1
81%
master: 81%

Ran 18 Feb 2024 02:27PM UTC

Files 35

Run time 1s

Badge

Embed ▾

Committed 18 Feb 2024 01:56PM UTC coverage: 81.07% (+0.01%) from 81.06%

Job # 7949480648.1

Build Type

push

github

Committed by

web-flow

Commit Message

Forbid 0x/+/-/whitespace prefixes on HTTP chunk sizes (#1542)

Currently, libevent's HTTP parser accepts and ignores 0x, +, and whitespace prefixes on chunk sizes. It also ignores - prefixes on chunk sizes of 0. This patch fixes that.

There is a potential danger in the current behavior, which is that there exist HTTP implementations that interpret chunk sizes as their longest valid prefix. For those implementations, 0xa (for example) is equivalent to 0, and this may present a request smuggling risk when those implementations are used in conjunction with libevent. However, as far I'm aware, there is no HTTP proxy that both interprets 0xa as 0 and forwards it verbatim, so I think this is a low-risk bug that is acceptable to report in public.

Run Details

12809 of 15800 relevant lines covered (81.07%)

603538.85 hits per line

libevent / libevent / 7949480648 / 1
81%
master: 81%

README BADGES
x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 7949480648.1

libevent / libevent / 7949480648 / 1 81% master: 81%

README BADGES x

Markdown

Textile

RDoc

HTML

Rst

Source Files on job 7949480648.1

libevent / libevent / 7949480648 / 1
81%
master: 81%

README BADGES
x