Skip to content

Conversation

@pimterry
Copy link
Member

This PR adds support for 'relaxed' header parsing, to support the parsing side of nodejs/node#61597. See the comments in that PR for context.

The end goal here is to build a new 3rd mode for HTTP parsing in Node, such that we have:

  • Strict mode - existing default, sticks closely to the RFCs and rejects anything else.
  • Insecure mode - existing option, primarily for backward compatibility with past Node behaviour - prints a warning on usage, allows anything, definitely dangerous.
  • Relaxed mode - new option, to widen compatibility into grey areas (e.g. matching real browser behaviour & the WHATWG Fetch spec, where they support behaviour the RFC discourages but doesn't prohibit) but still reject anything that could be considered as insecure or dangerous.

This is my first LLHTTP PR, but I think most of the implementation is relatively clear hopefully.

Naming is hard here, since this clearly fits within the 'lenient' flags, but by design it is fully distinct from the other lenient flags that are all part of Node's insecure mode. I've gone with just treating it as a new type of lenient flag (LENIENT_HEADER_VALUE_RELAXED) but open to opinions.

@pimterry
Copy link
Member Author

Build is failing before the tests, in dev env provisioning.

@pimterry
Copy link
Member Author

All the core tests here are passing. The aiohttp regression tests that fail are unrelated, and I've fixed separately in #788.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant