xrootd 6.0.2__tar.gz → 6.0.3__tar.gz

{xrootd-6.0.2/xrootd.egg-info → xrootd-6.0.3}/PKG-INFO

@@ -1,9 +1,9 @@
 Metadata-Version: 2.4
 Name: xrootd
-Version: 6.0.2
+Version: 6.0.3
 Summary: eXtended ROOT daemon
 Home-page: https://xrootd.org
-Download-URL: https://github.com/xrootd/xrootd/archive/v6.0.2.tar.gz
+Download-URL: https://github.com/xrootd/xrootd/archive/v6.0.3.tar.gz
 Author: XRootD Developers
 Author-email: xrootd-dev@slac.stanford.edu
 License: LGPL-3.0-or-later

xrootd-6.0.3/VERSION

@@ -0,0 +1 @@
+v6.0.3

{xrootd-6.0.2 → xrootd-6.0.3}/docs/ReleaseNotes.txt

@@ -5,6 +5,23 @@ XRootD
 Release Notes
 =============
 
+-------------
+Version 6.0.3
+-------------
+
+All bugfixes and improvements from XRootD 5.9.5 are also in XRootD 6.0.3.
+
++ **Bugfixes**
+  **[XrdClHttp]** Fix bug preventing the configuration of threads
+  **[XrdCrypto]** Fix leak of file descriptor in XrdCryptosslX509::XrdCryptosslX509
+  **[XrdHttp]** Add the resource type tag for non-collections in xml response
+  **[XrdHttp]** Strengthen Content-Length and Transfer-Encoding header parsing
+
++ **Miscellaneous**
+  **[CI]** Move permissions down to job level in Python workflow
+  **[CI]** Update ABI compliance check build
+  **[CI]** Adjust build triggers of GitHub Action workflows
+
 -------------
 Version 6.0.2
 -------------
@@ -120,6 +137,25 @@ Version 6.0.0
   **[XrdOuc]** Use nlohmann_json from the system when possible
   **[XrdXrootd]** Define oss.coloc as URL encoded and provide encode/decode util
 
+-------------
+Version 5.9.5
+-------------
+
++ **Major bug fixes**
+  **[XrdMacaroons]** Fix double free bug when reading macaroon secret (#2797)
+
++ **Minor bug fixes**
+  **[Python]** Use with statement to ensure VERSION file is closed
+  **[XrdHttp]** Do not set iscollection property to 1 for executable files
+  **[XrdHttp]** Perform minimal host validation in XrdHttpReq::Redir()
+  **[XrdHttp]** Re-encode resource when appending opaque information
+  **[XrdHttp]** Use strtoll in XrdHttpReq::ProcessHTTPReq()
+  **[XrdHttpTpc]** Set CURLOPT_SSLVERSION to at least TLSv1.2
+
++ **Miscellaneous**
+  **[CI]** Build Python wheels in parallel
+  **[CI]** Do not let delocate-wheel remove RPATHs from macOS wheels (#2784)
+
 -------------
 Version 5.9.4
 -------------

xrootd-6.0.3/python/VERSION

@@ -0,0 +1 @@
+v6.0.3

{xrootd-6.0.2 → xrootd-6.0.3}/python/setup.py

@@ -55,14 +55,14 @@ def get_version():
 
     if version.startswith('$'):
         try:
-            version = open('VERSION').read().strip()
+            with open('VERSION') as f:
+                version = f.read().strip()
 
             if version.startswith('$'):
                 output = check_output(['git', 'describe'])
                 version = output.decode().strip()
         except:
             version = None
-            pass
 
     if version is None:
         from datetime import date

{xrootd-6.0.2 → xrootd-6.0.3}/setup.py

@@ -25,14 +25,14 @@ def get_cmake_args():
 
 def get_version():
     try:
-        version = open('VERSION').read().strip()
+        with open('VERSION') as f:
+            version = f.read().strip()
 
         if version.startswith('$'):
             output = check_output(['git', 'describe'])
             version = output.decode().strip()
     except:
         version = None
-        pass
 
     if version is None:
         from datetime import date

{xrootd-6.0.2 → xrootd-6.0.3}/src/XrdClHttp/XrdClHttpFactory.cc

@@ -194,7 +194,7 @@ Factory::Initialize()
         auto &cache = XrdClHttp::VerbsCache::Instance();
 
