elixir-mint / mint / 4e38b23d103001ff01c5e4cd81db5b7c38d6f8c0

88%

push

github

Fix CONNECT response framing and IPv6 authority in tunnel proxies (#493)

* Ignore content-length and transfer-encoding in 2xx responses to CONNECT

RFC 9110 (section 9.3.6) forbids these header fields in a successful
response to CONNECT and requires clients to ignore them when present.
The HTTP/1 parser treated them as regular body framing, so a proxy
replying to CONNECT with "200" plus "content-length: 0" - which some
real proxies send - emitted {:done, ref} as a body response, and
Mint.TunnelProxy rejected the tunnel with :unexpected_trailing_responses.

Any 2xx response to CONNECT is now body-less: the response is done at
the end of the header section and everything after it belongs to the
tunnel, so it stays in the buffer instead of being parsed.

* Bracket IPv6 addresses in the CONNECT authority

The authority-form request target requires IPv6 addresses to be
enclosed in square brackets (RFC 3986, section 3.2.2), but the tunnel
proxy sent "CONNECT ::1:443" for IPv6 targets, which proxies cannot
parse unambiguously.

6 of 6 new or added lines in 2 files covered. (100.0%)

1443 of 1642 relevant lines covered (87.88%)

497.31 hits per line