boostorg/beast
1
0
Fork 1
mirror of https://github.com/boostorg/beast.git synced 2026-08-03 20:14:17 +02:00
Code Issues Packages Projects Releases Wiki Activity

Unconditionally drop framing and connection-control fields carried in trailers

Browse Source
This commit is contained in:
Mohammad Nejati
2026-06-07 14:46:28 +00:00
committed by Mohammad Nejati
parent 60b4c2e3fc
commit 54a49706e4
2 changed files with 51 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
include/boost/beast/http/parser.hpp
+13
View File
@@ -498,11 +498,23 @@ private:
string_view value,
error_code& ec) override
{
// Drop fields not advertised in the Trailer header
if(! token_list{m_[field::trailer]}.exists(name_string))
return;
switch(name)
{
// Drop fields that govern message framing or connection handling
case field::connection:
case field::proxy_connection:
case field::upgrade:
case field::transfer_encoding:
case field::content_length:
case field::trailer:
case field::host:
return;
// Safe and well-known trailer fields
case field::digest: // RFC 3230, Section 2 (obsolete)
case field::content_digest: // RFC 9530, Section 2
case field::repr_digest: // RFC 9530, Section 3
@@ -513,6 +525,7 @@ private:
case field::link: // RFC 8288, Section 3
case field::alt_svc: // RFC 7838, Section 3
break;
default:
if(! merge_all_trailers_)
return;
test/beast/http/parser.cpp
+38
View File
@@ -441,6 +441,44 @@ public:
// Upgrade in the trailer must not mark the message as upgrade
BEAST_EXPECT(! p.upgrade());
}
// framing/connection control fields are dropped even when they
// are listed in `Trailer` and merge_all_trailers(true) is set
{
error_code ec;
parser_type<false> p;
p.eager(true);
p.merge_all_trailers(true);
p.put(
buf("HTTP/1.1 200 OK\r\n"
"Transfer-Encoding: chunked\r\n"
"Trailer: Connection, Proxy-Connection, Upgrade, "
"Transfer-Encoding, Content-Length, Trailer, Host\r\n"
"\r\n"
"0\r\n"
"Connection: close\r\n"
"Proxy-Connection: close\r\n"
"Upgrade: websocket\r\n"
"Transfer-Encoding: gzip\r\n"
"Content-Length: 42\r\n"
"Trailer: Evil\r\n"
"Host: evil.example\r\n"
"\r\n"),
ec);
BEAST_EXPECT(p.is_done());
// fields absent from the header must not be added
BEAST_EXPECT(! p.get().contains(field::connection));
BEAST_EXPECT(! p.get().contains(field::proxy_connection));
BEAST_EXPECT(! p.get().contains(field::upgrade));
BEAST_EXPECT(! p.get().contains(field::content_length));
BEAST_EXPECT(! p.get().contains(field::host));
// fields present in the header must not be duplicated
BEAST_EXPECT(p.get().count(field::transfer_encoding) == 1);
BEAST_EXPECT(p.get()[field::transfer_encoding] == "chunked");
BEAST_EXPECT(p.get().count(field::trailer) == 1);
}
}
void