Skip to content

Normalize repeated carriage returns in headers - #13595

Open
RajaMuhammadAwais wants to merge 1 commit into
apache:masterfrom
RajaMuhammadAwais:fix-12195-extra-cr
Open

Normalize repeated carriage returns in headers#13595
RajaMuhammadAwais wants to merge 1 commit into
apache:masterfrom
RajaMuhammadAwais:fix-12195-extra-cr

Conversation

@RajaMuhammadAwais

@RajaMuhammadAwais RajaMuhammadAwais commented Aug 27, 2026

Copy link
Copy Markdown

Summary

Fix HTTP header serialization so malformed header line endings containing repeated carriage-return (CR) bytes are not forwarded unchanged to the next hop.

This addresses issue #12195, where ATS was observed forwarding header lines such as Extra-CRs: \r\r\r\r\n with the extra carriage returns preserved.

Problem

ATS intentionally preserves the original input buffer for some valid CRLF-terminated fields as a serialization fast path. The parser already trims trailing whitespace, line-feed, and carriage-return characters from the parsed field value, but it could still mark a line with repeated carriage returns as safe for raw-line preservation merely because it ended in CRLF.

As a result, the normalized field representation and the serialized wire representation could differ: the parsed value was normalized, while the original malformed line—including the extra CR bytes—could be forwarded downstream.

This is undesirable for HTTP intermediaries because downstream components should not receive malformed line endings that ATS has already parsed and normalized.

Implementation

The parser now disables raw input-line preservation when either of the following is true:

  1. The line does not end in the normal CRLF sequence; or
  2. The byte immediately preceding the final CRLF is itself a carriage return, indicating repeated carriage returns at the line ending.

When raw preservation is disabled, ATS serializes the parsed field using its normal canonical format, producing a single CRLF terminator. The existing fast path for correctly formed header lines remains unchanged.

Regression Test

Added a header unit test that:

  1. Parses a request containing Extra-CRs: \r\r\r\r\n.
  2. Serializes the parsed request.
  3. Verifies that the output contains the normalized Extra-CRs: \r\n form.
  4. Verifies that the serialized output does not contain repeated carriage returns.

Validation

The following checks were completed locally:

  • The new focused regression test passed.
  • The complete test_proxy_hdrs suite passed: 53 test cases and 436,882 assertions.
  • Repository formatting checks passed, including clang-format, yapf, cmake-format, trailing-whitespace, and DOS-line-ending checks.
  • git diff --check passed.

Scope and Compatibility

This change is limited to serialization of header fields whose raw line ending contains repeated carriage returns. Properly formed CRLF header lines retain the existing behavior. No public API, configuration setting, or wire format for valid HTTP headers is changed.

Related Issue

Fixes #12195

@bryancall bryancall added this to the 11.0.0 milestone Aug 31, 2026
@bryancall
bryancall self-requested a review August 31, 2026 22:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ATS forwards extra carriage returns in header line endings

2 participants