diff --git a/NuGet.config b/NuGet.config index 1c2f27eb90ce..6f6f3bfde211 100644 --- a/NuGet.config +++ b/NuGet.config @@ -6,8 +6,10 @@ + + @@ -28,8 +30,10 @@ + + diff --git a/eng/Baseline.Designer.props b/eng/Baseline.Designer.props index d622c72bd232..b4be5b0617cc 100644 --- a/eng/Baseline.Designer.props +++ b/eng/Baseline.Designer.props @@ -2,117 +2,117 @@ $(MSBuildAllProjects);$(MSBuildThisFileFullPath) - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - + - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 @@ -120,138 +120,138 @@ - 8.0.20 + 8.0.21 - + - + - + - 8.0.20 + 8.0.21 - + - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - + - 8.0.20 + 8.0.21 - - + + - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - - + + - 8.0.20 + 8.0.21 - + - 8.0.20 + 8.0.21 - + - 8.0.20 + 8.0.21 - + - 8.0.20 + 8.0.21 - - + + - 8.0.20 + 8.0.21 - - - + + + - 8.0.20 + 8.0.21 - - + + - 8.0.20 + 8.0.21 - - + + - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - - + + @@ -259,7 +259,7 @@ - 8.0.20 + 8.0.21 @@ -268,51 +268,51 @@ - 8.0.20 + 8.0.21 - + - + - + - + - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - + - + - + - 8.0.20 + 8.0.21 - - + + @@ -322,8 +322,8 @@ - - + + @@ -331,8 +331,8 @@ - - + + @@ -343,58 +343,58 @@ - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - - + + - 8.0.20 + 8.0.21 - + - + - + - 8.0.20 + 8.0.21 - + - + - + - 8.0.20 + 8.0.21 - + - 8.0.20 + 8.0.21 @@ -403,7 +403,7 @@ - 8.0.20 + 8.0.21 @@ -411,71 +411,71 @@ - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - + - + - + - + - 8.0.20 + 8.0.21 - + - + - + - 8.0.20 + 8.0.21 - - + + - 8.0.20 + 8.0.21 - - + + - 8.0.20 + 8.0.21 @@ -491,27 +491,27 @@ - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - + - 8.0.20 + 8.0.21 @@ -520,23 +520,23 @@ - 8.0.20 + 8.0.21 - + - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 @@ -545,54 +545,54 @@ - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - - + + - - + + - - + + - 8.0.20 + 8.0.21 - - + + - - + + - - + + - - + + @@ -600,83 +600,83 @@ - 8.0.20 + 8.0.21 - + - + - + - 8.0.20 + 8.0.21 - + - + - + - 8.0.20 + 8.0.21 - + - + - + - 8.0.20 + 8.0.21 - + - + - + - 8.0.20 + 8.0.21 - - - - + + + + - 8.0.20 + 8.0.21 @@ -685,64 +685,64 @@ - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - + - 8.0.20 + 8.0.21 - + - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 @@ -764,7 +764,7 @@ - 8.0.20 + 8.0.21 @@ -786,7 +786,7 @@ - 8.0.20 + 8.0.21 @@ -802,23 +802,23 @@ - 8.0.20 + 8.0.21 - + - + - + @@ -826,24 +826,24 @@ - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - - - + + + - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 @@ -853,7 +853,7 @@ - 8.0.20 + 8.0.21 @@ -862,73 +862,73 @@ - 8.0.20 + 8.0.21 - + - + - + - 8.0.20 + 8.0.21 - + - + - + - 8.0.20 + 8.0.21 - + - + - + - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 @@ -957,11 +957,11 @@ - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 @@ -979,18 +979,18 @@ - 8.0.20 + 8.0.21 - 8.0.20 + 8.0.21 - + - 8.0.20 + 8.0.21 diff --git a/eng/Baseline.xml b/eng/Baseline.xml index 86b656657f27..6e8226d92653 100644 --- a/eng/Baseline.xml +++ b/eng/Baseline.xml @@ -4,110 +4,110 @@ This file contains a list of all the packages and their versions which were rele Update this list when preparing for a new patch. --> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/eng/Version.Details.xml