Comma splitting doesn't work
Dreamsorcerer opened this issue · comments
I've been updating our Python parser (which we use as a fallback when llhttp is unavailable) to be up-to-date with RFC 9110/9112.
One thing I found missing in llhttp, is multi-value headers using commas. e.g. These 2 payloads should be considered equivalent:
Foo: 1
Foo: 2
Foo: 1,2
Relevant points in the spec:
https://www.rfc-editor.org/rfc/rfc9110.html#name-field-order
https://www.rfc-editor.org/rfc/rfc9110.html#section-5.5-8
https://www.rfc-editor.org/rfc/rfc9110.html#section-5.6.1.2-8
https://www.rfc-editor.org/rfc/rfc9110.html#section-10.2.2-13.1
https://www.rfc-editor.org/rfc/rfc9110.html#name-collected-abnf
The headers, it seems to me, that should not have this splitting done are:
Content-Location, Date, From, If-Modified-Since, If-Range, If-Unmodified-Since, Last-Modified, Location, Referer, Retry-After, Set-Cookie
Test cases I've come up with (including a couple of awkward edge cases):
'"http://example.com/a.html,foo", apples' => ["http://example.com/a.html,foo", "apples"]
'bananas, apples' => ["bananas", "apples"]
'"http://example.com/a.html,foo", "apples"' => ["http://example.com/a.html,foo", "apples"]
'"Sat, 04 May 1996", "Wed, 14 Sep 2005"' => ["Sat, 04 May 1996", "Wed, 14 Sep 2005"]
"foo,bar,baz" => ["foo", "bar", "baz"]
'"applebanna, this' => ['"applebanna', "this"]
'fooo", "bar"' => ['fooo"', "bar"]
" spam , eggs " => ["spam", "eggs"]
" , , " => INVALID (empty header)
Where the left side is a header value (inserted into a HTTP body) and right side is the expected header values that are returned.
I think I misinterpreted part of the spec.
You are right in saying that the payloads above should have been considered equivalent.
About llhttp, it does not copy or aggregates any message value (in any section) so the burden to choose whether to merge them or not is on the developer, which means that this issue is not applicable.
Yes, I realised that. Also realised that it is about joining the values into a single header, not splitting them.