Subject: I-D Action: draft-ietf-httpbis-header-structure-04.txt

From: [email-masked]
Date: Mon, 05 Mar 2018 00:46:48 -0800

A New Internet-Draft is available from the on-line Internet-Drafts directories.
This draft is a work item of the Hypertext Transfer Protocol WG of the IETF.

        Title           : Structured Headers for HTTP
        Authors         : Mark Nottingham
                          Poul-Henning Kamp
	Filename        : draft-ietf-httpbis-header-structure-04.txt
	Pages           : 19
	Date            : 2018-03-05

Abstract:
   This document describes a set of data types and parsing algorithms
   associated with them that are intended to make it easier and safer to
   define and handle HTTP header fields.  It is intended for use by new
   specifications of HTTP header fields as well as revisions of existing
   header field specifications when doing so does not cause
   interoperability issues.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-ietf-httpbis-header-structure/

There are also htmlized versions available at:
https://tools.ietf.org/html/draft-ietf-httpbis-header-structure-04
https://datatracker.ietf.org/doc/html/draft-ietf-httpbis-header-structure-04

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-ietf-httpbis-header-structure-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Kari Hurtta <[email-masked]>
Date: Mon, 5 Mar 2018 20:45:05 +0200 (EET)

3.  Parsing Text into Structured Headers
https://tools.ietf.org/html/draft-ietf-httpbis-header-structure-04#section-3

|   Given an ASCII string input_string that represents the chosen
|   header's field-value, return the parsed header value.  When
|   generating input_string, parsers MUST combine all instances of the
|   target header field into one comma-separated field-value, as per
|   [RFC7230], Section 3.2.2; this assures that the header is processed
|   correctly.

|   Note that in the case of lists, parameterised lists and dictionaries,
|   this has the effect of coalescing all of the values for that field.
|   However, for singular items, parsing will fail if more than instance
|   of that header field is present.

I think that this is not true for a String, if header field is mailformed
enough.

Consider following

Foo: "xxss
Foo: xxxx"

This gives

Foo: "xxss,xxxx"

This passes

4.7.1.  Parsing a String from Text
https://tools.ietf.org/html/draft-ietf-httpbis-header-structure-04#section-4.7.1

4.7.  Strings
https://tools.ietf.org/html/draft-ietf-httpbis-header-structure-04#section-4.7

|   string    = DQUOTE 0*1024(char) DQUOTE
|   char      = unescaped / escape ( DQUOTE / "\" )
|   unescaped = %x20-21 / %x23-5B / %x5D-7E
|   escape    = "\"

Comma is allowed here as unescaped.

Other singular items does not allow comma, so combining causes parse error.

/ Kari Hurtta

---

From: Mark Nottingham <[email-masked]>
Date: Tue, 6 Mar 2018 10:22:21 +1100

Thanks, Kari; I've recorded this at:
  https://github.com/httpwg/http-extensions/issues/504

> On 6 Mar 2018, at 5:45 am, Kari Hurtta <[email-masked]> wrote:
> 

--
Mark Nottingham   https://www.mnot.net/