b/eng/Version.Details.xml index 284cb879b985..0233cc55de62 100644 --- a/eng/Version.Details.xml +++ b/eng/Version.Details.xml @@ -9,37 +9,37 @@ --> - + https://dev.azure.com/dnceng/internal/_git/dotnet-efcore - a947fe22902f3f0b921f5dafed9f059eaa4d18c6 + bd381fa6af1f80b3b6a52739729596cd68b6f5c8 - + https://dev.azure.com/dnceng/internal/_git/dotnet-efcore - a947fe22902f3f0b921f5dafed9f059eaa4d18c6 + bd381fa6af1f80b3b6a52739729596cd68b6f5c8 - + https://dev.azure.com/dnceng/internal/_git/dotnet-efcore - a947fe22902f3f0b921f5dafed9f059eaa4d18c6 + bd381fa6af1f80b3b6a52739729596cd68b6f5c8 - + https://dev.azure.com/dnceng/internal/_git/dotnet-efcore - a947fe22902f3f0b921f5dafed9f059eaa4d18c6 + bd381fa6af1f80b3b6a52739729596cd68b6f5c8 - + https://dev.azure.com/dnceng/internal/_git/dotnet-efcore - a947fe22902f3f0b921f5dafed9f059eaa4d18c6 + bd381fa6af1f80b3b6a52739729596cd68b6f5c8 - + https://dev.azure.com/dnceng/internal/_git/dotnet-efcore - a947fe22902f3f0b921f5dafed9f059eaa4d18c6 + bd381fa6af1f80b3b6a52739729596cd68b6f5c8 - + https://dev.azure.com/dnceng/internal/_git/dotnet-efcore - a947fe22902f3f0b921f5dafed9f059eaa4d18c6 + bd381fa6af1f80b3b6a52739729596cd68b6f5c8 - + https://dev.azure.com/dnceng/internal/_git/dotnet-efcore - a947fe22902f3f0b921f5dafed9f059eaa4d18c6 + bd381fa6af1f80b3b6a52739729596cd68b6f5c8 https://dev.azure.com/dnceng/internal/_git/dotnet-runtime @@ -121,9 +121,9 @@ https://dev.azure.com/dnceng/internal/_git/dotnet-runtime 5535e31a712343a63f5d7d796cd874e563e5ac14 - + https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - 574100b692e71fa3426931adf4c1ba42e4ee5213 + 362ab6669d55a75d51166f01b596c967c734ef4c https://dev.azure.com/dnceng/internal/_git/dotnet-runtime @@ -185,9 +185,9 @@ https://dev.azure.com/dnceng/internal/_git/dotnet-runtime 5535e31a712343a63f5d7d796cd874e563e5ac14 - + https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - 574100b692e71fa3426931adf4c1ba42e4ee5213 + 362ab6669d55a75d51166f01b596c967c734ef4c https://github.com/dotnet/source-build-externals @@ -275,17 +275,17 @@ https://dev.azure.com/dnceng/internal/_git/dotnet-runtime 81cabf2857a01351e5ab578947c7403a5b128ad1 - + https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - 574100b692e71fa3426931adf4c1ba42e4ee5213 + 362ab6669d55a75d51166f01b596c967c734ef4c - + https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - 574100b692e71fa3426931adf4c1ba42e4ee5213 + 362ab6669d55a75d51166f01b596c967c734ef4c - + https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - 574100b692e71fa3426931adf4c1ba42e4ee5213 + 362ab6669d55a75d51166f01b596c967c734ef4c https://dev.azure.com/dnceng/internal/_git/dotnet-runtime @@ -316,22 +316,22 @@ Win-x64 is used here because we have picked an arbitrary runtime identifier to flow the version of the latest NETCore.App runtime. All Runtime.