diff --git a/src/llhttp/http.ts b/src/llhttp/http.ts index dbc9c607..52cbeae9 100644 --- a/src/llhttp/http.ts +++ b/src/llhttp/http.ts @@ -422,7 +422,7 @@ export class HTTP { .skipTo(n('res_status')); n('res_line_almost_done') - .match([ '\r', '\n' ], onStatusComplete) + .match('\n', onStatusComplete) .otherwise(this.testLenientFlags(LENIENT_FLAGS.OPTIONAL_LF_AFTER_CR, { 1: onStatusComplete, }, p.error(ERROR.STRICT, 'Expected LF after CR'))); diff --git a/test/response/invalid.md b/test/response/invalid.md index 461e9779..879cc27c 100644 --- a/test/response/invalid.md +++ b/test/response/invalid.md @@ -129,6 +129,69 @@ off=22 len=1 span[header_value]="1" off=24 error code=3 reason="Missing expected LF after header value" ``` +### Bare CR after response line + + +```http +HTTP/1.1 200 OK\rContent-Length: 0 + + +``` + +```log +off=0 message begin +off=0 len=4 span[protocol]="HTTP" +off=4 protocol complete +off=5 len=3 span[version]="1.1" +off=8 version complete +off=13 len=2 span[status]="OK" +off=16 error code=2 reason="Expected LF after CR" +``` + +### Bare CR after response line (lenient) + + +```http +HTTP/1.1 200 OK\rContent-Length: 0 + + +``` + +```log +off=0 message begin +off=0 len=4 span[protocol]="HTTP" +off=4 protocol complete +off=5 len=3 span[version]="1.1" +off=8 version complete +off=13 len=2 span[status]="OK" +off=16 status complete +off=16 len=14 span[header_field]="Content-Length" +off=31 header_field complete +off=32 len=1 span[header_value]="0" +off=35 header_value complete +off=37 headers complete status=200 v=1/1 flags=20 content_length=0 +off=37 message complete +``` + +### Bare CR followed by CR after response line + + +```http +HTTP/1.1 200 OK\r\rContent-Length: 4 + +Evil +``` + +```log +off=0 message begin +off=0 len=4 span[protocol]="HTTP" +off=4 protocol complete +off=5 len=3 span[version]="1.1" +off=8 version complete +off=13 len=2 span[status]="OK" +off=16 error code=2 reason="Expected LF after CR" +``` + ### Invalid HTTP version @@ -313,4 +376,4 @@ off=35 headers complete status=200 v=1/1 flags=0 content_length=0 off=35 len=4 span[body]="BODY" off=39 len=1 span[body]=lf off=40 len=1 span[body]="\" -``` \ No newline at end of file +```