W3C home > Mailing lists > Public > ietf-http-wg@w3.org > January to March 2013

Re: #409: is parsing OBS-FOLD mandatory?

From: Willy Tarreau <w@1wt.eu>
Date: Sun, 20 Jan 2013 10:44:48 +0100
To: Mark Nottingham <mnot@mnot.net>
Cc: "ietf-http-wg@w3.org Group" <ietf-http-wg@w3.org>, Roy Fielding <fielding@gbiv.com>
Message-ID: <20130120094448.GK6838@1wt.eu>
On Sun, Jan 20, 2013 at 08:26:42PM +1100, Mark Nottingham wrote:
> Proposal:
> 
> """
> Historically, HTTP header field values could be extended over multiple lines by preceding each extra line with at least one space or horizontal tab (obs-fold). This specification deprecates such line folding except within the message/http media type (Section 7.3.1). Senders MUST NOT generate messages that include line folding (i.e., that contain any field-value that matches the obs-fold rule) unless the message is intended for packaging within the message/http media type. Recipients MUST either:
> 
>   - accept line folding and replace any embedded obs-fold whitespace with either a single SP or a matching number of SP octets (to avoid buffer copying) prior to interpreting the field value or forwarding the message downstream, or
> 
>   - reject a message with line folding present. Servers can do for requests by responding with 400 Bad Request and a representation explaining the condition; clients can only discard the message.
> 
> In particular, recipients who choose not to implement obs-fold processing (as described above) MUST NOT accept messages containing headers with leading whitespace, as this can expose them to attacks that exploit this difference in processing.
> """

Seems perfect to me :-)

Cheers,
Willy
Received on Sunday, 20 January 2013 09:45:20 GMT

This archive was generated by hypermail 2.2.0+W3C-0.50 : Sunday, 20 January 2013 09:45:22 GMT