Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix(http): enable httptools lenient data #2488

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

vvanglro
Copy link
Contributor

@vvanglro vvanglro commented Oct 17, 2024

Summary

#2486

Checklist

  • I understand that this PR may be closed in case there was no previous discussion. (This doesn't apply to typos!)
  • I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • I've updated the documentation accordingly.

…ndency- Set dangerous leniency for HTTP parsing to handle data received after connection close

- Upgrade httptools dependency from >=0.5.0 to >=0.6.3 for improved functionality and security
@vvanglro
Copy link
Contributor Author

@Kludex The process is hanging again. #2431

@Kludex
Copy link
Member

Kludex commented Oct 17, 2024

Can you explain a bit what we are doing here?

@Kludex
Copy link
Member

Kludex commented Oct 17, 2024

@Kludex The process is hanging again. #2431

I'll merge that after we fix this. 👍

@vvanglro
Copy link
Contributor Author

Can you explain a bit what we are doing here?

Use a relaxed approach to parsing messages.

@vvanglro
Copy link
Contributor Author

vvanglro commented Oct 18, 2024

If we follow the discussion in #2238 and the RFC standard we should use lenient mode to parse the data.
Until then, we have been using the lenient mode to parse the data.

From RFC 9112, section 9.6:

A server that receives a "close" connection option MUST initiate closure of the connection (see below) after it sends the final response to the request that contained the "close" connection option. The server SHOULD send a "close" connection option in its final response on that connection. The server MUST NOT process any further requests received on that connection.

@vvanglro
Copy link
Contributor Author

As a record.

Httptools v0.6.3 upgrades dependency llhttp from 8.1.1 to 9.2.1, due to the lenient mode used before llhttp v9.0, some messages could not be parsed and responded to in this upgrade.

The following is a list of methods that support lenient parsing in llhttp, facilitate subsequent troubleshooting and development of more lenient methods as needed.
https://github.com/nodejs/llhttp/tree/v9.2.1?tab=readme-ov-file#void-llhttp_set_lenient_headersllhttp_t-parser-int-enabled

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants