HTTP/1.1 CL.TE request smuggling in actix-http (GHSA-xhj4-vrgc-hr34)

Metric values as published in the disclosure vector. Meters show how far each value raises exposure.

1. Source · attacker-controlledactix-http/src/h1/decoder.rs:75

   MessageType::set_headers

2. 1
   Step 01actix-http/src/h1/decoder.rs:75-150

   set_headers consumed the raw httparse header indexes and accepted both framing headers: Content-Length populated content_length, while Transfer-Encoding: chunked set chunked = true.

   let mut chunked = false;
   let mut content_length = None;
   
   match name {
       header::CONTENT_LENGTH => {
           content_length = Some(len);
       }
       header::TRANSFER_ENCODING if version == Version::HTTP_11 => {
           if val.eq_ignore_ascii_case("chunked") {
               chunked = true;
           }
       }
       _ => {}
   }
   

3. 2
   Step 02actix-http/src/h1/decoder.rs:197-209 (before fix)

   After all headers were processed, the vulnerable parser selected chunked decoding whenever chunked was true. It did not treat the simultaneously present Content-Length as an error.

   if chunked {
       Ok(PayloadLength::Payload(PayloadType::Payload(
           PayloadDecoder::chunked(),
       )))
   } else if let Some(len) = content_length {
       Ok(PayloadLength::Payload(PayloadType::Payload(
           PayloadDecoder::length(len),
       )))
   }
   

4. 3
   Step 03actix-http/src/h1/decoder.rs:275-293 (fix)

   The patched decoder validates transfer-encoding semantics after headers are installed and before payload decoding is chosen. If both Transfer-Encoding and Content-Length are present, parsing fails with ParseError::Header.

   if msg.head().headers.contains_key(header::TRANSFER_ENCODING) {
       if ver == Version::HTTP_10 {
           return Err(ParseError::Header);
       }
   
       if !crate::HttpMessage::chunked(&msg)? {
           return Err(ParseError::Header);
       }
   
       if msg.head().headers.contains_key(header::CONTENT_LENGTH) {
           return Err(ParseError::Header);
       }
   }
   

5. 4
   Step 04actix-http/src/h1/codec.rs:241-252

   The regression test sends a CL.TE request followed by a second request on the same buffer and asserts that the first decode fails rather than leaving the second request to be parsed on the backend connection.

   let mut buf = BytesMut::from(
       "POST /test HTTP/1.1\r\n\
        content-length: 11\r\n\
        transfer-encoding: chunked\r\n\r\n\
        0\r\n\r\n\
        GET /test2 HTTP/1.1\r\n\r\n",
   );
   
   assert!(codec.decode(&mut buf).is_err());
   

6. Sinkactix-http/src/h1/decoder.rs:197

   PayloadDecoder::chunked selection