HttpRuleParser GetExpressionLength allows invalid characters.
- Dominant language
- C#
- Stars
- 38.4k
- Forks
- 10.9k
- Avg merge
- 2d 6h
- Merged PRs (30d)
- 290
Description
_From @jkotalik on Tuesday, August 22, 2017 4:19:40 PM_
@Tratcher and I discovered that [GetExpressionLength in HttpRuleParser](https://github.com/aspnet/HttpAbstractions/blob/dev/src/Microsoft.Net.Http.Headers/HttpRuleParser.cs#L257) allows invalid characters (including control characters in expressions. GetExpressionLength mentions [that we don't really care about the content of a quoted string](https://github.com/aspnet/HttpAbstractions/blob/dev/src/Microsoft.Net.Http.Headers/HttpRuleParser.cs#L250-L251), however it seems appropriate that if a quoted string has an invalid character, it should throw on parsing here, not in Kestrel (or whatever server).
This would be a breaking change, as it would introduce a new place where an exception is thrown, however it is probably the right behavior.
_Copied from original issue: aspnet/HttpAbstractions#923_
Contributor guide
Assessment
This issue has not been assessed yet.