HTTP parser: allowed more characters in header field names.

Previously, all requests that contained in header field names characters other
than alphanumeric, or "-", or "_" were rejected with a 400 "Bad Request" error
response.

Now, the parser allows the same set of characters as specified in RFC 7230,
including: "!", "#", "$", "%", "&", "'", "*", "+", ".", "^", "`", "|", and "~".
Header field names that contain only these characters are considered valid.

Also, there's a new option introduced: "discard_unsafe_fields".  It accepts
boolean value and it is set to "true" by default.

When this option is "true", all header field names that contain characters
in valid range, but other than alphanumeric or "-" are skipped during parsing.
When the option is "false", these header fields aren't skipped.

Requests with non-valid characters in header field names according to
RFC 7230 are rejected regardless of "discard_unsafe_fields" setting.

This closes #422 issue on GitHub.

1 files changed, 9 insertions, 5 deletions

diff --git a/src/nxt_http_parse.h b/src/nxt_http_parse.h
index cbfc8433..3cd9bd15 100644
--- a/src/nxt_http_parse.h
+++ b/src/nxt_http_parse.h
@@ -55,15 +55,19 @@ struct nxt_http_request_parse_s {
 
     uint32_t                  field_hash;
 
+    uint8_t                   skip_field;             /* 1 bit */
+    uint8_t                   discard_unsafe_fields;  /* 1 bit */
+
     /* target with "/." */
-    uint8_t                   complex_target;   /* 1 bit */
+    uint8_t                   complex_target;         /* 1 bit */
+#if 0
     /* target with "%" */
-    uint8_t                   quoted_target;    /* 1 bit */
+    uint8_t                   quoted_target;          /* 1 bit */
     /* target with " " */
-    uint8_t                   space_in_target;  /* 1 bit */
-
+    uint8_t                   space_in_target;        /* 1 bit */
+#endif
     /* Preserve encoded '/' (%2F) and '%' (%25). */
-    uint8_t                   encoded_slashes;  /* 1 bit */
+    uint8_t                   encoded_slashes;        /* 1 bit */
 };