Parsing issue of Duplicate Chunked Transfer-Encoding #3861
Description
Version
12717d1
Platform
Ubuntu 11.4.0-1ubuntu1~22.04
Description
Hello, I may have found a bug in hyper's parsing of HTTP requests with duplicate chunked Transfer-Encoding.
RFC 9112 says these:
A sender MUST NOT apply the chunked transfer coding more than once to a message body (i.e., chunking an already chunked message is not allowed).
A server that receives a request message with a transfer coding it does not understand SHOULD respond with
501 (Not Implemented).
Although the RFC only restricts the sender (A sender MUST NOT apply the chunked transfer coding more than once to a message body), this should imply that duplicate chunked Transfer-Encoding is incorrect. The server may reject the request with 501 (Not Implemented) or 400 (Bad Request).
However, hyper does not reject such requests. For example:
POST / HTTP/1.1\r\n
Host: victim.com\r\n
Transfer-Encoding: chunked, chunked\r\n
\r\n
0\r\n
\r\n
$ echo -ne "POST / HTTP/1.1\r\nHost: victim.com\r\nTransfer-Encoding: chunked, chunked\r\n\r\n0\r\n\r\n" | nc 172.18.0.9 80
HTTP/1.1 200 OK
content-length: 161
date: Thu, 20 Mar 2025 11:59:52 GMT
{"method":"UE9TVA==","version":"MS4x","uri":"Lw==","headers":[["aG9zdA==","dmljdGltLmNvbQ=="],["dHJhbnNmZXItZW5jb2Rpbmc=","Y2h1bmtlZCwgY2h1bmtlZA=="]],"body":""}