Appears we cannot disallow this whitespace, since the chunk BNF coexisted

with the implied *LWS rule, before RFC7230 eliminated the later. Whether
this is actually OWS or BWS is an editorial decision beyond our pay grade.

git-svn-id: https://svn.apache.org/repos/asf/httpd/httpd/trunk@1765475 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/modules/http/http_filters.c b/modules/http/http_filters.c
index 26f2509d882babc5dfbfaf2fa8ae00e0fcd0b3ac..b0ed5b009b55d5c911fbb51eb8e47fbd276a1d88 100644 (file)
--- a/modules/http/http_filters.c
+++ b/modules/http/http_filters.c
@@ -179,8 +179,10 @@ static apr_status_t parse_chunk_size(http_ctx_t *ctx, const char *buffer,
                 return APR_EINVAL;
             }
         }
-        else if (!strict && (c == ' ' || c == '\t')) {
-            /* Be lenient up to 10 BWS (term from rfc7230 - 3.2.3).
+        else if (c == ' ' || c == '\t') {
+            /* Be lenient up to 10 implied *LWS, a legacy of RFC 2616,
+             * and noted as errata to RFC7230;
+             * https://www.rfc-editor.org/errata_search.php?rfc=7230&eid=4667
              */
             ctx->state = BODY_CHUNK_CR;
             if (++ctx->chunk_bws > 10) {