Match Brotli and Zstandard content codings as whole tokens

is_brotli_encoding() and is_zstd_encoding() searched the Content-Encoding
value for "br" and "zstd" as substrings, while is_zlib_encoding() beside them
compared the whole value. So "fibre" and "librarian" were read as Brotli and
"x-zstd-ish" as Zstandard, and "gzip, br" -- a value naming two codings, which
cpp-httplib does not support -- was labeled Brotli and run through a Brotli
decompressor over gzip data.

RFC 9110 8.4.1 defines a content coding as a token, so compare the whole value
case-insensitively as the zlib check already does. A value naming several
codings no longer matches any of them and takes the pass-through path
prepare_content_receiver() already documents for an unrecognized coding.

contains_case_ignore() has no callers left.
This commit is contained in:
yhirose committed 2026-08-18 21:05:22 -04:00
1 parent 881842cd72
commit e8887d98e9
2 files changed
+48 -9

No files matched your search

+2 -9
View File
@@ -7642,13 +7642,6 @@ inline bool zstd_decompressor::decompress(const char *data, size_t data_length,
}
#endif
inline bool contains_case_ignore(const std::string &s, const char *token) {
auto token_end = token + std::strlen(token);
return std::search(s.begin(), s.end(), token, token_end, [](char a, char b) {
return case_ignore::to_lower(a) == case_ignore::to_lower(b);
}) != s.end();
}
// Content codings are case-insensitive (RFC 9110 8.4.1). Matching them
// case-sensitively would make a response labeled e.g. "GZIP" look like an
// unknown coding, and its payload would be handed back still compressed.
@@ -7658,11 +7651,11 @@ inline bool is_zlib_encoding(const std::string &encoding) {
}
inline bool is_brotli_encoding(const std::string &encoding) {
return contains_case_ignore(encoding, "br");
return case_ignore::equal(encoding, "br");
}
inline bool is_zstd_encoding(const std::string &encoding) {
return contains_case_ignore(encoding, "zstd");
return case_ignore::equal(encoding, "zstd");
}
// Returns true if the content coding is one cpp-httplib is able to decompress