Duplicate chunked Transfer-Encoding lets a malicious origin smuggle a response across reused HTTP proxy connections
该报告还没有中文解读。
原文摘录
摘自原文（7971 字符中的一小部分）
A malicious HTTP origin can send `Transfer-Encoding: chunked, chunked, gzip` through a reusable HTTP proxy connection to bypass curl's "chunked must be last" guard, queue a forged HTTP response after its own response, and make curl parse that queued data as the response for a later request to a …
原文中的代码
curl 8.21.0-DEV (x86_64-pc-linux-gnu) libcurl/8.21.0-DEV zlib/1.2.11 Release-Date: [unreleased] Protocols: file ftp http ipfs ipns ws Features: alt-svc AsynchDNS IPv6 Largefile libz threadsafe UnixSockets
默认不展示报告全文。以上为简短摘录，完整复现过程请阅读原文。版权归研究员与 curl 所有。
时间线
- 报告提交
- 公开披露
阅读 HackerOne 原文 ↗作者 @violet12331 · 版权归作者与 curl 所有