Re: [PATCH] http-backend: treat empty CONTENT_LENGTH as zero

From: Junio C Hamano <gitster@pobox.com>
Date: Sep 11, 2018, 04:18 UTC
Message-ID: <xmqqo9d4r7j2.fsf@gitster-ct.c.googlers.com>
In-Reply-To: <20180911034227.GB20518@aiede.svl.corp.google.com>

Jonathan Nieder <jrnieder@gmail.com> writes:

Show 15 quoted lines

> RFC 3875 (the CGI specification) explains:
>
>    The CONTENT_LENGTH variable contains the size of the message-body
>    attached to the request, if any, in decimal number of octets.  If no
>    data is attached, then NULL (or unset).
>
>       CONTENT_LENGTH = "" | 1*digit
>
> And:
>
>    This specification does not distinguish between zero-length (NULL)
>    values and missing values.
>
> But that specification was written before HTTP/1.1 and chunked
> encoding.

RFC 3875 is from October 2004, while RFC 2616 (HTTP/1.1) is from June 1999; I presume that 3875 only writes down what has already been an established practice and that is where the date discrepancy comes from.

This is a bit old but some of those who participated in the discussion archived at https://lists.gt.net/apache/users/373042 seemed to know what they were talking about. In short, lack of content-length for CGI scripts driven by Apache seems to mean that the content length is unknown and we are expected to read through to the eof, and we are expected to ignore the CGI spec, which says missing CONTENT_LENGTH and CONTENT_LENGTH set to an empty string both must mean there is no message body. Instead, we need to take the former as a sign to read through to the end.

> Fortunately, there's a way out.  Use the HTTP_TRANSFER_ENCODING
> environment variable to distinguish the two cases.

Cute.

I'm anxious to learn how well this works in practice. Or is this a trick you know somebody else's system already uses (in which case, that's wonderful)?

Show 19 quoted lines

> +	if (!str || !*str) {
> +		/*
> +		 * According to RFC 3875, an empty or missing
> +		 * CONTENT_LENGTH means "no body", but RFC 3875
> +		 * precedes HTTP/1.1 and chunked encoding. Apache and
> +		 * its imitators leave CONTENT_LENGTH unset for
> +		 * chunked requests, for which we should use EOF to
> +		 * detect the end of the request.
> +		 */
> +		str = getenv("HTTP_TRANSFER_ENCODING");
> +		if (str && !strcmp(str, "chunked"))
> +			return -1;
> +
> +		return 0;
> +	}
> +	if (!git_parse_ssize_t(str, &val))
>  		die("failed to parse CONTENT_LENGTH: %s", str);
>  	return val;
>  }