Detect bad framing
See original GitHub issueFrom https://www.mnot.net/blog/2011/07/11/what_proxies_must_do
Proxies also need to be on the lookout for Content-Length headers that are duplicates, as well as ones that conflict with the use of Transfer-Encoding, and either reject the message or remove the bad headers.
This is because there are entire classes of attacks that exploit the differences between how implementations frame messages.
For example, this response:
HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 45 Content-Length: 20
has an ambiguous length. If a proxy treats it differently than a client, an attacker can inject a response. Likewise, this one:
HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Content-Length: 200 Transfer-Encoding: chunked
has both a Content-Length and chunked encoding. The chunked encoding has precedence, and the Content-Length has to be removed before forwarding the message.
See the spec for how to do it well.
Issue Analytics
- State:
- Created 7 years ago
- Comments:5 (5 by maintainers)
Top Results From Across the Web
How to Check and Correct Framing - Better Homes & Gardens
As a quick check, hold a straight piece of lumber horizontally and diagonally across the studs to check that their edges are in...
Read more >Evaluating Structural Framing - InterNACHI®
You may also be able to see evidence of poor workmanship, such as improper connectors or fasteners, improperly installed purlin bracing, or blocks...
Read more >khoulihan/detect-bad-frames - GitHub
A small script to detect bad frames in a sequence of timelapse images based on pixels at specific locations being the expected colours....
Read more >How do you judge quality framing? - Fine Homebuilding
More than 5-6 is bad. I look for tight fit between boards and straight lumber used in the walls and ceilings. I can't...
Read more >Find Crooked Studs, Headers, and Beams - YouTube
Fixing Framing Problems: Find Crooked Studs, Headers, and Beams.
Read more >
Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free
Top Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
I’m working on a tool to automate this, and so far, I’ve found at least one case we’re not handling correctly.
According to the spec:
We are, as you might have guessed, Not Doing This.
Testing with
flossy
, where the upstream server sends first bad response message in the blog post @olix0r quoted above (with multipleContent-Length
headers), linkerd happily forwards the bad response, multiple headers intact.(N.B. for potential users of
flossy
– it’s currently a minimum working proof-of-concept. you probably don’t want to use this yet)Still need to add similar tests in
flossy
for chunked encodings (BuoyantIO/flossy#2).