$rid packages should have the same version. --> - + https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - 574100b692e71fa3426931adf4c1ba42e4ee5213 + 362ab6669d55a75d51166f01b596c967c734ef4c - + https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - 574100b692e71fa3426931adf4c1ba42e4ee5213 + 362ab6669d55a75d51166f01b596c967c734ef4c - + https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - 574100b692e71fa3426931adf4c1ba42e4ee5213 + 362ab6669d55a75d51166f01b596c967c734ef4c - + https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - 574100b692e71fa3426931adf4c1ba42e4ee5213 + 362ab6669d55a75d51166f01b596c967c734ef4c https://github.com/dotnet/xdt @@ -368,9 +368,9 @@ - + https://dev.azure.com/dnceng/internal/_git/dotnet-runtime - 574100b692e71fa3426931adf4c1ba42e4ee5213 + 362ab6669d55a75d51166f01b596c967c734ef4c https://github.com/dotnet/winforms diff --git a/eng/Versions.props b/eng/Versions.props index f43ced5accd8..0cfb03b4e3b6 100644 --- a/eng/Versions.props +++ b/eng/Versions.props @@ -11,7 +11,7 @@ 22 - false + true 7.1.2 7.* 8.0.2 - 8.0.20 - 8.0.20 - 8.0.20 - 8.0.20 - 8.0.20 - 8.0.20-servicing.25419.14 + 8.0.21 + 8.0.21 + 8.0.21 + 8.0.21 + 8.0.21 + 8.0.21-servicing.25475.13 8.0.0 8.0.1 8.0.0 @@ -93,7 +93,7 @@ 8.0.0 8.0.0 8.0.0 - 8.0.20-servicing.25419.14 + 8.0.21-servicing.25475.13 8.0.1 8.0.1 8.0.1 @@ -109,7 +109,7 @@ 8.0.0 8.0.2 8.0.0 - 8.0.20-servicing.25419.14 + 8.0.21-servicing.25475.13 8.0.1 8.0.1 8.0.2 @@ -129,9 +129,9 @@ 8.0.0 8.0.0 8.0.0 - 8.0.20-servicing.25419.14 + 8.0.21-servicing.25475.13 - 8.0.20-servicing.25419.14 + 8.0.21-servicing.25475.13 8.0.0 8.0.1 @@ -143,14 +143,14 @@ 9.0.0-preview.9.24518.1 9.0.0-preview.9.24518.1 - 8.0.20 - 8.0.20 - 8.0.20 - 8.0.20 - 8.0.20 - 8.0.20 - 8.0.20 - 8.0.20 + 8.0.21 + 8.0.21 + 8.0.21 + 8.0.21 + 8.0.21 + 8.0.21 + 8.0.21 + 8.0.21 4.8.0-7.24574.2 4.8.0-7.24574.2 diff --git a/global.json b/global.json index b8461e46e871..4d4e9d9086f2 100644 --- a/global.json +++ b/global.json @@ -1,9 +1,9 @@ { "sdk": { - "version": "8.0.120" + "version": "8.0.121" }, "tools": { - "dotnet": "8.0.120", + "dotnet": "8.0.121", "runtimes": { "dotnet/x86": [ "$(MicrosoftNETCoreBrowserDebugHostTransportVersion)" diff --git a/src/Servers/Kestrel/Core/src/CoreStrings.resx b/src/Servers/Kestrel/Core/src/CoreStrings.resx index 68908731bf54..346b9c8631fe 100644 --- a/src/Servers/Kestrel/Core/src/CoreStrings.resx +++ b/src/Servers/Kestrel/Core/src/CoreStrings.resx @@ -737,4 +737,7 @@ For more information on configuring HTTPS see https://go.microsoft.com/fwlink/?l The client sent a {frameType} frame to a control stream that was too large. + + Bad chunk extension. + \ No newline at end of file diff --git a/src/Servers/Kestrel/Core/src/Internal/Http/Http1ChunkedEncodingMessageBody.cs b/src/Servers/Kestrel/Core/src/Internal/Http/Http1ChunkedEncodingMessageBody.cs index 78416a213472..0762739223ee 100644 --- a/src/Servers/Kestrel/Core/src/Internal/Http/Http1ChunkedEncodingMessageBody.cs +++ b/src/Servers/Kestrel/Core/src/Internal/Http/Http1ChunkedEncodingMessageBody.cs @@ -15,6 +15,7 @@ internal sealed class Http1ChunkedEncodingMessageBody : Http1MessageBody { // byte consts don't have a data type annotation so we pre-cast it private const byte ByteCR = (byte)'\r'; + private const byte ByteLF = (byte)'\n'; // "7FFFFFFF\r\n" is the largest chunk size that could be returned as an int. private const int MaxChunkPrefixBytes = 10; @@ -26,6 +27,8 @@ internal sealed class Http1ChunkedEncodingMessageBody : Http1MessageBody private readonly Pipe _requestBodyPipe; private ReadResult _readResult; + private static readonly bool InsecureChunkedParsing = AppContext.TryGetSwitch("Microsoft.AspNetCore.Server.Kestrel.EnableInsecureChunkedRequestParsing", out var value) && value; + public Http1ChunkedEncodingMessageBody(Http1Connection