestrel/Core/src/Internal/Http/RequestRejectionReason.cs b/src/Servers/Kestrel/Core/src/Internal/Http/RequestRejectionReason.cs
index 0194f09f16d6..3979d2ad7562 100644
--- a/src/Servers/Kestrel/Core/src/Internal/Http/RequestRejectionReason.cs
+++ b/src/Servers/Kestrel/Core/src/Internal/Http/RequestRejectionReason.cs
@@ -16,6 +16,7 @@ internal enum RequestRejectionReason
UnexpectedEndOfRequestContent,
BadChunkSuffix,
BadChunkSizeData,
+ BadChunkExtension,
ChunkedRequestIncomplete,
InvalidRequestTarget,
InvalidCharactersInHeaderName,
@@ -32,5 +33,5 @@ internal enum RequestRejectionReason
MissingHostHeader,
MultipleHostHeaders,
InvalidHostHeader,
- RequestBodyExceedsContentLength
+ RequestBodyExceedsContentLength,
}
diff --git a/src/Servers/Kestrel/Core/src/KestrelBadHttpRequestException.cs b/src/Servers/Kestrel/Core/src/KestrelBadHttpRequestException.cs
index 05ae34f89802..6bfa5bfe60c4 100644
--- a/src/Servers/Kestrel/Core/src/KestrelBadHttpRequestException.cs
+++ b/src/Servers/Kestrel/Core/src/KestrelBadHttpRequestException.cs
@@ -49,6 +49,9 @@ internal static BadHttpRequestException GetException(RequestRejectionReason reas
case RequestRejectionReason.BadChunkSizeData:
ex = new BadHttpRequestException(CoreStrings.BadRequest_BadChunkSizeData, StatusCodes.Status400BadRequest, reason);
break;
+ case RequestRejectionReason.BadChunkExtension:
+ ex = new BadHttpRequestException(CoreStrings.BadRequest_BadChunkExtension, StatusCodes.Status400BadRequest, reason);
+ break;
case RequestRejectionReason.ChunkedRequestIncomplete:
ex = new BadHttpRequestException(CoreStrings.BadRequest_ChunkedRequestIncomplete, StatusCodes.Status400BadRequest, reason);
break;
diff --git a/src/Servers/Kestrel/Core/test/MessageBodyTests.cs b/src/Servers/Kestrel/Core/test/MessageBodyTests.cs
index f0e9dd29ea77..926914975910 100644
--- a/src/Servers/Kestrel/Core/test/MessageBodyTests.cs
+++ b/src/Servers/Kestrel/Core/test/MessageBodyTests.cs
@@ -338,14 +338,14 @@ public async Task ReadExitsGivenIncompleteChunkedExtension()
var stream = new HttpRequestStream(Mock.Of(), reader);
reader.StartAcceptingReads(body);
- input.Add("5;\r\0");
+ input.Add("5;\r");
var buffer = new byte[1024];
var readTask = stream.ReadAsync(buffer, 0, buffer.Length);
Assert.False(readTask.IsCompleted);
- input.Add("\r\r\r\nHello\r\n0\r\n\r\n");
+ input.Add("\nHello\r\n0\r\n\r\n");
Assert.Equal(5, await readTask.DefaultTimeout());
try
diff --git a/src/Servers/Kestrel/test/InMemory.FunctionalTests/ChunkedRequestTests.cs b/src/Servers/Kestrel/test/InMemory.FunctionalTests/ChunkedRequestTests.cs
index 46a364c586de..34428961e022 100644
--- a/src/Servers/Kestrel/test/InMemory.FunctionalTests/ChunkedRequestTests.cs
+++ b/src/Servers/Kestrel/test/InMemory.FunctionalTests/ChunkedRequestTests.cs
@@ -9,6 +9,7 @@
using System.Linq;
using System.Text;
using System.Threading.Tasks;
+using Microsoft.AspNetCore.Hosting.Server;
using Microsoft.AspNetCore.Http;
using Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http;
using Microsoft.AspNetCore.Server.Kestrel.InMemory.FunctionalTests.TestTransport;
@@ -21,6 +22,70 @@ namespace Microsoft.AspNetCore.Server.Kestrel.InMemory.FunctionalTests;
public class ChunkedRequestTests : LoggedTest
{
+ [Theory]
+ [InlineData("2;\rxx\r\nxy\r\n0")] // \r in chunk extensions
+ [InlineData("2;\nxx\r\nxy\r\n0")] // \n in chunk extensions
+ public async Task RejectsInvalidChunkExtensions(string invalidChunkLine)
+ {
+ var testContext = new TestServiceContext(LoggerFactory);
+
+ await using (var server = new TestServer(AppChunked, testContext))
+ {
+ using (var connection = server.CreateConnection())
+ {
+ await connection.Send(
+ "POST / HTTP/1.1",
+ "Host:",
+ "Transfer-Encoding: chunked",
+ "Content-Type: text/plain",
+ "",
+ invalidChunkLine,
+ "",
+ "");
+ await connection.ReceiveEnd(
+ "HTTP/1.1 400 Bad Request",
+ "Content-Length: 0",
+ "Connection: close",
+ $"Date: {testContext.DateHeaderValue}",
+ "",
+ "");
+ }
+ }
+ }
+
+ [Theory]
+ [InlineData("2;a=b;b=c\r\nxy\r\n0")] // Multiple chunk extensions
+ [InlineData("2; \r\nxy\r\n0")] // Space in chunk extensions (BWS)
+ [InlineData("2;;;\r\nxy\r\n0")] // Multiple ';' in chunk extensions
+ [InlineData("2;novalue\r\nxy\r\n0")] // Name only chunk extension
+ //[InlineData("2 ;\r\nxy\r\n0")] // Technically allowed per spec, but we never supported it, and no one should be sending it
+ public async Task AllowsValidChunkExtensions(string chunkLine)
+ {
+ var testContext = new TestServiceContext(LoggerFactory);
+
+ await using (var server = new TestServer(AppChunked, testContext))
+ {
+ using (var connection = server.CreateConnection())
+ {
+ await connection.Send(
+ "POST / HTTP/1.1",
+ "Host:",
+ "Transfer-Encoding: chunked",
+ "Content-Type: text/plain",
+ "",
+ chunkLine,
+ "",
+ "");
+ await connection.Receive(
+ "HTTP/1.1 200 OK",
+ "Content-Length: 2",
+ $"Date: {testContext.DateHeaderValue}",
+ "",
+ "xy");
+ }
+ }
+ }
+
private async Task App(HttpContext httpContext)
{
var request = httpContext.Request;
@@ -1115,4 +1180,86 @@ await connection.Receive(
}
}
}
+
+ [Fact]
+ public async Task MultiReadWithInvalidNewlineAcrossReads()
+ {
+ // Inline so that we know when the first connection.Send has been parsed so we can send the next part
+ var testContext = new TestServiceContext(LoggerFactory)
+ { Scheduler = System.IO.Pipelines.PipeScheduler.Inline };
+
+ var tcs = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+
+ await using (var server = new TestServer(async httpContext =>
+ {
+ var request = httpContext.Request;
+ var readTask = request.BodyReader.ReadAsync();
+ tcs.TrySetResult();
+ var readResult = await readTask;
+ request.BodyReader.AdvanceTo(readResult.Buffer.End);
+ }, testContext))
+ {
+ using (var connection = server.CreateConnection())
+ {
+ await connection.SendAll(
+ "GET / HTTP/1.1",
+ "Host:",
+ "Transfer-Encoding: chunked",
+ "",
+ "1;\r");
+ await tcs.Task;
+ await connection.SendAll(
+ "\r");
+
+ await connection.ReceiveEnd(
+ "HTTP/1.1 400 Bad Request",
+ "Content-Length: 0",
+ "Connection: close",
+ $"Date: {testContext.DateHeaderValue}",
+ "",
+ "");
+ }
+ }
+ }
+
+ [Fact]
+ public async Task InvalidNewlineInFirstReadWithPartialChunkExtension()
+ {
+ // Inline so that we know when the first connection.Send has been parsed so we can send the next part
+ var testContext = new TestServiceContext(LoggerFactory)
+ { Scheduler = System.IO.Pipelines.PipeScheduler.Inline };
+
+ var tcs = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+
+ await using (var server = new TestServer(async httpContext =>
+ {
+ var request = httpContext.Request;
+ var readTask = request.BodyReader.ReadAsync();
+ tcs.TrySetResult();
+ var readResult = await readTask;
+ request.BodyReader.AdvanceTo(readResult.Buffer.End);
+ }, testContext))
+ {
+ using (var connection = server.CreateConnection())
+ {
+ await connection.SendAll(
+ "GET / HTTP/1.1",
+ "Host:",
+ "Transfer-Encoding: chunked",
+ "",
+ "1;\n");
+ await tcs.Task;
+ await connection.SendAll(
+ "t");
+
+ await connection.ReceiveEnd(
+ "HTTP/1.1 400 Bad Request",
+ "Content-Length: 0",
+ "Connection: close",
+ $"Date: {testContext.DateHeaderValue}",
+ "",
+ "");
+ }
+ }
+ }
}