You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
This was brought about by certain whitespace characters being allowed
that are not allowed in the HTTP standard.
Waitress would dutifully strip those whitespace characters and continue
on as if nothing mattered, however whitespace in HTTP messages does
matter and could allow for HTTP request smuggling if the front-end proxy
server does not agree with the back-end server on how to parse a HTTP
message.
This disallows things like this:
Content-Length: 10
Transfer-Encoding:[0x0b]chunked
Which would get parsed by a front-end server as a request with
Content-Length 10, and an invalid Transfer-Encoding header, but would
get parsed as a chunked request by Waitress.
0 commit comments