context, bool keepAlive) : base(context, keepAlive) { @@ -343,15 +346,31 @@ private void ParseChunkedPrefix(in ReadOnlySequence buffer, out SequencePo KestrelBadHttpRequestException.Throw(RequestRejectionReason.BadChunkSizeData); } + // https://www.rfc-editor.org/rfc/rfc9112#section-7.1 + // chunk = chunk-size [ chunk-ext ] CRLF + // chunk-data CRLF + + // https://www.rfc-editor.org/rfc/rfc9112#section-7.1.1 + // chunk-ext = *( BWS ";" BWS chunk-ext-name + // [BWS "=" BWS chunk-ext-val] ) + // chunk-ext-name = token + // chunk-ext-val = token / quoted-string private void ParseExtension(ReadOnlySequence buffer, out SequencePosition consumed, out SequencePosition examined) { - // Chunk-extensions not currently parsed - // Just drain the data - examined = buffer.Start; + // Chunk-extensions parsed for \r\n and throws for unpaired \r or \n. do { - SequencePosition? extensionCursorPosition = buffer.PositionOf(ByteCR); + SequencePosition? extensionCursorPosition; + if (InsecureChunkedParsing) + { + extensionCursorPosition = buffer.PositionOf(ByteCR); + } + else + { + extensionCursorPosition = buffer.PositionOfAny(ByteCR, ByteLF); + } + if (extensionCursorPosition == null) { // End marker not found yet @@ -359,9 +378,10 @@ private void ParseExtension(ReadOnlySequence buffer, out SequencePosition examined = buffer.End; AddAndCheckObservedBytes(buffer.Length); return; - }; + } var extensionCursor = extensionCursorPosition.Value; + var charsToByteCRExclusive = buffer.Slice(0, extensionCursor).Length; var suffixBuffer = buffer.Slice(extensionCursor); @@ -376,7 +396,9 @@ private void ParseExtension(ReadOnlySequence buffer, out SequencePosition suffixBuffer = suffixBuffer.Slice(0, 2); var suffixSpan = suffixBuffer.ToSpan(); - if (suffixSpan[1] == '\n') + if (InsecureChunkedParsing + ? (suffixSpan[1] == ByteLF) + : (suffixSpan[0] == ByteCR && suffixSpan[1] == ByteLF)) { // We consumed the \r\n at the end of the extension, so switch modes. _mode = _inputLength > 0 ? Mode.Data : Mode.Trailer; @@ -385,13 +407,22 @@ private void ParseExtension(ReadOnlySequence buffer, out SequencePosition examined = suffixBuffer.End; AddAndCheckObservedBytes(charsToByteCRExclusive + 2); } - else + else if (InsecureChunkedParsing) { + examined = buffer.Start; // Don't consume suffixSpan[1] in case it is also a \r. buffer = buffer.Slice(charsToByteCRExclusive + 1); consumed = extensionCursor; AddAndCheckObservedBytes(charsToByteCRExclusive + 1); } + else + { + consumed = suffixBuffer.End; + examined = suffixBuffer.End; + + // We have \rX or \nX, that's an invalid extension. + KestrelBadHttpRequestException.Throw(RequestRejectionReason.BadChunkExtension); + } } while (_mode == Mode.Extension); } diff --git a/src/Servers/Kestrel/Core/src/Internal/Http/RequestRejectionReason.cs b/src/Servers/Kestrel/Core/src/Internal/Http/RequestRejectionReason.cs index 0194f09f16d6..3979d2ad7562 100644 --- a/src/Servers/Kestrel/Core/src/Internal/Http/RequestRejectionReason.cs +++ b/src/Servers/Kestrel/Core/src/Internal/Http/RequestRejectionReason.cs @@ -16,6 +16,7 @@ internal enum RequestRejectionReason UnexpectedEndOfRequestContent, BadChunkSuffix, BadChunkSizeData, + BadChunkExtension, ChunkedRequestIncomplete, InvalidRequestTarget, InvalidCharactersInHeaderName, @@ -32,5 +33,5 @@ internal