Skip to content

httputil: Remove support for "obsolete line folding" - #3765

Merged
bdarnell merged 3 commits into
tornadoweb:masterfrom
bdarnell:remove-obs-fold
Oct 6, 2026
Merged

bdarnell merged 3 commits into
tornadoweb:masterfrom
bdarnell:remove-obs-fold

Conversation

@bdarnell

@bdarnell bdarnell commented Oct 6, 2026

Copy link
Copy Markdown
Member

This optional part of the HTTP specification is no longer used
in practice, and continuing to support it adds complexity and risk
of DoS via quadratic performance on malicious data.

bdarnell and others added 3 commits October 6, 2026 09:59
This optional part of the HTTP specification is no longer used
in practice, and continuing to support it adds complexity and risk
of DoS via quadratic performance on malicious data.
Previously, an HTTPInputError raised while parsing response headers
happened before the delegate was marked as needing on_connection_close,
and close() cleared the stream's close callback, so simple_httpclient
never completed the request and it hung until the timeout. Now the
delegate is told the connection closed, matching the behavior for
errors raised after headers_received.

Update test_multi_line_headers to expect an error from simple_httpclient
now that line folding is no longer supported (curl still accepts it).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016cNR4NyeuzQ1qFdqCk1yum
Rather than declaring per-implementation whether line folding is
supported (which was wrong when --httpclient changes the default
client), accept either a correctly unfolded header or a 599 error.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016cNR4NyeuzQ1qFdqCk1yum
@bdarnell
bdarnell merged commit cb9789a into tornadoweb:master Oct 6, 2026
17 checks passed
@bdarnell
bdarnell deleted the remove-obs-fold branch October 6, 2026 15:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants