Re: #173: CR and LF in chunk extension values

Mark Nottingham wrote:
> Now that we've dealt with allowed characters in quoted pairs 
> <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/194>, can we wrap 
> this one up too? Julian, does your proposal need to be modified?
> 
> <http://trac.tools.ietf.org/wg/httpbis/trac/ticket/173>
> ...

Yes, that proposal doesn't help. We have addressed CTLs in qdtext with 
issue 194, but, as Henrik pointed out, we can't change quoted-string to 
disallow OWS (which is what was proposed, applied, and backed out again).

Thus, we'll have to restrict the change to <chunk-ext-val>, as proposed 
by Henrik in 
<http://lists.w3.org/Archives/Public/ietf-http-wg/2009JulSep/0621.html>:

> Which means defining a new variant of quoted-string which do not allow
> for folding for use in chunk-ext-val.
> 
>     chunk-ext-val    = token / quoted-string-nf
>     quoted-string-nf = DQUOTE *( qdtext-nf / quoted-pair ) DQUOTE
>     qdtext-nf        = WSP / %x21 / %x23-5B / %x5D-7E / obs-text
>                      ; WSP / <VCHAR except DQUOTE and "\"> / obs-text 
> 
> 
> assuming quoted-pair is fixed as discussed.
> 
> Perhaps is should also be noted in text that folding is explicitly forbidden in chunk headers.
> 
> Comments are thankfully not allowed in chunk extensions from what I can tell.

Ok, I applied <http://trac.tools.ietf.org/wg/httpbis/trac/changeset/707>.

The next text is almost as suggested by Henrik:

      chunk          = chunk-size *WSP [ chunk-ext ] CRLF
                       chunk-data CRLF
      chunk-size     = 1*HEXDIG
      last-chunk     = 1*("0") *WSP [ chunk-ext ] CRLF

      chunk-ext      = *( ";" *WSP chunk-ext-name
                          [ "=" chunk-ext-val ] *WSP )
      chunk-ext-name = token
      chunk-ext-val  = token / quoted-str-nf
      chunk-data     = 1*OCTET ; a sequence of chunk-size octets
      trailer-part   = *( entity-header CRLF )

      quoted-str-nf  = DQUOTE *( qdtext-nf / quoted-pair ) DQUOTE
                     ; like quoted-string, but disallowing line folding
      qdtext-nf      = WSP / %x21 / %x23-5B / %x5D-7E / obs-text
                     ; WSP / <VCHAR except DQUOTE and "\"> / obs-text

(I renamed quoted-string-nf to quoted-str-nf for compactness, and added 
an ABNF comment pointing out the difference compared to quoted-string).

Also, in the changes section I added the second sentence in:

    Clarification that the chunk length does not include the count of the
    octets in the chunk header and trailer.  Furthermore disallowed line
    folding in chunk extensions.  (Section 6.2.1)

BR, Julian

Received on Wednesday, 7 October 2009 14:58:39 UTC