CGI script using LF line breaks in headers causes error
Nobody has claimed this yet.
- Dominant language
- Ruby
- Stars
- 327
- Forks
- 112
- Avg merge
- 4h 2m
- Merged PRs (30d)
- 1
Description
The change introduced in #138 disallows bare LFs in headers and request lines. This change is good, but it also affects CGIHandler, causing scripts that use bare LF as a header separator to fail. However, according to RFC 3875, unlike HTTP, bare LFs are allowed in CGI header syntax.
For example, the following CGI script will fail when run under WEBrick 1.8 and later:
#!/usr/bin/ruby
print "Content-Type: text/html\n"
print "\n"
print "<html>example</html>"
In this case, the error message displayed in the browser is:
bad header 'Content-Type: text/html '.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing CGIHandler's header parsing and reviewing the change from #138 that rejects bare LF characters. Reproduce the failure with the Ruby CGI script shown in the issue, then verify that RFC 3875-style LF-separated headers are accepted without weakening validation for ordinary HTTP headers.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- ruby
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100