RFC 9112 §3.1 defines the request-line as:
method SP request-target SP HTTP-version CRLF
A literal (unencoded) space is not a valid character in a request-target. A server receiving such a request should respond with 400 Bad Request.
darkhttpd's parse_request() stops URL parsing at the first space, silently truncates the URL there, and treats the next token as the HTTP version. For a request like:
…it parses /foo as the URL and bar as the protocol version, returning 404 instead of 400.
This has a secondary security implication: a field name embedded in the URL (e.g. GET /X-Forwarded-For: evil HTTP/1.1) is present in the raw request buffer and could be matched by code doing substring searches over the full buffer.
RFC 9112 §3.1 defines the request-line as:
A literal (unencoded) space is not a valid character in a request-target. A server receiving such a request should respond with 400 Bad Request.
darkhttpd's
parse_request()stops URL parsing at the first space, silently truncates the URL there, and treats the next token as the HTTP version. For a request like:…it parses
/fooas the URL andbaras the protocol version, returning 404 instead of 400.This has a secondary security implication: a field name embedded in the URL (e.g.
GET /X-Forwarded-For: evil HTTP/1.1) is present in the raw request buffer and could be matched by code doing substring searches over the full buffer.