fix(decompression): disable multiple_members option for gzip decoder (#621)

ducaale · web-flow · commit 1fe4c091df13 · 2025-11-28T11:10:11.000-05:00
This was mistakenly enabled previously, but it does not make sense in an HTTP context.
diff --git a/tower-http/src/compression_utils.rs b/tower-http/src/compression_utils.rs
@@ -237,13 +237,23 @@ where
 
         // poll any remaining frames, such as trailers
         let body = M::get_pin_mut(this.read).get_pin_mut().get_pin_mut();
-        body.poll_frame(cx).map(|option| {
-            option.map(|result| {
-                result
-                    .map(|frame| frame.map_data(|mut data| data.copy_to_bytes(data.remaining())))
-                    .map_err(|err| err.into())
-            })
-        })
+        match ready!(body.poll_frame(cx)) {
+            Some(Ok(frame)) if frame.is_trailers() => Poll::Ready(Some(Ok(
+                frame.map_data(|mut data| data.copy_to_bytes(data.remaining()))
+            ))),
+            Some(Ok(frame)) => {
+                if let Ok(bytes) = frame.into_data() {
+                    if bytes.has_remaining() {
+                        return Poll::Ready(Some(Err(
+                            "there are extra bytes after body has been decompressed".into(),
+                        )));
+                    }
+                }
+                Poll::Ready(None)
+            }
+            Some(Err(err)) => Poll::Ready(Some(Err(err.into()))),
+            None => Poll::Ready(None),
+        }
     }
 }
 
diff --git a/tower-http/src/decompression/body.rs b/tower-http/src/decompression/body.rs
@@ -344,9 +344,7 @@ where
     type Output = GzipDecoder<Self::Input>;
 
     fn apply(input: Self::Input, _quality: CompressionLevel) -> Self::Output {
-        let mut decoder = GzipDecoder::new(input);
-        decoder.multiple_members(true);
-        decoder
+        GzipDecoder::new(input)
     }
 
     fn get_pin_mut(pinned: Pin<&mut Self::Output>) -> Pin<&mut Self::Input> {
diff --git a/tower-http/src/decompression/mod.rs b/tower-http/src/decompression/mod.rs
@@ -150,24 +150,6 @@ mod tests {
         Ok(Response::builder().body(body).unwrap())
     }
 
-    #[tokio::test]
-    async fn decompress_multi_gz() {
-        let mut client = Decompression::new(service_fn(handle_multi_gz));
-
-        let req = Request::builder()
-            .header("accept-encoding", "gzip")
-            .body(Body::empty())
-            .unwrap();
-        let res = client.ready().await.unwrap().call(req).await.unwrap();
-
-        // read the body, it will be decompressed automatically
-        let body = res.into_body();
-        let decompressed_data =
-            String::from_utf8(body.collect().await.unwrap().to_bytes().to_vec()).unwrap();
-
-        assert_eq!(decompressed_data, "Hello, World!");
-    }
-
     #[tokio::test]
     async fn decompress_multi_zstd() {
         let mut client = Decompression::new(service_fn(handle_multi_zstd));
@@ -186,22 +168,6 @@ mod tests {
         assert_eq!(decompressed_data, "Hello, World!");
     }
 
-    async fn handle_multi_gz(_req: Request<Body>) -> Result<Response<Body>, Infallible> {
-        let mut buf = Vec::new();
-        let mut enc1 = GzEncoder::new(&mut buf, Default::default());
-        enc1.write_all(b"Hello, ").unwrap();
-        enc1.finish().unwrap();
-
-        let mut enc2 = GzEncoder::new(&mut buf, Default::default());
-        enc2.write_all(b"World!").unwrap();
-        enc2.finish().unwrap();
-
-        let mut res = Response::new(Body::from(buf));
-        res.headers_mut()
-            .insert("content-encoding", "gzip".parse().unwrap());
-        Ok(res)
-    }
-
     async fn handle_multi_zstd(_req: Request<Body>) -> Result<Response<Body>, Infallible> {
         let mut buf = Vec::new();
         let mut enc1 = zstd::Encoder::new(&mut buf, Default::default()).unwrap();
@@ -254,4 +220,36 @@ mod tests {
             .insert("content-encoding", "gzip".parse().unwrap());
         Ok(res)
     }
+
+    #[tokio::test]
+    async fn decompress_empty_with_trailers() {
+        let mut client =
+            Decompression::new(Compression::new(service_fn(handle_empty_with_trailers)));
+
+        let req = Request::builder()
+            .header("accept-encoding", "gzip")
+            .body(Body::empty())
+            .unwrap();
+        let res = client.ready().await.unwrap().call(req).await.unwrap();
+
+        let body = res.into_body();
+        let collected = body.collect().await.unwrap();
+        let trailers = collected.trailers().cloned().unwrap();
+        let decompressed_data = String::from_utf8(collected.to_bytes().to_vec()).unwrap();
+
+        assert_eq!(decompressed_data, "");
+        assert_eq!(trailers["foo"], "bar");
+    }
+
+    async fn handle_empty_with_trailers(
+        _req: Request<Body>,
+    ) -> Result<Response<WithTrailers<Body>>, Infallible> {
+        let mut trailers = HeaderMap::new();
+        trailers.insert(HeaderName::from_static("foo"), "bar".parse().unwrap());
+        let body = Body::empty().with_trailers(trailers);
+        Ok(Response::builder()
+            .header("content-encoding", "gzip")
+            .body(body)
+            .unwrap())
+    }
 }

Original file line number	Diff line number	Diff line change
`@@ -344,9 +344,7 @@ where`
`344`	`344`	`type Output = GzipDecoder<Self::Input>;`
`345`	`345`
`346`	`346`	`fn apply(input: Self::Input, _quality: CompressionLevel) -> Self::Output {`
`347`		`- let mut decoder = GzipDecoder::new(input);`
`348`		`- decoder.multiple_members(true);`
`349`		`- decoder`
	`347`	`+ GzipDecoder::new(input)`
`350`	`348`	`}`
`351`	`349`
`352`	`350`	`fn get_pin_mut(pinned: Pin<&mut Self::Output>) -> Pin<&mut Self::Input> {`