seanmonstar / seanmonstar/httparse

`Request::parse()` accepts invalid methods.

Open
#196 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
713
Forks
135
PR merge metrics
No merged PRs in 30d

Description

This issue seems to be related to https://github.com/seanmonstar/httparse/issues/161.


Consider this example :

#[test]
fn invalid_methods() {
    let src = "\"some,unvalid%GET{}:; / HTTP/1.1\r\nHost: 127.0.0.1:80\r\n\r\n";

    let mut headers = [httparse::EMPTY_HEADER; 32];
    let mut req = httparse::Request::new(&mut headers);

    let status = req.parse(src.as_bytes()).unwrap();
    assert!(status.is_complete());
    assert_eq!(req.method, Some("\"some,unvalid%GET{}:;"))
}

From the MDN and my understanding of the RFC, methods MUST be defined by the following grammar:

tchar = "!" / "#" / "$" / "%" / "&" / "'" / "*" / "+" / "-" / "." /
        "^" / "_" / "`" / "|" / "~" / DIGIT / ALPHA

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at the httparse::Request::parse entry point and reproduce the inline invalid_methods test from the issue. Compare method parsing with the cited RFC tchar grammar. Done means the example no longer accepts characters outside that grammar, with a regression test covering the reported input.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.