Use TryAddWithoutValidation to prevent parsing potentially illegal headers #25
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Hi!
Currently, when automatic decompression is used, the headers are copied between instances of
HttpContent
to facilitate the decompression. Unfortunately, theHttpContentHeaders.Add
method used inHttpContentHeadersExtensions
performs header parsing, which tests whether the headers are valid. This leads to exceptions like "The format of value '0' is invalid." triggered by .NET Framework'sDateHeaderParser
being too strict when parsing theExpires: 0
header, while RFC 9111 explicitly mentions this:Also, this can lead to a misinterpretation of other header fields that do not perfectly roundtrip by a parse->convert step of
HttpContentHeaders.Add
. I believe that decompression should not intervene into header processing and pass content headers as-is.To improve this, I propose using
HttpContentHeaders.TryAddWithoutValidation
that will copy the headers without any other processing. I'm not sure whether the result value should be checked and acted upon by, for example, throwing some kind of exception since this might defeat the original purpose.Thanks for looking into this.