Merge pull request #474 from Pylons/bugfix/drop-multiple-chunked-transfer-encodings

If Transfer-Encoding includes "chunked" multiple times, drop request

Author: mmerickel

CHANGES.txt

@@ -4,6 +4,12 @@ Unreleased
 Bugfix
 ~~~~~~
 
+- Waitress will now drop a request if the Transer-Encoding is set twice in the
+  request, previously it would decode the chunks and pass it along to the WSGI
+  application with an appropriate content length. See
+  https://github.com/Pylons/waitress/issues/465 and
+  https://github.com/Pylons/waitress/pull/474
+  
 - When encountering a request that has both Content-Length set and
   Transfer-Encoding of chunked we now close the connection after it is
   completed to comply with the requirements of RFC9112. See

src/waitress/parser.py

@@ -304,6 +304,14 @@ def parse_header(self, header_plus):
                     )
 
             if encodings and encodings[-1] == "chunked":
+                if (
+                    len([encoding for encoding in encodings if encoding == "chunked"])
+                    != 1
+                ):
+                    raise TransferEncodingNotImplemented(
+                        "Transfer-Encoding is invalid. Multiple chunked encodings requested."
+                    )
+
                 self.chunked = True
                 buf = OverflowableBuffer(self.adj.inbuf_overflow)
                 self.body_rcv = ChunkedReceiver(buf)

tests/test_parser.py

@@ -263,6 +263,19 @@ def test_parse_header_transfer_encoding_invalid_multiple(self):
         else:  # pragma: nocover
             self.assertTrue(False)
 
+    def test_parse_header_transfer_encoding_invalid_multiple_chunked(self):
+        data = b"GET /foobar HTTP/1.1\r\ntransfer-encoding: chunked\r\ntransfer-encoding: chunked\r\n"
+
+        try:
+            self.parser.parse_header(data)
+        except TransferEncodingNotImplemented as e:
+            self.assertIn(
+                "Transfer-Encoding is invalid. Multiple chunked encodings requested.",
+                e.args[0],
+            )
+        else:  # pragma: nocover
+            self.assertTrue(False)
+
     def test_parse_header_transfer_encoding_invalid_whitespace(self):
         data = b"GET /foobar HTTP/1.1\r\nTransfer-Encoding:\x85chunked\r\n"