envoyproxy / envoyproxy/envoy

UHV: Runtime or config knobs for known behavioral differences

Open
#26,642 0 comments 0 reactions 0 assignees View on GitHub
area/header_validator enhancement no stalebot
Dominant language
C++
Stars
28.9k
Forks
5.6k
Avg merge
1d 20h
Merged PRs (30d)
437

Description

Runtime or config flags for the known behavioral differences in UHV:

Path normalization:

- [x] Preserve the case of hexadecimal digits within %-encoded triplets (UHV makes them uppercase)
- [x] Allow malformed %-encoded triplets (UHV rejects requests with malformed %-encoded sequences)
- [x] Translate `\` to `/` (UHV rejects with 400 requests with `\` in the URL path)
- [ ] Fix nested %-encoded sequences by changing leading % to %25 (UHV rejects requests with malformed %-encoded sequences)
- [x] %-encode and allow all characters with codepoints >= 0x80 for H/2
- [x] Allow unencoded space or TAB in path for H/2 and H/3
- [x] Allow " < > [ ] ^ ` { } \ | # in URL path
- [x] reject requests with %00 sequence when path_normalization is enabled.

Header validation:

- [ ] Allow any case `:scheme` for H/2
- [ ] Restrict the `:method` header to specific values for H/1
- [ ] The `:authority` header validation compatible with nghttp2
- [ ] Reject the `*` URI path unconditionally
- [ ] Allow leading and trailing whitespace in H/2 header values.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.