Skip to content

validate content-length is decimal digits in wasi-http#13636

Open
netliomax25-code wants to merge 1 commit into
bytecodealliance:mainfrom
netliomax25-code:wasi-http-content-length-digits
Open

validate content-length is decimal digits in wasi-http#13636
netliomax25-code wants to merge 1 commit into
bytecodealliance:mainfrom
netliomax25-code:wasi-http-content-length-digits

Conversation

@netliomax25-code

Copy link
Copy Markdown
  1. get_content_length and the p3 parse_header_value read Content-Length with u64's FromStr, which also accepts a leading +, so a value like +5 is parsed as 5.
  2. RFC 9110 defines the field value as 1*DIGIT, so a value like that is accepted here while a strict parser (a proxy or the peer) would reject it. The parsed value drives the p2 and p3 request/response body framing, and parse_header_value runs when a guest builds a field map.

Reject any content-length value that is not a non-empty run of ASCII decimal digits before parsing, at both sites. Added unit tests covering +5, -5, a leading space, and the empty value.

@netliomax25-code netliomax25-code requested a review from a team as a code owner June 13, 2026 20:12
@netliomax25-code netliomax25-code requested review from pchickey and removed request for a team June 13, 2026 20:12
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant