diff options
| author | Sergey Kandaurov <pluknet@nginx.com> | 2025-11-25 02:06:29 +0400 |
|---|---|---|
| committer | Sergey Kandaurov <s.kandaurov@f5.com> | 2025-12-06 17:41:32 +0400 |
| commit | f405ef11fde6ed749318a844c010ce97483a8f98 (patch) | |
| tree | 768bcdebf28c159fea41489f7d316c161f8ce355 /src/http/modules | |
| parent | 0427f5335f7abfbb733a72d6bf3561508f5d8a88 (diff) | |
| download | nginx-f405ef11fde6ed749318a844c010ce97483a8f98.tar.gz nginx-f405ef11fde6ed749318a844c010ce97483a8f98.tar.bz2 | |
Disabled bare LF in chunked transfer encoding.
Chunked transfer encoding, since originally introduced in HTTP/1.1
in RFC 2068, is specified to use CRLF as the only line terminator.
Although tolerant applications may recognize a single LF, formally
this covers the start line and fields, and doesn't apply to chunks.
Strict chunked parsing is reaffirmed as intentional in RFC errata
ID 7633, notably "because it does not have to retain backwards
compatibility with 1.0 parsers".
A general RFC 2616 recommendation to tolerate deviations whenever
interpreted unambiguously doesn't apply here, because chunked body
is used to determine HTTP message framing; a relaxed parsing may
cause various security problems due to a broken delimitation.
For instance, this is possible when receiving chunked body from
intermediates that blindly parse chunk-ext or a trailer section
until CRLF, and pass it further without re-coding.
Diffstat (limited to 'src/http/modules')
| -rw-r--r-- | src/http/modules/ngx_http_proxy_module.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c index d3836602e..5e6b0c434 100644 --- a/src/http/modules/ngx_http_proxy_module.c +++ b/src/http/modules/ngx_http_proxy_module.c @@ -2119,7 +2119,7 @@ ngx_http_proxy_input_filter_init(void *data) /* chunked */ u->pipe->input_filter = ngx_http_proxy_chunked_filter; - u->pipe->length = 3; /* "0" LF LF */ + u->pipe->length = 5; /* "0" CRLF CRLF */ u->input_filter = ngx_http_proxy_non_buffered_chunked_filter; u->length = 1; |