You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
In tfw_http_meth_str2id function we check first letter in chunk and the length of header and return method type according to it. It is totally wrong, because we return method 'PUT' if the real method was 'PAT' or 'POT'
and so on. This function should be reworked
The text was updated successfully, but these errors were encountered:
Why do we allow unknown methods at first place? Who uses such methods?
I believe we need to block all unknown methods on the HTTP parser and HPACK levels. This will make the parser faster, more robust and secure. See commit 73d30d4
This should be done as the transition to observability #2399
It makes sense to preserve the ability to proxy unknown headers, but yes, we should go with method PUT only if we explicitly parsed PUT, not PUTX or soemething like this.
In
tfw_http_meth_str2id
function we check first letter in chunk and the length of header and return method type according to it. It is totally wrong, because we return method 'PUT' if the real method was 'PAT' or 'POT'and so on. This function should be reworked
The text was updated successfully, but these errors were encountered: