diff --git a/CHANGELOG.md b/CHANGELOG.md index 8e07874..ed6a8f7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -3,7 +3,7 @@ # Unreleased - Remove all usage of `string.inspect` as it's a huge anti-pattern for logging. -- Patch infinite loop on rejected trailer headers inside `handle_trailers`. +- Patch infinite loops and adjust allowed entries for trailer headers. # v3.0.4 - 13.03.2026 diff --git a/dev/benchmark.gleam b/dev/benchmark.gleam index 31ecddc..fe51684 100644 --- a/dev/benchmark.gleam +++ b/dev/benchmark.gleam @@ -24,6 +24,8 @@ fn handle_request(req: Request) -> Response { http.Post, ["user"] -> { case ewe.read_body(req, 40_000_000) { Ok(req) -> { + echo req.headers + let content_type = req |> request.get_header("content-type") diff --git a/src/ewe/internal/http1.gleam b/src/ewe/internal/http1.gleam index 2ed4f53..c346569 100644 --- a/src/ewe/internal/http1.gleam +++ b/src/ewe/internal/http1.gleam @@ -508,9 +508,7 @@ fn handle_trailers( case field_name { Ok(field_name) -> { - case - set.contains(set, field_name) && !is_forbidden_trailer(field_name) - { + case set.contains(set, field_name) && is_allowed_trailer(field_name) { True -> { case bit_array.to_string(value) { Ok(value) -> { @@ -530,18 +528,10 @@ fn handle_trailers( } } -/// Checks if a header field is forbidden in trailers. -fn is_forbidden_trailer(field: String) -> Bool { - case string.lowercase(field) { - "transfer-encoding" - | "content-length" - | "host" - | "cache-control" - | "expect" - | "max-forwards" - | "pragma" - | "range" - | "te" -> True +/// Checks if a trailer field is allowed. +fn is_allowed_trailer(field: String) -> Bool { + case field { + "server-timing" | "content-digest" | "repr-digest" -> True _ -> False } } -- 2.51.2 From 52f3e05b07bfca0dab44eb5d6a230443d91acb75 Mon Sep 17 00:00:00 2001 From: vshakitskiy Date: Sat, 14 Mar 2026 22:00:48 +0300 Subject: [PATCH 2/2] revert dev file --- dev/benchmark.gleam | 2 -- 1 file changed, 2 deletions(-) diff --git a/dev/benchmark.gleam b/dev/benchmark.gleam index fe51684..31ecddc 100644 --- a/dev/benchmark.gleam +++ b/dev/benchmark.gleam @@ -24,8 +24,6 @@ fn handle_request(req: Request) -> Response { http.Post, ["user"] -> { case ewe.read_body(req, 40_000_000) { Ok(req) -> { - echo req.headers - let content_type = req |> request.get_header("content-type")