lib-http: Document why client response parser is lenient

Record why http_response_parser_init() is intentionally not passed
STRICT here: the client parses responses from arbitrary upstream
servers, some of which send legitimately non-compliant framing, and
the response is consumed internally rather than re-emitted
downstream, so the response-splitting precondition that STRICT
guards against doesn't apply to this connection's use.

No behavior change.

diff --git a/src/lib-http/http-client-connection.c b/src/lib-http/http-client-connection.c
index e2cd192e754c546419917cdceb25aece679a512f..04429f7d2bfbebc765d86c306cf1db197e4156fd 100644 (file)
--- a/src/lib-http/http-client-connection.c
+++ b/src/lib-http/http-client-connection.c
@@ -1381,6 +1381,13 @@ static void http_client_connection_ready(struct http_client_connection *conn)
                .max_field_size = set->response_hdr_max_field_size,
                .max_fields = set->response_hdr_max_fields,
        };
+       /* Intentionally lenient (not STRICT): the client parses responses
+          from arbitrary/untrusted upstream servers, many of which send
+          legitimately non-compliant framing (e.g. obs-fold). Unlike the
+          server-side request parser, the response is consumed internally by
+          this connection rather than re-emitted downstream, so there is no
+          response-splitting precondition here to justify the interop risk
+          of rejecting it. */
        conn->http_parser = http_response_parser_init(
                conn->conn.input, &limits, 0);
        o_stream_set_finish_via_child(conn->conn.output, FALSE);