Acting on incomplete headers
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 25/100
- Issue type
- Bug
- Clarity
- Needs clarification
- Activity status
- Stale
- Domain
- networking, security
Research direction
Start by reviewing issue #416 and the cited RFC 7230 section on incomplete header blocks. Reproduce the behavior with the provided netcat command in the listed browsers, then determine the Fetch Standard change and interoperability criteria needed to define this as resolved.
Written by the indexing model from the issue text.
Description
From #416.
Browsers seem to act upon partial response header blocks, which might introduce security issues. In particular, some will follow a redirect without getting the final separating \n, either upon a timeout or connection close.
For example, given:
printf "HTTP/1.1 301 Redirect\nLocation: https://evil.com/\n" | nc -l -p 8002 -c
Firefox 51 and Chrome 55 will redirect to evil.com upon connection close (-c).
Safari 10 will also navigate to evil.com upon connection close, although there appears to be a timer or race condition; you have to omit -c and manually kill nc after the request is sent.
HTTP talks about this here:
If a response terminates in the middle of the header section (before the empty line is received) and the status code might rely on header fields to convey the full meaning of the response, then the client cannot assume that meaning has been conveyed; the client might need to repeat the request in order to determine what action to take next.
cc @mcmanus
- Dominant language
- HTML
- Stars
- 2.3k
- Forks
- 403
- Avg merge
- 21h 16m
- Merged PRs (30d)
- 4
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from whatwg/fetch
-
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
addition/proposal needs implementer interest
Difficulty 5/5 Over a week Newbie friendliness 30/100
-
Fetch Posture Open
Difficulty 5/5 Over a week Newbie friendliness 20/100
-
addition/proposal needs implementer interest
Difficulty 5/5 Over a week Newbie friendliness 35/100
Similar issues
-
kind/bug Ubuntu 24
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
kubernetes-sigs/kubespray#13532 ·
-
language/en needs-triage sig/network
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
kubernetes/website#57642 · 1 comment ·
-
app.loanspq.com OpenN: AdGuard DNS P3: Medium T: Incorrect Blocking
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
AdguardTeam/AdguardFilters#242018 ·
-
[adam] AdamNet network read doesn't cap to MAX_ADAM_PACKET_LEN, overflows client receive buffers Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
FujiNetWIFI/fujinet-firmware#1649 · 2 comments ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
daeuniverse/dae#1116 · 1 comment ·