Close the client connection after faulty response framing

A response framed by Transfer-Encoding next to a Content-Length, or an
HTTP/1.0 response with Transfer-Encoding, left the connection open for
the next request, though RFC 9112 6.1 has such framing treated as faulty
and the connection closed after it. Close it, with the check the server
makes for requests now shared.
This commit is contained in:
yhirose committed 2026-10-16 21:38:40 -04:00
1 parent 9a3c1febee
commit f18f0b7576
2 files changed
+41 -9

No files matched your search

+23
View File
@@ -22664,6 +22664,29 @@ TEST(ClientResponseSmugglingTest, BodylessResponseNotRejected) {
}
}
// RFC 9112 6.1: Transfer-Encoding next to a Content-Length, or in an HTTP/1.0
// response, is faulty framing, so the connection is not reused after it.
TEST(ClientResponseSmugglingTest, FaultyTransferEncodingClosesConnection) {
for (const char *response : {"HTTP/1.1 200 OK\r\n"
"Content-Length: 0\r\n"
"Transfer-Encoding: chunked\r\n"
"\r\n"
"5\r\nhello\r\n0\r\n\r\n",
"HTTP/1.0 200 Connection established\r\n"
"Connection: keep-alive\r\n"
"Transfer-Encoding: chunked\r\n"
"\r\n"
"5\r\nhello\r\n0\r\n\r\n"}) {
with_single_response(response, [&](Client &cli) {
cli.set_keep_alive(true);
auto res = cli.Get("/");
ASSERT_TRUE(res) << response;
EXPECT_EQ("hello", res->body);
EXPECT_FALSE(cli.is_socket_open()) << response;
});
}
}
// A payload max length of 0 means no limit, however the body is framed.
TEST(PayloadMaxLengthZeroTest, ClientReadsChunkedAndUnframedResponse) {
for (const char *response : {"HTTP/1.1 200 OK\r\n"