Function validate_headers

mitmproxy/net/http/validate.py:66–141

Validate HTTP message headers to avoid request smuggling attacks. Raises a ValueError if they are malformed.

(message: Message)

def validate_headers(message: Message) -> None:
    """
    Validate HTTP message headers to avoid request smuggling attacks.

    Raises a ValueError if they are malformed.
    """

    te = []
    cl = []

    for name, value in message.headers.fields:
        if not _valid_header_name.match(name):
            raise ValueError(f"invalid header name: {name!r}")
        match name.lower():
            case b"transfer-encoding":
                te.append(value)
            case b"content-length":
                cl.append(value)

    if te and cl:
        # > A server MAY reject a request that contains both Content-Length and Transfer-Encoding or process such a
        # > request in accordance with the Transfer-Encoding alone.

        # > A sender MUST NOT send a Content-Length header field in any message that contains a Transfer-Encoding header
        # > field.
        raise ValueError(
            "message with both transfer-encoding and content-length headers"
        )
    elif te:
        if len(te) > 1:
            raise ValueError(f"multiple transfer-encoding headers: {te!r}")
        # > Transfer-Encoding was added in HTTP/1.1. It is generally assumed that implementations advertising only
        # > HTTP/1.0 support will not understand how to process transfer-encoded content, and that an HTTP/1.0 message
        # > received with a Transfer-Encoding is likely to have been forwarded without proper handling of the chunked
        # > transfer coding in transit.
        #
        # > A client MUST NOT send a request containing Transfer-Encoding unless it knows the server will handle
        # > HTTP/1.1 requests (or later minor revisions); such knowledge might be in the form of specific user
        # > configuration or by remembering the version of a prior received response. A server MUST NOT send a response
        # > containing Transfer-Encoding unless the corresponding request indicates HTTP/1.1 (or later minor revisions).
        if not message.is_http11:
            raise ValueError(
                f"unexpected HTTP transfer-encoding {te[0]!r} for {message.http_version}"
            )
        # > A server MUST NOT send a Transfer-Encoding header field in any response with a status code of 1xx
        # > (Informational) or 204 (No Content).
        if isinstance(message, Response) and (
            100 <= message.status_code <= 199 or message.status_code == 204
        ):
            raise ValueError(
                f"unexpected HTTP transfer-encoding {te[0]!r} for response with status code {message.status_code}"
            )
        # > If a Transfer-Encoding header field is present in a request and the chunked transfer coding is not the final
        # > encoding, the message body length cannot be determined reliably; the server MUST respond with the 400 (Bad
        # > Request) status code and then close the connection.
        te_parsed = parse_transfer_encoding(te[0])
        match te_parsed:
            case "chunked" | "compress,chunked" | "deflate,chunked" | "gzip,chunked":