Repository navigation
feat: incremental request parser (smuggling-prone rejections) - #6
Merged
Merged
Conversation
Push-style parser owning its buffer: feed()/next()/reset() keep-alive with pipelining, byte-exact across split feeds. Enforces maxHeadBytes/maxBodyBytes/maxHeaderCount before consuming bodies. Rejections: bare-LF line endings, obsolete folding, header line without colon, duplicate Content-Length, Content-Length with Transfer-Encoding, non-token method/name chars, non-digit CL, non-1.0/1.1 versions. keepAlive() token-list aware; close wins.
Traps found while testing: explicit ctor + '= {}' default arg is ill-formed (copy-list-init); head-size guard must only fire while the terminator is still missing or body bytes falsely trip it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
http::RequestParser: push parser (feed → next → reset), buffer-owning, pipelining-safe.maxHeadBytes(64K),maxBodyBytes(8M),maxHeaderCount(100) — CL rejected at header time, before body bytes arrive.Content-Length, CL+TE together, TE (chunked bodies deferred), no-colon lines, non-token method/name chars, non-digit CL, versions ≠ 1.0/1.1.keepAlive(): comma-list Connection header;closewins; 1.0 needs explicit keep-alive.Why now
Reactor (R) consumes exactly this interface; parser lands first so R stays reviewable.
Tests
ck.ps1: all passed (23 cases).