Skip to content

validate quoted-string in parse_chunk_extensions#3102

Merged
ashtum merged 1 commit into
boostorg:developfrom
sahvx655-wq:chunk-ext-qstring-validate
Jun 25, 2026
Merged

validate quoted-string in parse_chunk_extensions#3102
ashtum merged 1 commit into
boostorg:developfrom
sahvx655-wq:chunk-ext-qstring-validate

Conversation

@sahvx655-wq

Copy link
Copy Markdown
Contributor

Quoted chunk-ext values skip character validation

While going over the chunked request path I noticed parse_chunk_extensions walks a quoted chunk-ext value looking only for the closing " and a backslash escape, without ever checking the octets in between. The rfc7230 quoted-string grammar only permits qdtext inside the quotes and a qpchar after a backslash, yet the loop accepts anything, so NUL, other control characters, DEL and a bare LF all parse cleanly. param_iter already validates header-parameter quoted-strings with is_qdchar/is_qpchar; the chunk parser just never got the same treatment.

The bare LF is what bothers me here. find_eol only recognises CRLF as the chunk-line terminator, so Beast keeps 1;a="<LF>" together as a single line, whereas a peer that accepts a lone LF as a line ending would cut the chunk-size line at the LF and disagree about where the next chunk begins, which is the usual shape of a chunked desync. The added regression case in basic_parser.cpp fails on the unpatched parser and passes after; valid quoted extensions still parse.

@codecov

codecov Bot commented Jun 24, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.28%. Comparing base (5c484a3) to head (eec2ee1).

Additional details and impacted files

Impacted file tree graph

@@             Coverage Diff             @@
##           develop    #3102      +/-   ##
===========================================
- Coverage    93.31%   93.28%   -0.03%     
===========================================
  Files          177      177              
  Lines        13754    13760       +6     
===========================================
+ Hits         12834    12836       +2     
- Misses         920      924       +4     
Files with missing lines Coverage Δ
include/boost/beast/http/detail/basic_parser.ipp 88.49% <100.00%> (+0.19%) ⬆️

... and 1 file with indirect coverage changes


Continue to review full report in Codecov by Harness.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 5c484a3...eec2ee1. Read the comment docs.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ashtum ashtum merged commit bb6cf79 into boostorg:develop Jun 25, 2026
75 of 76 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants