From: Aki Tuomi Date: Mon, 13 Jul 2026 21:09:14 +0000 (+0000) Subject: lib-http: Document why client response parser is lenient X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;ds=inline;p=thirdparty%2Fdovecot%2Fcore.git lib-http: Document why client response parser is lenient Record why http_response_parser_init() is intentionally not passed STRICT here: the client parses responses from arbitrary upstream servers, some of which send legitimately non-compliant framing, and the response is consumed internally rather than re-emitted downstream, so the response-splitting precondition that STRICT guards against doesn't apply to this connection's use. No behavior change. --- diff --git a/src/lib-http/http-client-connection.c b/src/lib-http/http-client-connection.c index e2cd192e75..04429f7d2b 100644 --- a/src/lib-http/http-client-connection.c +++ b/src/lib-http/http-client-connection.c @@ -1381,6 +1381,13 @@ static void http_client_connection_ready(struct http_client_connection *conn) .max_field_size = set->response_hdr_max_field_size, .max_fields = set->response_hdr_max_fields, }; + /* Intentionally lenient (not STRICT): the client parses responses + from arbitrary/untrusted upstream servers, many of which send + legitimately non-compliant framing (e.g. obs-fold). Unlike the + server-side request parser, the response is consumed internally by + this connection rather than re-emitted downstream, so there is no + response-splitting precondition here to justify the interop risk + of rejecting it. */ conn->http_parser = http_response_parser_init( conn->conn.input, &limits, 0); o_stream_set_finish_via_child(conn->conn.output, FALSE);