[From nobody Sun Jul 5 15:23:16 2026 Received: (at submit) by bugs.debian.org; 26 Aug 2023 12:16:39 +0000 X-Spam-Checker-Version: SpamAssassin 3.4.6-bugs.debian.org_2005_01_02 (2021-04-09) on buxtehude.debian.org X-Spam-Level: X-Spam-Status: No, score=-12.4 required=4.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FOURLA,HAS_PACKAGE,MONEY, NUMERIC_HTTP_ADDR,PGPSIGNATURE,SPF_HELO_PASS,SPF_PASS,STOCKLIKE autolearn=ham autolearn_force=no version=3.4.6-bugs.debian.org_2005_01_02 X-Spam-Bayes: score:0.0000 Tokens: new, 45; hammy, 150; neutral, 202; spammy, 0. spammytokens: hammytokens:0.000-+--bookworm, 0.000-+--sk:taint_o, 0.000-+--sk:TAINT_O, 0.000-+--sk:taint_u, 0.000-+--sk:TAINT_U Return-path: <nabijaczleweli@nabijaczleweli.xyz> Received: from tarta.nabijaczleweli.xyz ([139.28.40.42]:46002) by buxtehude.debian.org with esmtp (Exim 4.94.2) (envelope-from <nabijaczleweli@nabijaczleweli.xyz>) id 1qZsDV-002aFQ-Dz for submit@bugs.debian.org; Sat, 26 Aug 2023 12:16:38 +0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=nabijaczleweli.xyz; s=202305; t=1693052194; bh=yKIEqItcyZeFVVb92gE+gWsP5iPJEfyWN6AImeHOq0M=; h=Date:From:To:Subject:From; b=YZDeAdbl7LCoWe8qqDcS7mdGP4FA2twLqCXVplcfUz9BLDfrb+/sVsq6Olq2DPnUr axeUoz11tIPSs2T6ZObTq3LyobUDHv7YAcvBBX48ZKYS5cRpWtQt0KY4qIBAoVttQ4 mX0h2dEzaxKI1LHjOHYeWU7FUmi++NRn75nrsKLOwb/znBQNg3/JqUWbYcgOtA4b2q WlPTzrnalHtPNoxueO/9Negx/EAbX9CGHu8ugJJ3EnYtnk0SCOgOQA9imnxnfiz3Dr 4hAcyN9oxXD+2bL5NVqZcABAC6NFve/CADixia43htZtQuZlxwtF6lPG/3RZzLMvIc +vf2DShZf3C7Q== Received: by tarta.nabijaczleweli.xyz (Postfix, from userid 1000) id 56A97A4DA; Sat, 26 Aug 2023 14:16:34 +0200 (CEST) Date: Sat, 26 Aug 2023 14:16:34 +0200 From: =?utf-8?B?0L3QsNCx?= <nabijaczleweli@nabijaczleweli.xyz> To: Debian Bug Tracking System <submit@bugs.debian.org> Subject: reportbug: nginx normalises "Status: 123 " and "Status: 123" to invalid "HTTP/1.1 123" (must be "HTTP/1.1 123 ") Message-ID: <63v6gi4i6pmo4eidv3ige477k2pnhzgu6felpymoein4ybg7wv@xhwvslg7nnau> Mail-Followup-To: Debian Bug Tracking System <submit@bugs.debian.org> X-Reportbug-Version: 12.0.0 MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="2krbit2j7ce4yq4n" Content-Disposition: inline User-Agent: NeoMutt/20230517 Delivered-To: submit@bugs.debian.org --2krbit2j7ce4yq4n Content-Type: multipart/mixed; boundary="5rntt3z7nzbtty4d" Content-Disposition: inline --5rntt3z7nzbtty4d Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Package: nginx Version: 1.24.0-1 Severity: normal Dear Maintainer, Test setup: -- >8 -- #!