by polished85 on 1/13/22, 11:38 PM with 6 comments
by LeoPanthera on 1/14/22, 12:35 AM
by greenyoda on 1/14/22, 12:08 AM
by mirashii on 1/14/22, 4:14 AM
Amongst other issues, this was triggered by a lack of case-insensitive handling of the HTTP "Content-Length" header. https://phabricator.services.mozilla.com/D135871 has one of the commits that landed as a result of this, and while it does change the handling to be case insensitive, it raises even more questions on the HTTP/3 stack. For instance, this is doing a string search across the HTTP headers for the string "content-length". Does that string appear in a cookie? Well you just got the wrong content length. It's extremely concerning that this isn't downstream of something that has pre-parsed the headers and has them indexed by their parsed out names.
by polished85 on 1/13/22, 11:38 PM