7949480648
81%

Ran 18 Feb 2024 02:27PM UTC

Jobs 1

Files 35

Run time 3s

Badge

Embed ▾

Committed 18 Feb 2024 01:56PM UTC coverage: 81.07% (+0.01%) from 81.06%

Build # 7949480648

Build Type

push

github

Committed by

web-flow

Commit Message

Forbid 0x/+/-/whitespace prefixes on HTTP chunk sizes (#1542)

Currently, libevent's HTTP parser accepts and ignores 0x, +, and whitespace prefixes on chunk sizes. It also ignores - prefixes on chunk sizes of 0. This patch fixes that.

There is a potential danger in the current behavior, which is that there exist HTTP implementations that interpret chunk sizes as their longest valid prefix. For those implementations, 0xa (for example) is equivalent to 0, and this may present a request smuggling risk when those implementations are used in conjunction with libevent. However, as far I'm aware, there is no HTTP proxy that both interprets 0xa as 0 and forwards it verbatim, so I think this is a low-risk bug that is acceptable to report in public.

Run Details

12809 of 15800 relevant lines covered (81.07%)

603538.85 hits per line

Jobs

ID	Job ID	Ran	Files	Coverage
1	7949480648.1	18 Feb 2024 02:27PM UTC	0	81.07	GitHub Action Run

Source Files on build 7949480648

Detailed source file information is not available for this build.

libevent / libevent / 7949480648
81%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 7949480648

libevent / libevent / 7949480648 81%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Jobs

Source Files on build 7949480648

libevent / libevent / 7949480648
81%

README BADGES
x