Twisted does not properly strip whitespace from the ends of HTTP header values

Open
#12,504 3 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
42/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
python
Domain
networking

Research direction

Start at Twisted's HTTP/1.1 header parser and reproduce the issue with the provided ncat command, using the linked server.py as the echo server. The fix is done when trailing spaces and tabs are excluded even when extra carriage returns occur, with a regression test covering that input.

Written by the indexing model from the issue text.

Description

bug

The Bug

Twisted's HTTP/1.1 header parser does not properly strip trailing whitespace from header values.

Reproduction Steps

  1. Start a Twisted HTTP/1.1 server that echoes received header values, such as this one.
  2. Send it a request with a header that ends in one or more spaces or tabs, followed by one or more carriage returns (in addition to the CRLF pair that ends the header), and observe that the spaces/tabs are interprete as part of the header value:
printf 'GET / HTTP/1.1\r\nHost: a\r\nExtra-Whitespace-Here: whatever \t \t \t \r\r\n\r\n' | \
    timeout 1 ncat --no-shutdown localhost 80 | \
    grep '"headers"' | \
    jq '.headers[1][1]' | \
    xargs echo | \
    base64 -d | \
    od -tcx1

0000000   w   h   a   t   e   v   e   r      \t      \t      \t
         77  68  61  74  65  76  65  72  20  09  20  09  20  09  20
0000017

Note that the spaces and tabs remain. (If you remove the extra carriage return, you'll notice that the spaces and tabs are stripped appropriately.)

Correct Behavior

From RFC 9112:

A field line value might be preceded and/or followed by optional whitespace (OWS); a single SP preceding the field line value is preferred for consistent readability by humans. The field line value does not include that leading or trailing whitespace: OWS occurring before the first non-whitespace octet of the field line value, or after the last non-whitespace octet of the field line value, is excluded by parsers when extracting the field line value from a field line.

Environment

Linux f85ab701084c 6.12.34-1-lts #1 SMP PREEMPT_DYNAMIC Thu, 19 Jun 2025 15:05:14 +0000 x86_64 GNU/Linux
Debian 13
Dominant language
Python
Stars
6k
Forks
1.2k
Avg merge
2d 10h
Merged PRs (30d)
10

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from twisted/twisted

All issues in twisted/twisted

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.