Subject: [httpwg/http-extensions] Impact of Combining headers (#504)

From: HTTP issue updates <[email-masked]>
Date: Mon, 05 Mar 2018 23:22:07 +0000 (UTC)

Kari points out [on list](https://www.w3.org/mid/[email-masked]):

3. [Parsing Text into Structured Headers](https://tools.ietf.org/html/draft-ietf-httpbis-header-structure-04#section-3)

~~~
Given an ASCII string input_string that represents the chosen
header's field-value, return the parsed header value.  When
generating input_string, parsers MUST combine all instances of the
target header field into one comma-separated field-value, as per
[RFC7230], Section 3.2.2; this assures that the header is processed
correctly.

Note that in the case of lists, parameterised lists and dictionaries,
this has the effect of coalescing all of the values for that field.
However, for singular items, parsing will fail if more than instance
of that header field is present.
~~~

I think that this is not true for a String, if header field is mailformed
enough.

Consider following

~~~
Foo: "xxss
Foo: xxxx"
~~~

This gives

> Foo: "xxss,xxxx"

This passes

[4.7.1.  Parsing a String from Text](https://tools.ietf.org/html/draft-ietf-httpbis-header-structure-04#section-4.7.1)

[4.7.  Strings](https://tools.ietf.org/html/draft-ietf-httpbis-header-structure-04#section-4.7)

~~~
 string    = DQUOTE 0*1024(char) DQUOTE
 char      = unescaped / escape ( DQUOTE / "\" )
 unescaped = %x20-21 / %x23-5B / %x5D-7E
 escape    = "\"
~~~

Comma is allowed here as unescaped.

Other singular items does not allow comma, so combining causes parse error.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/httpwg/http-extensions/issues/504