Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

http: disallow > 3-digit response codes #7641

Closed
wants to merge 4 commits into from
Closed

Conversation

@bagder
Copy link
Member

@bagder bagder commented Aug 26, 2021

Make the built-in HTTP parser behave similar to hyper and reject any
HTTP response using more than 3 digits for the response code.

Updated test 1432 accordingly.
Enabled test 1432 in the hyper builds.

@bagder bagder changed the title http: disallow 4-digit response codes http: disallow > 3-digit response codes Aug 26, 2021
lib/http.c Outdated
if(baddigit != -1) {
failf(data, "Unsupported response code in HTTP response");
return CURLE_UNSUPPORTED_PROTOCOL;
}
Copy link
Member

@danielgustafsson danielgustafsson Aug 26, 2021

Shouldn't this also inspect nc to just to be on the safe side?

Copy link
Member Author

@bagder bagder Aug 26, 2021

Hm, maybe that's better for readability but surely baddigit cannot be assigned anything if the other fields didn't already get stored?

Copy link
Member Author

@bagder bagder Aug 26, 2021

ah no, the check below will be skipped ... updating!

Copy link
Member Author

@bagder bagder Aug 26, 2021

I went with an explanatory comment instead. What do you think @danielgustafsson ?

Copy link
Member

@danielgustafsson danielgustafsson Aug 26, 2021

LGTM

Make the built-in HTTP parser behave similar to hyper and reject any
HTTP response using more than 3 digits for the response code.

Updated test 1432 accordingly.
Enabled test 1432 in the hyper builds.

Closes #7641
@bagder bagder force-pushed the bagder/http-4digit-response branch from eefd539 to 5a82f54 Aug 26, 2021
@bagder bagder closed this in 5dc594e Aug 26, 2021
@bagder bagder deleted the bagder/http-4digit-response branch Aug 26, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked issues

Successfully merging this pull request may close these issues.

None yet

2 participants