Subject: ISSUE 31: qdtext BNF

From: Julian Reschke <[email-masked]>
Date: Fri, 20 Apr 2007 14:22:08 +0200

(see <http://www.w3.org/Protocols/HTTP/1.1/rfc2616bis/issues/#i31>)

The proposed resolution was to say:

   qdtext         = <any TEXT except <"> and "\">

This fixes the original issue, but preserves another problem; the ABNF 
production being broken because the prose contains the "<" character. So 
I'd like to change this to:

   qdtext         = <any TEXT excluding '"' and '\'>

or even

   DQUOTE         = %x22
   qdtext         = <any TEXT excluding DQUOTE and "\">

(doing a first step towards RFC4234 compliance)

Best regards, Julian

---

From: Dan Winship <[email-masked]>
Date: Fri, 20 Apr 2007 11:12:21 -0400

> (see <http://www.w3.org/Protocols/HTTP/1.1/rfc2616bis/issues/#i31>)

I think quoted-pair is broken too. Merging your fix into RFC2616 gives:

       quoted-string  = ( <"> *(qdtext | quoted-pair ) <"> )
       qdtext         = <any TEXT excluding '"' and '\'>
       quoted-pair    = "\" CHAR
       CHAR           = <any US-ASCII character (octets 0 - 127)>

but that means you can do this:

       HTTP/1.1 200 OK
       Warning: "Don't misparse \
       this: it's really a single header!"

(if the receiving implementation follows the recommendations in 19.3 you
need to escape the LF instead of the CR, but it's otherwise the same.)

RFC 2822 updates RFC 822's quoted-pair rule to disallow CR, LF, and NUL.
We should probably make the same change.

-- Dan

---

From: Julian Reschke <[email-masked]>
Date: Fri, 20 Apr 2007 17:27:35 +0200

> We should probably make the same change.

Dan,

good catch, you're probably right. I guess this deserves it's own issue...

Best regards, Julian

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 24 Apr 2007 17:30:21 +1000

Now issue 62;
   http://www.w3.org/Protocols/HTTP/1.1/rfc2616bis/issues/#i62

--
Mark Nottingham     http://www.mnot.net/