Skip to content

http: reject messages with both Transfer-Encoding and Content-Length - #15047

Open
xia-chao wants to merge 1 commit into
bytecodealliance:mainfrom
xia-chao:serve-cl-te
Open

xia-chao wants to merge 1 commit into
bytecodealliance:mainfrom
xia-chao:serve-cl-te

Conversation

@xia-chao

@xia-chao xia-chao commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

Requests and responses that carry both transfer-encoding and content-length are rejected before they reach the guest: 400 for a request and an HttpProtocolError for a response.

Hyper passes both headers through, so a guest was getting a content-length that did not match the body it read.

@xia-chao
xia-chao requested review from a team as code owners October 28, 2026 17:26
@xia-chao
xia-chao requested review from cfallin and rvolosatovs and removed request for a team October 28, 2026 17:26
@xia-chao xia-chao changed the title serve: reject requests with both Transfer-Encoding and Content-Length server: reject requests with both Transfer-Encoding and Content-Length Oct 29, 2026

@pchickey pchickey left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If we're going to do this we also need to take care of the case where a response is received on the HTTP client which is malformed in this way (in that case, client should return an HttpProtocolError)

@xia-chao xia-chao changed the title server: reject requests with both Transfer-Encoding and Content-Length http: reject messages with both Transfer-Encoding and Content-Length Oct 30, 2026
@xia-chao
xia-chao force-pushed the serve-cl-te branch 3 times, most recently from 3a53d81 to caa099a Compare October 30, 2026 12:04
Requests and responses carrying both headers are rejected before
the guest sees them.
@xia-chao

Copy link
Copy Markdown
Contributor Author

the duplicate content length tests relied on a TE+CL response, so i changed the fixture

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants