HTTP/1.1: Chunked message bodies incorrectly terminated on \r\n\r\n instead of 0\r\n\r\n

[kenballus]

Version

deno 1.44.4 (debug, x86_64-unknown-linux-gnu)
v8 12.7.224.9
typescript 5.5.2

Description

Deno HTTP/1.1 servers allow chunked message bodies to be terminated by \r\n\r\n alone (i.e., not 0\r\n\r\n).

To reproduce

1. Run a Deno HTTP server that echos back message bodies, such as this one.
2. Send it a chunked request that's missing the final chunk-size, and extract the echoed message body:

printf 'POST / HTTP/1.1\r\nHost: whatever\r\nTransfer-Encoding: chunked\r\n\r\n1\r\nZ\r\n\r\n\r\n' \
    | timeout 1 nc localhost 80 \
    | grep '"body"' \
    | jq '.["body"]' \
    | xargs echo \
    | base64 -d \
    | xxd

3. Observe that Deno interprets the message body as Z.

00000000: 5a                                       Z

Suggested fix

Respond 400 to requests with invalid chunked message bodies. This is what nearly all other HTTP implementations do, including AIOHTTP, Apache httpd, Cheroot, FastHTTP, Go net/http, Gunicorn, H2O, HAProxy, Hypercorn, Jetty, Lighttpd, Nginx, Node.js, Puma, Tomcat, Twisted, Uvicorn, and WEBrick do.

[lucacasonato]

Will be fixed by hyperium/hyper#3698

[bartlomieju]

Need to land #24237 first.