dotnet / dotnet/aspnetcore

HttpRuleParser GetExpressionLength allows invalid characters.

Open
#2,694 2 comments 0 reactions 0 assignees View on GitHub
affected-few area-networking bug feature-http-abstractions help wanted severity-minor
Dominant language
C#
Stars
38.4k
Forks
10.9k
Avg merge
2d 6h
Merged PRs (30d)
290

Description

_From @jkotalik on Tuesday, August 22, 2017 4:19:40 PM_

@Tratcher and I discovered that [GetExpressionLength in HttpRuleParser](https://github.com/aspnet/HttpAbstractions/blob/dev/src/Microsoft.Net.Http.Headers/HttpRuleParser.cs#L257) allows invalid characters (including control characters in expressions. GetExpressionLength mentions [that we don't really care about the content of a quoted string](https://github.com/aspnet/HttpAbstractions/blob/dev/src/Microsoft.Net.Http.Headers/HttpRuleParser.cs#L250-L251), however it seems appropriate that if a quoted string has an invalid character, it should throw on parsing here, not in Kestrel (or whatever server).

This would be a breaking change, as it would introduce a new place where an exception is thrown, however it is probably the right behavior.

_Copied from original issue: aspnet/HttpAbstractions#923_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.