Loading src/http.cpp +12 −29 Original line number Diff line number Diff line Loading @@ -3880,35 +3880,18 @@ size_t libhttppp::HttpResponse::parse(const char *data, size_t inlen) { if (!ncontent) continue; if (key == "set-cookie") { // Set-Cookie must never be comma-split: its own value legitimately // contains commas (e.g. "Expires=Wed, 21 Oct 2026 07:28:00 GMT"), // and RFC 7230 Sec3.2.2 singles it out as the header that cannot // be combined/split as a comma list. Each physical line is exactly // one cookie. // Never comma-split a value: only headers whose grammar is explicitly // defined as a comma-separated list (Cache-Control, Accept, TE, ...) // could safely be split this way, but plenty of others legitimately // contain a comma inside a single value -- Date/Expires ("Sat, 08 Aug // 2026 ..."), and any custom header carrying e.g. a JSON object // (GitLab's X-Gitlab-Meta: {"correlation_id":"...","version":"1"}). // A blanket split (as this used to do, matching only Set-Cookie as an // exception) tore both of those apart into bogus fragments. Each // physical line is exactly one value, full stop -- matching what // parseH2()/parseH3() already do for HPACK/QPACK-delivered headers, // where no such splitting ever happened in the first place. ncontent->push_back(value); continue; } // Split value on commas (HTTP list headers: TE, Accept, etc.) size_t oldiv = 0; size_t iv = 0; while ((iv = value.find(',', oldiv)) != std::string::npos) { std::string token = value.substr(oldiv, iv - oldiv); trim_inplace(token); if (!token.empty()) { ncontent->push_back(token); } oldiv = iv + 1; } // last (or only) token std::string final_token = value.substr(oldiv); trim_inplace(final_token); if (!final_token.empty()) { ncontent->push_back(final_token); } } // --- 4) populate cached header pointers --- Loading Loading
src/http.cpp +12 −29 Original line number Diff line number Diff line Loading @@ -3880,35 +3880,18 @@ size_t libhttppp::HttpResponse::parse(const char *data, size_t inlen) { if (!ncontent) continue; if (key == "set-cookie") { // Set-Cookie must never be comma-split: its own value legitimately // contains commas (e.g. "Expires=Wed, 21 Oct 2026 07:28:00 GMT"), // and RFC 7230 Sec3.2.2 singles it out as the header that cannot // be combined/split as a comma list. Each physical line is exactly // one cookie. // Never comma-split a value: only headers whose grammar is explicitly // defined as a comma-separated list (Cache-Control, Accept, TE, ...) // could safely be split this way, but plenty of others legitimately // contain a comma inside a single value -- Date/Expires ("Sat, 08 Aug // 2026 ..."), and any custom header carrying e.g. a JSON object // (GitLab's X-Gitlab-Meta: {"correlation_id":"...","version":"1"}). // A blanket split (as this used to do, matching only Set-Cookie as an // exception) tore both of those apart into bogus fragments. Each // physical line is exactly one value, full stop -- matching what // parseH2()/parseH3() already do for HPACK/QPACK-delivered headers, // where no such splitting ever happened in the first place. ncontent->push_back(value); continue; } // Split value on commas (HTTP list headers: TE, Accept, etc.) size_t oldiv = 0; size_t iv = 0; while ((iv = value.find(',', oldiv)) != std::string::npos) { std::string token = value.substr(oldiv, iv - oldiv); trim_inplace(token); if (!token.empty()) { ncontent->push_back(token); } oldiv = iv + 1; } // last (or only) token std::string final_token = value.substr(oldiv); trim_inplace(final_token); if (!final_token.empty()) { ncontent->push_back(final_token); } } // --- 4) populate cached header pointers --- Loading