Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Via header: host ABNF could allow "," #24

Closed
reschke opened this issue Apr 23, 2017 · 7 comments
Closed

Via header: host ABNF could allow "," #24

reschke opened this issue Apr 23, 2017 · 7 comments
Assignees
@reschke
Labels
semantics

Comments

@reschke
Copy link
Contributor

reschke commented Apr 23, 2017

Reported by [email protected] in https://lists.w3.org/Archives/Public/ietf-http-wg/2016OctDec/0527.html:

I think I found a bug in the specification of the Via header as given
in RFC 7230

From RFC 7230: Via = 1#( received-protocol RWS received-by [ RWS comment ] )
where 1# is a special syntax that means "comma seperated list, at
least one element"

From RFC 7230: received-by = ( uri-host [ ":" port ] ) / pseudonym
From RFC 7230: uri-host = <host, see [RFC3986], Section 3.2.2>
From RFC 3986: host = IP-literal / IPv4address / reg-name
From RFC 3986: reg-name = ( unreserved / pct-encoded / sub-delims )
From RFC 3986: sub-delims = "!" / "$" / "&" / "'" / "(" / ")" / "" /
"+" / "," / ";" / "="

notice "," there in sub-delims; this means that comma is a valid
character in a host.
and hence, that using a comma to terminate a host makes no sense

e.g.
Via: 1.0 fred, 1.1 p.example.net
'fred,' is a valid uri-host
In this case, I think we might be saved by the fact that the rest of
the line doesn't match, so 'fred' ends up being a pseudonym rather
than a uri-host.

However, I believe that there might be corner cases not backed up by
this fallback.
@mnot mnot added the semantics label Jun 20, 2017
@mnot
Copy link
Member

mnot commented Oct 10, 2018

@royfielding could you enlighten us as to why 3986 allows such a wide range of characters in reg-name?

@mnot
Copy link
Member

mnot commented Feb 2, 2020 •
edited
Loading

Discussed in Basel; inclination is to remove , from uri-host by defining our own ABNF rather than referencing.

@reschke reschke self-assigned this Feb 2, 2020
@reschke
Copy link
Contributor Author

reschke commented Feb 2, 2020

Restrict the grammar in Via.

reschke added a commit that referenced this issue Feb 2, 2020
@reschke
Change Via to use via-host, disallowing comma (#24)"
9b09f15
@reschke
Copy link
Contributor Author

reschke commented Feb 2, 2020 •
edited
Loading

Proposal:

  • simplify "received-by" not to distinguish hosts and pseudonyms, just define the allowed characters
  • remove pseudonym ABNF

received-by would include...?

  1. Most inclusive: VCHAR minus ","
  2. Least inclusive: token plus all the characters we need for host names, excluding ","

@reschke
Copy link
Contributor Author

reschke commented Feb 3, 2020

The difference between token and VCHAR is:

DQUOTE / "(" / ")" / "," / "/" / ":" / ";" / "<" / "=" / ">" / "?" / "@" / "[" / "\" / "]" / "{" / "}"

Which ones do we need to allow?

@reschke
Copy link
Contributor Author

reschke commented Feb 3, 2020 •
edited
Loading

I believe we need to allow the following characters:

 "!" / "#" / "$" / "%" / "&" / "'" / "(" / ")" / "*" / "+" / "-" / "." / DIGIT / ":" / ";" / "=" / ALPHA / "[" / "]" / "^" / "_" / "`" / "|" / "~"

Missing from VCHAR would be:

DQUOTE / "," / "/" / "<" / ">" / "?" / "@" / "\" / "{" / "}"

Does this make sense, @royfielding ?

reschke added a commit that referenced this issue Feb 3, 2020
@reschke
simplify received-by to just enumerate the allowed characters, but ex…
3b5d0c1 
…clude "," (#24)
@royfielding
Copy link
Member

This one has revealed an unintentional change due to the dependency on RFC2396 host being replaced by the far more permissive reg-name when we updated that to RFC3986. We should have compensated for that in RFC7230, but instead redefined uri-host incorrectly.

I think the easiest fix would be to remove uri-host entirely, and simply rely on pseudonym as a sufficient grammar for both. In other words,

received-by = pseudonym [ ":" port ]

royfielding added a commit that referenced this issue Feb 4, 2020
@royfielding
Merge pull request #284 from httpwg/reschke-24
5f60c36 
Change Via to use via-host, disallowing comma (#24)
@reschke reschke closed this as completed Jun 5, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@reschke reschke

Labels
semantics
Milestone
No milestone
Development

No branches or pull requests
3 participants
@mnot @reschke @royfielding