elixir-mint / mint / 02d9148aba29f60910d761899c6ce781657a2247

89%

push

github

Check HTTP/2 response bodies against the content-length header (#505)

* Check HTTP/2 response bodies against the content-length header

The content-length header of an HTTP/2 response wasn't compared with the
DATA frames, so a body that was cut short, or that kept going past the
declared length, was delivered as a complete response. Non-numeric and
conflicting content-length values were passed through as well.

Each stream now records the request method and the declared length and
counts the body bytes it receives. A body that exceeds the declared
length, or that ends (through END_STREAM on DATA, on the headers or on
trailers) at a different length, is a stream error with PROTOCOL_ERROR,
following RFC 9113 8.1.1. Identical duplicate content-length headers are
accepted; differing values fail with
:more_than_one_content_length_header and values that aren't digits fail
with {:invalid_content_length_header, value}.

Responses to HEAD and 204 and 304 responses must not have content,
whatever their content-length header says, so they're tracked with a
length of zero and a DATA frame on them is a stream error rather than
body data. 2xx responses to CONNECT carry tunnel data and are exempt
from the comparison.

* Rename the HTTP/2 content-length mismatch error to :disagreeing_content_length_headers

HTTP/2 responses accept identical duplicate content-length headers and
only fail when the values differ, so :more_than_one_content_length_header
named a case that isn't an error. HTTP/1 keeps that name, since there a
second content-length header is an error whatever its value.

* Share the content-length digit check between HTTP/1 and HTTP/2

Mint.HTTP1.Parse and Mint.HTTP2 each had a private function checking that
a content-length value is only ASCII digits. Both now call
Mint.ParsingTools.only_digits?/1.

58 of 61 new or added lines in 3 files covered. (95.08%)

1582 of 1783 relevant lines covered (88.73%)

546.6 hits per line