/bin/sh printf '%s\n' "Status: ${DOCUMENT_URI##*/}" 'Content-Type: text/plain' '' "= ${DOCUMENT_URI##*/}" -- >8 -- in /tmp/cgi and -- >8 -- server { listen 127.1.2.3:80; location / { fastcgi_pass unix:/run/fcgiwrap.socket; include /etc/nginx/fastcgi_params; fastcgi_param SCRIPT_FILENAME /tmp/cgi; } } -- >8 -- in /etc/nginx/sites-enabled/demo. Naturally, this program returns "Status: {request path without /}", with body "{request path without /}" and whatever padding to make it palatable to nginx. Now, the abridged bug (full log attached, but it's not exciting): -- >8 -- $ curl -s -vvv http://127.1.2.3/'404%20Zupa' 2>&1 | cat -A > GET /404%20Zupa HTTP/1.1^M$ < HTTP/1.1 404 Zupa^M$ < Server: nginx/1.24.0^M$ 404 Zupa$ $ curl -s -vvv http://127.1.2.3/'404%20' 2>&1 | cat -A > GET /404%20 HTTP/1.1^M$ < HTTP/1.1 404^M$ < Server: nginx/1.24.0^M$ 404 $ $ curl -s -vvv http://127.1.2.3/'404' 2>&1 | cat -A > GET /404 HTTP/1.1^M$ < HTTP/1.1 404^M$ < Server: nginx/1.24.0^M$ 404$ $ curl -s -vvv http://127.1.2.3/'40' 2>&1 | cat -A > GET /40 HTTP/1.1^M$ < HTTP/1.1 502 Bad Gateway^M$ < Server: nginx/1.24.0^M$ <html>^M$ <head><title>502 Bad Gateway</title></head>^M$ <body>^M$ <center><h1>502 Bad Gateway</h1></center>^M$ <hr><center>nginx/1.24.0</center>^M$ </body>^M$ </html>^M$ -- >8 -- (yes, I straced fcgiwrap, it doesn't mangle the Status lines). Case-wise: "404 Zupa" correct! it's a valid 404 "40" correct! it's invalid, 502ing is sensible but "404 " wrong! "404" wrong! Both are normalised by nginx to "HTTP/1.1 404", which is invalid accd'g to RFC9112 (I think that's the current standard?): https://www.rfc-editor.org/rfc/rfc9112.html#name-collected-abnf which says start-line =3D request-line / status-line status-code =3D 3DIGIT status-line =3D HTTP-version SP status-code SP [ reason-phrase ] Naturally, nginx is producing a status-line without the second SP, which is wrong! Repros on sid and bookworm. Best, =D0=BD=D0=B0=D0=B1 -- System Information: Debian Release: trixie/sid APT prefers unstable APT policy: (500, 'unstable') Architecture: x32 (x86_64) Foreign Architectures: amd64, i386 Kernel: Linux 6.3.0-2-amd64 (SMP w/2 CPU threads; PREEMPT) Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_WARN, TAINT_OOT_MODULE,= TAINT_UNSIGNED_MODULE Locale: LANG=3Den_GB.UTF-8, LC_CTYPE=3Den_GB.UTF-8 (charmap=3DUTF-8), LANGU= AGE not set Shell: /bin/sh linked to /usr/bin/dash Init: systemd (via /run/systemd/system) LSM: AppArmor: enabled Versions of packages nginx depends on: ii iproute2 6.4.0-1 ii libc6 2.37-6 ii libcrypt1 1:4.4.35-1 ii libpcre2-8-0 10.42-2 ii libssl3 3.0.10-1 ii nginx-common 1.24.0-1 ii zlib1g 1:1.2.13.dfsg-1 nginx recommends no packages. nginx suggests no packages. -- no debconf information --5rntt3z7nzbtty4d Content-Type: text/plain; charset=us-ascii Content-Disposition: attachment; filename="full.log" $ curl -s -vvv http://127.1.2.3/'404%20Zupa' 2>&1 | cat -A * Trying 127.1.2.3:80...$ * Connected to 127.1.2.3 (127.1.2.3) port 80 (#0)$ > GET /404%20Zupa HTTP/1.1^M$ > Host: 127.1.2.3^M$ > User-Agent: curl/7.86.0^M$ > Accept: */*^M$ > ^M$ * Mark bundle as not supporting multiuse$ < HTTP/1.1 404 Zupa^M$ < Server: nginx/1.24.0^M$ < Date: Sat, 26 Aug 2023 11:53:59 GMT^M$ < Content-Type: text/plain^M$ < Transfer-Encoding: chunked^M$ < Connection: keep-alive^M$ < ^M$ { [19 bytes data]$ * Connection #0 to host 127.1.2.3 left intact$ 404 Zupa$ $ curl -s -vvv http://127.1.2.3/'404%20' 2>&1 | cat -A * Trying 127.1.2.3:80...$ * Connected to 127.1.2.3 (127.1.2.3) port 80 (#0)$ > GET /404%20 HTTP/1.1^M$ > Host: 127.1.2.3^M$ > User-Agent: curl/7.86.0^M$ > Accept: */*^M$ > ^M$ * Mark bundle as not supporting multiuse$ < HTTP/1.1 404^M$ < Server: nginx/1.24.0^M$ < Date: Sat, 26 Aug 2023 11:54:04 GMT^M$ < Content-Type: text/plain^M$ < Transfer-Encoding: chunked^M$ < Connection: keep-alive^M$ < ^M$ { [15 bytes data]$ * Connection #0 to host 127.1.2.3 left intact$ 404 $ $ curl -s -vvv http://127.1.2.3/'404' 2>&1 | cat -A * Trying 127.1.2.3:80...$ * Connected to 127.1.2.3 (127.1.2.3) port 80 (#0)$ > GET /404 HTTP/1.1^M$ > Host: 127.1.2.3^M$ > User-Agent: curl/7.86.0^M$ > Accept: */*^M$ > ^M$ * Mark bundle as not supporting multiuse$ < HTTP/1.1 404^M$ < Server: nginx/1.24.0^M$ < Date: Sat, 26 Aug 2023 11:55:51 GMT^M$ < Content-Type: text/plain^M$ < Transfer-Encoding: chunked^M$ < Connection: keep-alive^M$ < ^M$ { [14 bytes data]$ * Connection #0 to host 127.1.2.3 left intact$ 404$ $ curl -s -vvv http://127.1.2.3/'40' 2>&1 | cat -A * Trying 127.1.2.3:80...$ * Connected to 127.1.2.3 (127.1.2.3) port 80 (#0)$ > GET /40 HTTP/1.1^M$ > Host: 127.1.2.3^M$ > User-Agent: curl/7.86.0^M$ > Accept: */*^M$ > ^M$ * Mark bundle as not supporting multiuse$ < HTTP/1.1 502 Bad Gateway^M$ < Server: nginx/1.24.0^M$ < Date: Sat, 26 Aug 2023 11:55:53 GMT^M$ < Content-Type: text/html^M$ < Content-Length: 157^M$ < Connection: keep-alive^M$ < ^M$ { [157 bytes data]$ * Connection #0 to host 127.1.2.3 left intact$ <html>^M$ <head><title>502 Bad Gateway</title></head>^M$ <body>^M$ <center><h1>502 Bad Gateway</h1></center>^M$ <hr><center>nginx/1.24.0</center>^M$ </body>^M$ </html>^M$ --5rntt3z7nzbtty4d-- --2krbit2j7ce4yq4n Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEfWlHToQCjFzAxEFjvP0LAY0mWPEFAmTp7R8ACgkQvP0LAY0m WPETgg//UXBO1SF6/pz9iVyuH/BgjpCpxkqRSA0pEAd0QwhXz7JspaCip2Wg4J2T sw18qq5BR2U+WV/MQLiSE8pLNnQMTygDVw18L2U4H7H+iMMP3+toWukDgUKxjbk/ Xt6hadJqJN2dOHK3D4gKZnhlNw7obZhzFJbooOEe6gr65oS6bDXCMH3LLRCv7CNS bwVIoVIL724bYHZw3DXbLwRBSM4a+fkB4qXIfZLG//ANr+OZPcybZkWC6bd5t6sN RqDUaQjWhReZ+TGWV3UaaQtn+wGl6NWD9/f9iBj18qxo+1o+Qngt0lO3CHBzD16z hyJzs00dJ2i8OHR0inF4OBNx+ccMad2JlR97EovzKITsMBikKDDLgWlorSCxLQvf V/Jm+4n+6bAMD1uXc3rxgVGOQouMgz4AbvhjSO8FxBJ4oG/iMcKbeIosB2YZ5Y4x tGKsvfLwYVBXK/1JTe/UoBzbLLYtpXUvT7pZIkeXj18NodWz8zfFt11jEEaMNjvo lsT9KLAOdHQbp2DZDOG1HgseqDw3vfTwtBknZg0k+6jHt7JcX9nWULysp9FjsZ6I hKoWurTN5wdASsbArgvHQjceszeha4UIOnNqNtcsIzol72gIlE3QyBoGnpmBGeV2 ANYnu3EpFdKn/nLgGzgjB3IQgRzskE169Xse9hXPoW08aTv4MY4= =L4Ji -----END PGP SIGNATURE----- --2krbit2j7ce4yq4n-- ]