Re: Sections 3.3.2 and 3.3.3 allow bogus Content-Length?

"Poul-Henning Kamp" <phk@phk.freebsd.dk> Tue, 14 February 2017 21:14 UTC

Resent-Date: Tue, 14 Feb 2017 21:12:32 +0000
Resent-Message-Id: <E1cdkOm-0000ha-By@frink.w3.org>
To: Loïc Hoguin <essen@ninenines.eu>
cc: Adrien de Croy <adrien@qbik.com>, "ietf-http-wg@w3.org" <ietf-http-wg@w3.org>
In-reply-to: <e01c4945-1116-d258-7004-ea917843bf3d@ninenines.eu>
From: Poul-Henning Kamp <phk@phk.freebsd.dk>
References: <emdcb96fc0-0d2f-436c-9f1f-05beffe7593e@bodybag> <e01c4945-1116-d258-7004-ea917843bf3d@ninenines.eu>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-ID: <74699.1487106715.1@critter.freebsd.dk>
Content-Transfer-Encoding: quoted-printable
Date: Tue, 14 Feb 2017 21:11:55 +0000
Message-ID: <74700.1487106715@critter.freebsd.dk>
Received-SPF: none client-ip=130.225.244.222; envelope-from=phk@phk.freebsd.dk; helo=phk.freebsd.dk
Subject: Re: Sections 3.3.2 and 3.3.3 allow bogus Content-Length?
Archived-At: <http://www.w3.org/mid/74700.1487106715@critter.freebsd.dk>
Resent-From: ietf-http-wg@w3.org
Resent-Sender: ietf-http-wg-request@w3.org
Precedence: list

--------
In message <e01c4945-1116-d258-7004-ea917843bf3d@ninenines.eu>, =?UTF-8?Q?Lo=c3=afc_Hoguin?= writes:

>    4.  If a message is received without Transfer-Encoding and with
>        either multiple Content-Length header fields having differing
>        field-values or a single Content-Length header field having an
>        invalid value,

Last year, I think, I have had some dude claim that a "valid value"
was a sequence of digits, but that there is no explicit requirement
that it match the length of the body of that request.

I told him to get stuffed.

-- 
Poul-Henning Kamp       | UNIX since Zilog Zeus 3.20
phk@FreeBSD.ORG         | TCP/IP since RFC 956
FreeBSD committer       | BSD since 4.3-tahoe    
Never attribute to malice what can adequately be explained by incompetence.

Sections 3.3.2 and 3.3.3 allow bogus Content-Leng… Adrien de Croy
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Loïc Hoguin
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Poul-Henning Kamp
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Adrien de Croy
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Adrien de Croy
RE: Sections 3.3.2 and 3.3.3 allow bogus Content-… Mike Bishop
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Matthew Kerwin
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Jason T. Greene
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Jacob Champion
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Poul-Henning Kamp
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Daniel Stenberg
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Willy Tarreau
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Adrien de Croy
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Adrien de Croy
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Alex Rousskov
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Jacob Champion
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Adrien de Croy
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Alex Rousskov
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Adrien de Croy
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Jacob Champion
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Adrien de Croy
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Adrien de Croy
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Alex Rousskov
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Adrien de Croy
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Alex Rousskov
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Matthew Kerwin
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Adrien de Croy
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Alex Rousskov
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Mark Nottingham
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Willy Tarreau
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Poul-Henning Kamp
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Cory Benfield
Re: Sections 3.3.2 and 3.3.3 allow bogus Content-… Patrick McManus