enum RequestRejectionReason MissingHostHeader, MultipleHostHeaders, InvalidHostHeader, - RequestBodyExceedsContentLength + RequestBodyExceedsContentLength, } diff --git a/src/Servers/Kestrel/Core/src/KestrelBadHttpRequestException.cs b/src/Servers/Kestrel/Core/src/KestrelBadHttpRequestException.cs index 05ae34f89802..6bfa5bfe60c4 100644 --- a/src/Servers/Kestrel/Core/src/KestrelBadHttpRequestException.cs +++ b/src/Servers/Kestrel/Core/src/KestrelBadHttpRequestException.cs @@ -49,6 +49,9 @@ internal static BadHttpRequestException GetException(RequestRejectionReason reas case RequestRejectionReason.BadChunkSizeData: ex = new BadHttpRequestException(CoreStrings.BadRequest_BadChunkSizeData, StatusCodes.Status400BadRequest, reason); break; + case RequestRejectionReason.BadChunkExtension: + ex = new BadHttpRequestException(CoreStrings.BadRequest_BadChunkExtension, StatusCodes.Status400BadRequest, reason); + break; case RequestRejectionReason.ChunkedRequestIncomplete: ex = new BadHttpRequestException(CoreStrings.BadRequest_ChunkedRequestIncomplete, StatusCodes.Status400BadRequest, reason); break; diff --git a/src/Servers/Kestrel/Core/test/MessageBodyTests.cs b/src/Servers/Kestrel/Core/test/MessageBodyTests.cs index f0e9dd29ea77..926914975910 100644 --- a/src/Servers/Kestrel/Core/test/MessageBodyTests.cs +++ b/src/Servers/Kestrel/Core/test/MessageBodyTests.cs @@ -338,14 +338,14 @@ public async Task ReadExitsGivenIncompleteChunkedExtension() var stream = new HttpRequestStream(Mock.Of(), reader); reader.StartAcceptingReads(body); - input.Add("5;\r\0"); + input.Add("5;\r"); var buffer = new byte[1024]; var readTask = stream.ReadAsync(buffer, 0, buffer.Length); Assert.False(readTask.IsCompleted); - input.Add("\r\r\r\nHello\r\n0\r\n\r\n"); + input.Add("\nHello\r\n0\r\n\r\n"); Assert.Equal(5, await readTask.DefaultTimeout()); try diff --git a/src/Servers/Kestrel/test/InMemory.FunctionalTests/ChunkedRequestTests.cs b/src/Servers/Kestrel/test/InMemory.FunctionalTests/ChunkedRequestTests.cs index 46a364c586de..34428961e022 100644 --- a/src/Servers/Kestrel/test/InMemory.FunctionalTests/ChunkedRequestTests.cs +++ b/src/Servers/Kestrel/test/InMemory.FunctionalTests/ChunkedRequestTests.cs @@ -9,6 +9,7 @@ using System.Linq; using System.Text; using System.Threading.Tasks; +using Microsoft.AspNetCore.Hosting.Server; using Microsoft.AspNetCore.Http; using Microsoft.AspNetCore.Server.Kestrel.Core.Internal.Http; using Microsoft.AspNetCore.Server.Kestrel.InMemory.FunctionalTests.TestTransport; @@ -21,6 +22,70 @@ namespace Microsoft.AspNetCore.Server.Kestrel.InMemory.FunctionalTests; public class ChunkedRequestTests : LoggedTest { + [Theory] + [InlineData("2;\rxx\r\nxy\r\n0")] // \r in chunk extensions + [InlineData("2;\nxx\r\nxy\r\n0")] // \n in chunk extensions + public async Task RejectsInvalidChunkExtensions(string invalidChunkLine) + { + var testContext = new TestServiceContext(LoggerFactory); + + await using (var server = new TestServer(AppChunked, testContext)) + { + using (var connection = server.CreateConnection()) + { + await connection.Send( + "POST / HTTP/1.1", + "Host:", + "Transfer-Encoding: chunked", + "Content-Type: text/plain", + "", + invalidChunkLine, + "", + ""); + await connection.ReceiveEnd( + "HTTP/1.1 400 Bad Request", + "Content-Length: 0", + "Connection: