Subject: Re: [Technical Errata Reported] RFC7231 (4031)

From: Anne van Kesteren <[email-masked]>
Date: Tue, 1 Jul 2014 08:59:03 +0200

On Tue, Jul 1, 2014 at 8:45 AM, Julian Reschke <[email-masked]> wrote:
> True, but what would be a bigger concern is the case where draconic error
> handling results in a *loss* of security (and that's not the case here,
> right?).

I could imagine this being the cause of a crucial subresource not
working. Cannot immediately think of an attack though.

> It would be awesome if the people working on Servo would have a look at
> <http://trac.tools.ietf.org/wg/httpbis/trac/wiki/HeaderFieldTypes> and try
> to come up with some kind of library that makes it easier to create parsers
> for the notoriously hard to parse yet similar header fields (C-C, WWW-A,
> C-D, C-T ...)

It would be, but what we should be aiming for is not requiring
additional work as launching a new client is already very costly.

-- 
http://annevankesteren.nl/

---

From: Julian Reschke <[email-masked]>
Date: Tue, 01 Jul 2014 09:14:16 +0200

> additional work as launching a new client is already very costly.

Yes, optimally we already had this framework, both as a spec and as code.

Violent agreement over here.

What I said is that *if* somebody already is rewriting everything (due 
to a brand-new language), it would make a lot of sense to do it right 
this time, instead of coming up with ~10 customer parsers that are all 
buggy (such as the ones in classical Mozilla).

Best regards, Julian

---

From: Barry Leiba <[email-masked]>
Date: Tue, 1 Jul 2014 09:52:52 -0400

>> I could see us starting work on a "Tolerant HTTP Header Field
>> Parsing" spec if there's sufficient interest; it's a pretty thankless
>> task, but personally I think it'd be worthwhile, and would
>> contribute. We can spend a few minutes in Toronto on this if
>> anyone else is interested...
>
> Exhaustive parsing rules for HTTP clients would be good. Having them
> differ is a big end user transition problem and can slow development
> on new clients, such as Servo.

Mark, I do think it's worth spending a few minutes in Toronto on this.

Anne, after this discussion, do you object to my marking this report
as "rejected", with an explanation that summarizes the discussion, and
then having us look at trying to address the situation more broadly?

Barry

---

From: Anne van Kesteren <[email-masked]>
Date: Tue, 1 Jul 2014 16:10:07 +0200

> then having us look at trying to address the situation more broadly?

No, not really. We're only three days away of the three year
anniversary of me reporting this issue. I can wait a little longer.