diff --git a/tests/requests/invalid/rfc9112_chunked_size_minus_sign_01.http b/tests/requests/invalid/rfc9112_chunked_size_minus_sign_01.http new file mode 100644 index 00000000..27bdf6b8 --- /dev/null +++ b/tests/requests/invalid/rfc9112_chunked_size_minus_sign_01.http @@ -0,0 +1,8 @@ +POST /upload HTTP/1.1\r\n +Host: example.com\r\n +Transfer-Encoding: chunked\r\n +\r\n +-5\r\n +hello\r\n +0\r\n +\r\n diff --git a/tests/requests/invalid/rfc9112_chunked_size_minus_sign_01.py b/tests/requests/invalid/rfc9112_chunked_size_minus_sign_01.py new file mode 100644 index 00000000..4a8c5430 --- /dev/null +++ b/tests/requests/invalid/rfc9112_chunked_size_minus_sign_01.py @@ -0,0 +1,7 @@ +# +# This file is part of gunicorn released under the MIT license. +# See the NOTICE for more information. + +# RFC 9112 section 7.1: chunk-size = 1*HEXDIG; negative sign is invalid. +from gunicorn.http.errors import InvalidChunkSize +request = InvalidChunkSize diff --git a/tests/requests/invalid/rfc9112_chunked_size_plus_sign_01.http b/tests/requests/invalid/rfc9112_chunked_size_plus_sign_01.http new file mode 100644 index 00000000..68ca7443 --- /dev/null +++ b/tests/requests/invalid/rfc9112_chunked_size_plus_sign_01.http @@ -0,0 +1,8 @@ +POST /upload HTTP/1.1\r\n +Host: example.com\r\n +Transfer-Encoding: chunked\r\n +\r\n ++5\r\n +hello\r\n +0\r\n +\r\n diff --git a/tests/requests/invalid/rfc9112_chunked_size_plus_sign_01.py b/tests/requests/invalid/rfc9112_chunked_size_plus_sign_01.py new file mode 100644 index 00000000..342f53e2 --- /dev/null +++ b/tests/requests/invalid/rfc9112_chunked_size_plus_sign_01.py @@ -0,0 +1,8 @@ +# +# This file is part of gunicorn released under the MIT license. +# See the NOTICE for more information. + +# RFC 9112 section 7.1: chunk-size = 1*HEXDIG; a leading sign ("+" or "-") +# is not valid and has been used in request-smuggling vectors. +from gunicorn.http.errors import InvalidChunkSize +request = InvalidChunkSize diff --git a/tests/requests/valid/rfc9112_chunked_ext_quoted_01.http b/tests/requests/valid/rfc9112_chunked_ext_quoted_01.http new file mode 100644 index 00000000..51f179a2 --- /dev/null +++ b/tests/requests/valid/rfc9112_chunked_ext_quoted_01.http @@ -0,0 +1,8 @@ +POST /upload HTTP/1.1\r\n +Host: example.com\r\n +Transfer-Encoding: chunked\r\n +\r\n +5;foo="bar baz"\r\n +hello\r\n +0\r\n +\r\n diff --git a/tests/requests/valid/rfc9112_chunked_ext_quoted_01.py b/tests/requests/valid/rfc9112_chunked_ext_quoted_01.py new file mode 100644 index 00000000..00c00934 --- /dev/null +++ b/tests/requests/valid/rfc9112_chunked_ext_quoted_01.py @@ -0,0 +1,15 @@ +# +# This file is part of gunicorn released under the MIT license. +# See the NOTICE for more information. + +# RFC 9112 section 7.1.1: chunk-ext-val can be token or quoted-string. +request = { + "method": "POST", + "uri": uri("/upload"), + "version": (1, 1), + "headers": [ + ("HOST", "example.com"), + ("TRANSFER-ENCODING", "chunked"), + ], + "body": b"hello", +} diff --git a/tests/requests/valid/rfc9112_chunked_size_leading_zeros_01.http b/tests/requests/valid/rfc9112_chunked_size_leading_zeros_01.http new file mode 100644 index 00000000..708d4d82 --- /dev/null +++ b/tests/requests/valid/rfc9112_chunked_size_leading_zeros_01.http @@ -0,0 +1,8 @@ +POST /upload HTTP/1.1\r\n +Host: example.com\r\n +Transfer-Encoding: chunked\r\n +\r\n +0005\r\n +hello\r\n +0\r\n +\r\n diff --git a/tests/requests/valid/rfc9112_chunked_size_leading_zeros_01.py b/tests/requests/valid/rfc9112_chunked_size_leading_zeros_01.py new file mode 100644 index 00000000..d0c4142d --- /dev/null +++ b/tests/requests/valid/rfc9112_chunked_size_leading_zeros_01.py @@ -0,0 +1,16 @@ +# +# This file is part of gunicorn released under the MIT license. +# See the NOTICE for more information. + +# RFC 9112 section 7.1: chunk-size is 1*HEXDIG. Leading zeros are permitted +# but have been used in smuggling vectors; fixture pins accepted behavior. +request = { + "method": "POST", + "uri": uri("/upload"), + "version": (1, 1), + "headers": [ + ("HOST", "example.com"), + ("TRANSFER-ENCODING", "chunked"), + ], + "body": b"hello", +} diff --git a/tests/requests/valid/rfc9112_chunked_size_uppercase_hex_01.http b/tests/requests/valid/rfc9112_chunked_size_uppercase_hex_01.http new file mode 100644 index 00000000..4c290e82 --- /dev/null +++ b/tests/requests/valid/rfc9112_chunked_size_uppercase_hex_01.http @@ -0,0 +1,8 @@ +POST /upload HTTP/1.1\r\n +Host: example.com\r\n +Transfer-Encoding: chunked\r\n +\r\n +A\r\n +0123456789\r\n +0\r\n +\r\n diff --git a/tests/requests/valid/rfc9112_chunked_size_uppercase_hex_01.py b/tests/requests/valid/rfc9112_chunked_size_uppercase_hex_01.py new file mode 100644 index 00000000..cb82f874 --- /dev/null +++ b/tests/requests/valid/rfc9112_chunked_size_uppercase_hex_01.py @@ -0,0 +1,15 @@ +# +# This file is part of gunicorn released under the MIT license. +# See the NOTICE for more information. + +# RFC 9112 section 7.1: chunk-size = 1*HEXDIG, which allows both cases. +request = { + "method": "POST", + "uri": uri("/upload"), + "version": (1, 1), + "headers": [ + ("HOST", "example.com"), + ("TRANSFER-ENCODING", "chunked"), + ], + "body": b"0123456789", +}