         // Startup curl workers after we've set the configs to avoid race conditions
-        for (unsigned idx=0; idx<m_poll_threads; idx++) {
+        for (int idx=0; idx<num_threads; idx++) {
             auto wk = std::make_unique<XrdClHttp::CurlWorker>(m_queue, cache, m_log);
             auto wkp = wk.get();
             std::thread t(XrdClHttp::CurlWorker::RunStatic, wkp);

{xrootd-6.0.2 → xrootd-6.0.3}/src/XrdCrypto/XrdCryptosslX509.cc

@@ -120,6 +120,7 @@ XrdCryptosslX509::XrdCryptosslX509(const char *cf, const char *kf)
    // Read the content:
    if (!PEM_read_X509(fc, &cert, 0, 0)) {
       DEBUG("Unable to load certificate from file");
+      fclose(fc);
       return;
    } else {
       DEBUG("certificate successfully loaded");

{xrootd-6.0.2 → xrootd-6.0.3}/src/XrdHttp/XrdHttpHeaderUtils.cc

@@ -26,6 +26,10 @@
 
 #include <vector>
 #include <algorithm>
+#include <cerrno>
+#include <cstdlib>
+#include <limits>
+#include <string_view>
 
 
 void XrdHttpHeaderUtils::parseReprDigest(const std::string &value, std::map<std::string, std::string> &output) {
@@ -101,4 +105,62 @@ void XrdHttpHeaderUtils::parseWantReprDigest(const std::string & value, std::map
       // discard invalid values
     }
   }
-}
+}
+
+ssize_t XrdHttpHeaderUtils::parseContentLength(const std::string & value) {
+  std::string_view sv{value};
+  // parseLine forwards the trailing CRLF (and any preceding spaces/tabs).
+  while (!sv.empty() && (sv.back() == '\r' || sv.back() == '\n' ||
+                         sv.back() == ' '  || sv.back() == '\t')) {
+    sv.remove_suffix(1);
+  }
+  if (sv.empty()) {
+    return -1;
+  }
+  // RFC 9112 §6.2: 1*DIGIT only — no sign, no embedded whitespace.
+  for (char c : sv) {
+    if (c < '0' || c > '9') {
+      return -2;
+    }
+  }
+  std::string nullTerm{sv};
+  errno = 0;
+  long long parsed = std::strtoll(nullTerm.c_str(), nullptr, 10);
+  if (errno == ERANGE ||
+      parsed > static_cast<long long>(std::numeric_limits<ssize_t>::max())) {
+    return -3;
+  }
+  return static_cast<ssize_t>(parsed);
+}
+
+int XrdHttpHeaderUtils::parseTransferEncoding(const std::string & value) {
+  std::vector<std::string> tokens;
+  XrdOucTUtils::splitString(tokens, value, ",");
+
+  bool chunked_seen = false;
+  bool last_was_chunked = false;
+  bool any_token = false;
+
+  for (auto & tok : tokens) {
+    std::string_view sv{tok};
+    XrdOucUtils::trim(sv);
+    if (sv.empty()) continue;
+
+    // RFC 9112 §6.1: transfer-coding names are case-insensitive. Whole-token
+    // match (not strstr) so "chunkedX" or "x-chunked" no longer falsely hit.
+    std::string tlow{sv};
+    std::transform(tlow.begin(), tlow.end(), tlow.begin(), ::tolower);
+    any_token = true;
+    if (tlow == "chunked") {
+      chunked_seen = true;
+      last_was_chunked = true;
+    } else {
+      last_was_chunked = false;
+    }
+  }
+
+  if (!any_token)        return -1;
+  if (!chunked_seen)     return -2;
+  if (!last_was_chunked) return -3;
+  return 0;
+}

