Subject: [Technical Errata Reported] RFC7230 (5257)

From: RFC Errata System <[email-masked]>
Date: Wed, 7 Feb 2018 15:20:36 -0800 (PST)

The following errata report has been submitted for RFC7230,
"Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5257

--------------------------------------
Type: Technical
Reported by: Erwin Pe <[email-masked]>

Section: 7

Original Text
-------------
For compatibility with legacy list rules, a recipient MUST parse and
ignore a reasonable number of empty list elements: enough to handle
common mistakes by senders that merge values, but not so much that
they could be used as a denial-of-service mechanism.  In other words,
a recipient MUST accept lists that satisfy the following syntax:

  #element => [ ( "," / element ) *( OWS "," [ OWS element ] ) ]

  1#element => *( "," OWS ) element *( OWS "," [ OWS element ] )

Corrected Text
--------------
For compatibility with legacy list rules, a recipient MUST parse and
ignore a reasonable number of empty list elements: enough to handle
common mistakes by senders that merge values, but not so much that
they could be used as a denial-of-service mechanism.  In other words,
a recipient MUST accept lists that satisfy the following syntax:

  #element => [ ( ("," OWS element) / element ) *( OWS "," [ OWS 
    element ] ) ]

  1#element => *( "," OWS ) element *( OWS "," [ OWS element ] )

Notes
-----
With the current ABNF rule for #element, and using token as an element, the construction:

    ",     foobar" 

cannot be derived from #element, but can be derived from 1#element. (legacy list rule)
Since #element is meant to be a superset of 1#element, lists derived from 1#element should satisfy the #element rule as well.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC7230 (draft-ietf-httpbis-p1-messaging-26)
--------------------------------------
Title               : Hypertext Transfer Protocol (HTTP/1.1): Message Syntax and Routing
Publication Date    : June 2014
Author(s)           : R. Fielding, Ed., J. Reschke, Ed.
Category            : PROPOSED STANDARD
Source              : Hypertext Transfer Protocol Bis APP
Area                : Applications
Stream              : IETF
Verifying Party     : IESG

---

From: Richard Gibson <[email-masked]>
Date: Wed, 7 Feb 2018 22:53:56 -0500

The #element production in RFC 7230 matches a lone comma and a value 
beginning with two commas, both of which this proposed change would 
cause it to reject. A more correct improvement would be to move leading 
OWS out of the repeatable subexpression, thereby eliminating the need to 
special-case an initial comma:

#element => [ element OWS ] *( "," OWS [ element OWS ] )

On 02/07/2018 06:20 PM, RFC Errata System wrote:
> https://urldefense.proofpoint.com/v2/url?u=http-3A__www.rfc-2Deditor.org_errata_eid5257&d=DwIBaQ&c=RoP1YumCXCgaWHvlZYR8PZh8Bv7qIrMUB65eapI_JnE&r=-o8MJF7i0TzXAJRB0ncfTVfWKSyTG7nl_iTLU_A2B7c&m=zQjlOYino3rJYW4JoSmEaFILD08XL2uMjejcqr140FU&s=glP3zQBZzlydq72gdMb9gIXPknE1jsRwB6m7Hq-jjDs&e=
>

---

From: Julian Reschke <[email-masked]>
Date: Thu, 8 Feb 2018 09:24:25 +0100

On 2018-02-08 00:20, RFC Errata System wrote:
> ...

I agree that there's an issue here. Not sure yet about the right way to 
fix this.

We should open a ticket at <https://github.com/httpwg/http11bis/issues> 
to track this (and also <https://www.rfc-editor.org/errata/eid4169>).

Let's collect sample field values there so that we can verify the new 
ABNF properly.

Best regards, Julian