elixir-mint / mint / 984629f54c428b0e22fc46ed405dd798e1ebe369-PR-505

89%

main: 91%

Build Type

Pull #505

github

Committed by ericmj

Commit Message

Check HTTP/2 response bodies against the content-length header

The content-length header of an HTTP/2 response wasn't compared with the
DATA frames, so a body that was cut short, or that kept going past the
declared length, was delivered as a complete response. Non-numeric and
conflicting content-length values were passed through as well.

Each stream now records the request method and the declared length, and
counts the body bytes it receives. A body that exceeds the declared
length, or that ends (through END_STREAM on DATA, on the headers or on
trailers) at a different length, is a stream error with PROTOCOL_ERROR,
following RFC 9113 8.1.1. Responses to HEAD, 2xx responses to CONNECT
and 204 and 304 responses carry no content and are exempt. Identical
duplicate content-length headers are accepted; differing values fail
with :more_than_one_content_length_header and values that aren't digits
fail with {:invalid_content_length_header, value}.

Pull Request Pull Request #505: Check HTTP/2 response bodies against the content-length header

Coverage Stats

55 of 58 new or added lines in 1 file covered. (94.83%)

24 existing lines in 2 files now uncovered.

1581 of 1780 relevant lines covered (88.82%)

546.1 hits per line