Should there be a way to block requests with multiple hosts or none are sent?
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 1.9k
- Forks
- 237
- PR merge metrics
- No merged PRs in 30d
Description
I came across an issue on aiohttp that utilizes this library with Cython but it seems that multiple hosts or hosts being empty may not be an acceptable thing in the future and may be more of a bug/vulnerability. https://github.com/aio-libs/aiohttp/issues/10600 I was wondering if maybe I should develop another lenient flag to this typescript/C library that can be enabled or disabled for blocking multiple hosts from being accepted or not or being empty without it?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No source file or test is named in the issue. Start by reading the linked aiohttp issue and tracing how llhttp currently handles requests with multiple or empty Host values. Done should include a decided strict or lenient behavior, an explicit configuration choice if needed, and tests covering both cases.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, typescript
- Domain
- backend-api-design, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Quiet
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100