close", + $"Date: {testContext.DateHeaderValue}", + "", + ""); + } + } + } + + [Theory] + [InlineData("2;a=b;b=c\r\nxy\r\n0")] // Multiple chunk extensions + [InlineData("2; \r\nxy\r\n0")] // Space in chunk extensions (BWS) + [InlineData("2;;;\r\nxy\r\n0")] // Multiple ';' in chunk extensions + [InlineData("2;novalue\r\nxy\r\n0")] // Name only chunk extension + //[InlineData("2 ;\r\nxy\r\n0")] // Technically allowed per spec, but we never supported it, and no one should be sending it + public async Task AllowsValidChunkExtensions(string chunkLine) + { + var testContext = new TestServiceContext(LoggerFactory); + + await using (var server = new TestServer(AppChunked, testContext)) + { + using (var connection = server.CreateConnection()) + { + await connection.Send( + "POST / HTTP/1.1", + "Host:", + "Transfer-Encoding: chunked", + "Content-Type: text/plain", + "", + chunkLine, + "", + ""); + await connection.Receive( + "HTTP/1.1 200 OK", + "Content-Length: 2", + $"Date: {testContext.DateHeaderValue}", + "", + "xy"); + } + } + } + private async Task App(HttpContext httpContext) { var request = httpContext.Request; @@ -1115,4 +1180,86 @@ await connection.Receive( } } } + + [Fact] + public async Task MultiReadWithInvalidNewlineAcrossReads() + { + // Inline so that we know when the first connection.Send has been parsed so we can send the next part + var testContext = new TestServiceContext(LoggerFactory) + { Scheduler = System.IO.Pipelines.PipeScheduler.Inline }; + + var tcs = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously); + + await using (var server = new TestServer(async httpContext => + { + var request = httpContext.Request; + var readTask = request.BodyReader.ReadAsync(); + tcs.TrySetResult(); + var readResult = await readTask; + request.BodyReader.AdvanceTo(readResult.Buffer.End); + }, testContext)) + { + using (var connection = server.CreateConnection()) + { + await connection.SendAll( + "GET / HTTP/1.1", + "Host:", + "Transfer-Encoding: chunked", + "", + "1;\r"); + await tcs.Task; + await connection.SendAll( + "\r"); + + await connection.ReceiveEnd( + "HTTP/1.1 400 Bad Request", + "Content-Length: 0", + "Connection: close", + $"Date: {testContext.DateHeaderValue}", + "", + ""); + } + } + } + + [Fact] + public async Task InvalidNewlineInFirstReadWithPartialChunkExtension() + { + // Inline so that we know when the first connection.Send has been parsed so we can send the next part + var testContext = new TestServiceContext(LoggerFactory) + { Scheduler = System.IO.Pipelines.PipeScheduler.Inline }; + + var tcs = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously); + + await using (var server = new TestServer(async httpContext => + { + var request = httpContext.Request; + var readTask = request.BodyReader.ReadAsync(); + tcs.TrySetResult(); + var readResult = await readTask; + request.BodyReader.AdvanceTo(readResult.Buffer.End); + }, testContext)) + { + using (var connection = server.CreateConnection()) + { + await connection.SendAll( + "GET / HTTP/1.1", + "Host:", + "Transfer-Encoding: chunked", + "", + "1;\n"); + await tcs.Task; + await connection.SendAll( + "t"); + + await connection.ReceiveEnd( + "HTTP/1.1 400 Bad Request", + "Content-Length: 0", + "Connection: close", + $"Date: {testContext.DateHeaderValue}", + "", + ""); + } + } + } }