From f405ef11fde6ed749318a844c010ce97483a8f98 Mon Sep 17 00:00:00 2001 From: Sergey Kandaurov Date: Tue, 25 Nov 2025 02:06:29 +0400 Subject: Disabled bare LF in chunked transfer encoding. Chunked transfer encoding, since originally introduced in HTTP/1.1 in RFC 2068, is specified to use CRLF as the only line terminator. Although tolerant applications may recognize a single LF, formally this covers the start line and fields, and doesn't apply to chunks. Strict chunked parsing is reaffirmed as intentional in RFC errata ID 7633, notably "because it does not have to retain backwards compatibility with 1.0 parsers". A general RFC 2616 recommendation to tolerate deviations whenever interpreted unambiguously doesn't apply here, because chunked body is used to determine HTTP message framing; a relaxed parsing may cause various security problems due to a broken delimitation. For instance, this is possible when receiving chunked body from intermediates that blindly parse chunk-ext or a trailer section until CRLF, and pass it further without re-coding. --- src/http/modules/ngx_http_proxy_module.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'src/http/modules') diff --git a/src/http/modules/ngx_http_proxy_module.c b/src/http/modules/ngx_http_proxy_module.c index d3836602e..5e6b0c434 100644 --- a/src/http/modules/ngx_http_proxy_module.c +++ b/src/http/modules/ngx_http_proxy_module.c @@ -2119,7 +2119,7 @@ ngx_http_proxy_input_filter_init(void *data) /* chunked */ u->pipe->input_filter = ngx_http_proxy_chunked_filter; - u->pipe->length = 3; /* "0" LF LF */ + u->pipe->length = 5; /* "0" CRLF CRLF */ u->input_filter = ngx_http_proxy_non_buffered_chunked_filter; u->length = 1; -- cgit