Closed
Description
When FastHTTP receives a header value suffixed or prefixed with tabs, they should be stripped according to the RFCs. This is what nearly all other HTTP implementations do, including AIOHTTP, Apache httpd, Cheroot, Go net/http, H2O, HAProxy, Hyper, Hypercorn, Jetty, Libsoup, Lighttpd, Mongoose, Netty, Node.js, LiteSpeed, Passenger, Tomcat, Tornado, Twisted, Unicorn, Uvicorn, Waitress, and WEBrick.
Instead, FastHTTP allows the tabs to persist into the header value.
This can be confirmed by
- running a FastHTTP server that echos header values (like this one),
- sending it a request with a header value prefixed and suffixed with tabs, and extracting the echoed header value:
printf 'GET / HTTP/1.1\r\nHost: whatever\r\nTest: \t abc \t\r\n\r\n' \
| nc localhost 80 | grep '"headers"' \
| jq '.["headers"][1][1]' \
| xargs echo \
| base64 -d \
| xxd
00000000: 0920 6162 6320 09 . abc .
Notably, spaces are correctly stripped. Presumably, the patch should change this function to strip tabs in addition to spaces.