Skip to content

Doesn't reject invalid HTTP response #467

@ianpark

Description

@ianpark

Hi,

I am using libCur 7.42.1.1. While running Codenomicon with our http interface which is built with libCurl, I found something working ambiguous or wrong.

If peer sends back a dummy data like "aaaaaaaaaaaaaaa" without HTTP response result code or headers, the write function is called with the raw data. As far as I know the write function will be only called with HTTP response body so my code just stores on the buffer whatever given.

After then, The task is completed with CURLE_OK. How come it is OK when the response is not HTTP response. And the when I get the HTTP response code using get_easy_info, it returns 0.

So I put workaround fix:

  1. check response code in the write function
  2. if response code is 0, regard it as there were no HTTP header so handle it as a raw data or return 0 to reject the download.

What's more proper way to handle this case? How to reject if the response is not following HTTP standard. Why doesn't curl handle this case by checking the protocol and not calling write function at all?

I am not allowed to upload any pcap files so I attach a snapshot.

aaa

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions