2

Closed

HTTP parsing error?

description

Internet Explorer sends raw UTF-8 encoded bytes for everything after the "?" in an HTTP request URI. If the following HTTP request crosses pcap.net:
 
GET /%E2%84%AB/?Å#Å HTTP1/0
Host: example.com
User-Agent: Firefox
 
I get a null set of Headers returned from the packet.Ethernet.IpV4.Tcp.Http.Header collection. I also get a truncated URI:
 
(((PcapDotNet.Packets.Http.HttpRequestDatagram)(packet.Ethernet.IpV4.Tcp.Http))).Uri "/%E2%84%AB/?" string
 
 
Is there an internal problem parsing this? I know this is not legal HTTP, I'm doing it on purpose, but I thought pcap.net would be a little more liberal in what it accepted.

file attachments

Closed Apr 27, 2012 at 10:45 AM by Brickner
Released in version 0.10.0.

comments

Brickner wrote Jul 8, 2011 at 11:45 AM

Can you attach a pcap file with the problematic packet so I can see what is the problem?
Thanks.

chrisweber wrote Jul 22, 2011 at 6:32 PM

Yes, here's a single packet that causes the parsing to fail. Good enough?

Brickner wrote Apr 1, 2012 at 6:40 PM

Sorry for taking long to respond.

This is indeed an non valid HTTP URI, as you can see in appendix A of RFC 2396.
However, it seems that Wireshark is OK with it, so I will see if I can adapt Pcap.Net to be more liberal here.

Brickner wrote Apr 1, 2012 at 7:12 PM

Fix submitted.

Sign in to add a comment