Fossil SCM
Reject any transfer-encoding other than exactly "chunked".
Commit
b176932214d30d23871fd803234c5da5fb756ae7ac17266d8183492a3dcb7bd0
Parent
095976a13e6f364…
1 file changed
+12
-5
+12
-5
| --- src/http.c | ||
| +++ src/http.c | ||
| @@ -615,16 +615,23 @@ | ||
| 615 | 615 | closeConnection = 0; |
| 616 | 616 | }else if( fossil_strnicmp(zLine, "content-length:", 15)==0 ){ |
| 617 | 617 | for(i=15; fossil_isspace(zLine[i]); i++){} |
| 618 | 618 | iLength = atoi(&zLine[i]); |
| 619 | 619 | }else if( fossil_strnicmp(zLine, "transfer-encoding:", 18)==0 ){ |
| 620 | - /* RFC 7230: "chunked" must be the final transfer-coding so only | |
| 621 | - ** match when it appears at the end of the line. */ | |
| 622 | - if( sqlite3_strlike("%chunked", &zLine[18], 0)==0 ){ | |
| 623 | - size_t nx = strlen(&zLine[18]); | |
| 624 | - if( !fossil_isalnum(zLine[nx+10]) ) isChunked = 1; | |
| 620 | + /* Fossil never sends a "transfer-encoding:" request header, so we may | |
| 621 | + ** reject any encoding other than "chunked", including "gzip, chunked", | |
| 622 | + ** "superchunked", "deflate" etc. */ | |
| 623 | + int bOk = 0; | |
| 624 | + for(i=18; fossil_isspace(zLine[i]); i++){} | |
| 625 | + if( fossil_strnicmp(&zLine[i], "chunked", 7)==0 ){ | |
| 626 | + bOk = zLine[i+7]==0; | |
| 627 | + } | |
| 628 | + if( !bOk ){ | |
| 629 | + fossil_warning("unsupported transfer-encoding: %s", &zLine[18]); | |
| 630 | + goto write_err; | |
| 625 | 631 | } |
| 632 | + isChunked = 1; | |
| 626 | 633 | }else if( fossil_strnicmp(zLine, "connection:", 11)==0 ){ |
| 627 | 634 | if( sqlite3_strlike("%close%", &zLine[11], 0)==0 ){ |
| 628 | 635 | closeConnection = 1; |
| 629 | 636 | }else if( sqlite3_strlike("%keep-alive%", &zLine[11], 0)==0 ){ |
| 630 | 637 | closeConnection = 0; |
| 631 | 638 |
| --- src/http.c | |
| +++ src/http.c | |
| @@ -615,16 +615,23 @@ | |
| 615 | closeConnection = 0; |
| 616 | }else if( fossil_strnicmp(zLine, "content-length:", 15)==0 ){ |
| 617 | for(i=15; fossil_isspace(zLine[i]); i++){} |
| 618 | iLength = atoi(&zLine[i]); |
| 619 | }else if( fossil_strnicmp(zLine, "transfer-encoding:", 18)==0 ){ |
| 620 | /* RFC 7230: "chunked" must be the final transfer-coding so only |
| 621 | ** match when it appears at the end of the line. */ |
| 622 | if( sqlite3_strlike("%chunked", &zLine[18], 0)==0 ){ |
| 623 | size_t nx = strlen(&zLine[18]); |
| 624 | if( !fossil_isalnum(zLine[nx+10]) ) isChunked = 1; |
| 625 | } |
| 626 | }else if( fossil_strnicmp(zLine, "connection:", 11)==0 ){ |
| 627 | if( sqlite3_strlike("%close%", &zLine[11], 0)==0 ){ |
| 628 | closeConnection = 1; |
| 629 | }else if( sqlite3_strlike("%keep-alive%", &zLine[11], 0)==0 ){ |
| 630 | closeConnection = 0; |
| 631 |
| --- src/http.c | |
| +++ src/http.c | |
| @@ -615,16 +615,23 @@ | |
| 615 | closeConnection = 0; |
| 616 | }else if( fossil_strnicmp(zLine, "content-length:", 15)==0 ){ |
| 617 | for(i=15; fossil_isspace(zLine[i]); i++){} |
| 618 | iLength = atoi(&zLine[i]); |
| 619 | }else if( fossil_strnicmp(zLine, "transfer-encoding:", 18)==0 ){ |
| 620 | /* Fossil never sends a "transfer-encoding:" request header, so we may |
| 621 | ** reject any encoding other than "chunked", including "gzip, chunked", |
| 622 | ** "superchunked", "deflate" etc. */ |
| 623 | int bOk = 0; |
| 624 | for(i=18; fossil_isspace(zLine[i]); i++){} |
| 625 | if( fossil_strnicmp(&zLine[i], "chunked", 7)==0 ){ |
| 626 | bOk = zLine[i+7]==0; |
| 627 | } |
| 628 | if( !bOk ){ |
| 629 | fossil_warning("unsupported transfer-encoding: %s", &zLine[18]); |
| 630 | goto write_err; |
| 631 | } |
| 632 | isChunked = 1; |
| 633 | }else if( fossil_strnicmp(zLine, "connection:", 11)==0 ){ |
| 634 | if( sqlite3_strlike("%close%", &zLine[11], 0)==0 ){ |
| 635 | closeConnection = 1; |
| 636 | }else if( sqlite3_strlike("%keep-alive%", &zLine[11], 0)==0 ){ |
| 637 | closeConnection = 0; |
| 638 |