Skip to content

remove whitespace in transfer-encoding - #3369

Open
pajod wants to merge 2 commits into
benoitc:masterfrom
pajod:transfer-encoding-whitespace
Open

remove whitespace in transfer-encoding#3369
pajod wants to merge 2 commits into
benoitc:masterfrom
pajod:transfer-encoding-whitespace

Conversation

@pajod

@pajod pajod commented Mar 20, 2025

Copy link
Copy Markdown
Contributor

HTTP parser Whitespace cleanup

  1. one no-op replacement
  2. one variable reuse after casting to tuple, to clarify these are still just SP and HTAB
  3. another no-op replacement
  4. a meaningful change for Gunicorn incorrectly strips certain characters from transfer-codings #3364
    • N.B. this still disallows Content-Encoding: identity, (trailing comma), probably a robust choice
    • no longer meaningful after 2073e13 - \x0b is rejected by the new RFC9110_5_5_INVALID_AND_DANGEROUS
    • N.B. responding 501 is not what the original reporter recommended - but differentiating invalid and unsupported is is complicated because of potential parameters, and I do no see how the difference matters.
  5. a no-op replacement in checking the CONNECTION header.. which should probably just be dropped. How could v != v.strip(" \t") legitimately happen, unless something was wrong with obsolete folding?

Searching for strip() revealed additional references in cfg.strip_header_spaces (known dangerous) in util.is_hoppish() (unreachable after 72238fc - left as-is but did add the extra header rfc9112 tells us to drop) and in the websockets example (not reviewed yet).

References:

@pajod pajod moved this to Awaiting: 1st review in @pajod Gunicorn issue sorting table Mar 21, 2025
@pajod pajod moved this from Awaiting: 1st review to Security in @pajod Gunicorn issue sorting table Mar 21, 2025
@pajod pajod mentioned this pull request Apr 8, 2025
8 tasks
@pajod pajod changed the title remove whitspace in transfer-encoding remove whitespace in transfer-encoding Apr 8, 2025
@pajod
pajod force-pushed the transfer-encoding-whitespace branch from ac53840 to 1dfb849 Compare July 8, 2026 18:58
Comment on lines +3 to +4
Connection: keep-alive\r\n
\r\n

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't see any legitimate use for this. I suggest Gunicorn removes the .strip() call.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant