elixir-mint / mint / 3eef77290a1b4f543639cb94cc2f757613fb09e3-PR-505

89%

main: 91%

Build Type

Pull #505

github

Committed by ericmj

Commit Message

Check HTTP/2 response bodies against the content-length header

The content-length header of an HTTP/2 response wasn't compared with the
DATA frames, so a body that was cut short, or that kept going past the
declared length, was delivered as a complete response. Non-numeric and
conflicting content-length values were passed through as well.

Each stream now records the request method and the declared length, and
counts the body bytes it receives. A body that exceeds the declared
length, or that ends (through END_STREAM on DATA, on the headers or on
trailers) at a different length, is a stream error with PROTOCOL_ERROR,
following RFC 9113 8.1.1. Responses to HEAD, 2xx responses to CONNECT
and 204 and 304 responses carry no content and are exempt. Identical
duplicate content-length headers are accepted; differing values fail
with :more_than_one_content_length_header and values that aren't digits
fail with {:invalid_content_length_header, value}.

Pull Request Pull Request #505: Check HTTP/2 response bodies against the content-length header

Coverage Stats

55 of 58 new or added lines in 1 file covered. (94.83%)

27 existing lines in 2 files now uncovered.

1555 of 1754 relevant lines covered (88.65%)

542.85 hits per line