xrootd-6.0.3/src/XrdHttp/XrdHttpHeaderUtils.hh

@@ -0,0 +1,110 @@
+//------------------------------------------------------------------------------
+// This file is part of XrdHTTP: A pragmatic implementation of the
+// HTTP/WebDAV protocol for the Xrootd framework
+//
+// Copyright (c) 2025 by European Organization for Nuclear Research (CERN)
+// Author: Cedric Caffy <ccaffy@cern.ch>
+// File Date: Jun 2025
+//------------------------------------------------------------------------------
+// XRootD is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Lesser General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// XRootD is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU General Public License for more details.
+//
+// You should have received a copy of the GNU Lesser General Public License
+// along with XRootD.  If not, see <http://www.gnu.org/licenses/>.
+//------------------------------------------------------------------------------
+
+#ifndef XROOTD_XRDHTTPHEADERUTILS_HH
+#define XROOTD_XRDHTTPHEADERUTILS_HH
+
+#include <map>
+#include <string>
+#include <cstdint>
+#include <sys/types.h>
+
+class XrdHttpHeaderUtils {
+public:
+
+  /**
+   * Parses the 'Repr-Digest' header value received from the client
+   * Syntax: "Repr-Digest: adler=:base64EncodedValue:, crc32=:base64EncodedValue:
+   * @param value contains the value of the header Repr-Digest
+   * @param output the map containing the digests and their associated base64 encoded values
+   */
+  static void parseReprDigest(const std::string & value, std::map<std::string,std::string> & output);
+
+  /**
+   * Parses 'Want-Repr-Digest' header value received from the client
+   * Syntax: "Want-Repr-Digest: adler=1, crc32=2, sha-256=9
+   * The values are integers representing the preference, comprised between 0 and 9.
+   *
+   * @param value contains the value of the header Want-Repr-Digest
+   * @param output the map containing the lower-cased digest name and the associated preference
+   */
+  static void parseWantReprDigest(const std::string & value, std::map<std::string, uint8_t> & output);
+
+  /**
+   * Parses the value of a 'Content-Length' HTTP header.
+   *
+   * The HTTP spec says Content-Length must be one or more decimal digits
+   * with no sign character and no whitespace inside the number. Anything
+   * else is malformed and must be rejected with HTTP 400, because if we
+   * trust a garbage Content-Length we may disagree with a proxy in front
+   * of us on where the request body ends — which is the basis of HTTP
+   * request smuggling attacks.
+   *
+   * Trailing whitespace and CRLF in the value are tolerated (parseLine
+   * forwards the raw header line including the closing \r\n).
+   *
+   * Reference: RFC 9112 §6.2 (Content-Length syntax) and RFC 7230 §3.3.3
+   * rule 4 (rejection of invalid values).
+   *
+   * @param value the raw value of the Content-Length header
+   * @return the parsed non-negative integer on success, or a distinct
+   *         negative code on error:
+   *           -1 the value is empty (after trimming trailing CRLF / OWS),
+   *           -2 the value contains a non-digit character (sign, garbage,
+   *              embedded whitespace),
+   *           -3 the value is numerically too large for an ssize_t.
+   */
+  static ssize_t parseContentLength(const std::string & value);
+
+  /**
+   * Parses the value of a 'Transfer-Encoding' HTTP header.
+   *
+   * Transfer-Encoding carries a comma-separated list of body encodings,
+   * for example "chunked" or "gzip, chunked". The list is case-insensitive
+   * and items can have whitespace around them.
+   *
+   * The only encoding this server speaks is "chunked". HTTP requires
+   * that whenever "chunked" appears it must be the LAST item in the list
+   * (because that is the one that determines how the body is framed
+   * on the wire).
+   *
+   * This function checks two things together: that "chunked" is actually
+   * present (matched case-insensitively as a whole token, not as a
+   * substring like the old code did), and that it is the last item.
+   *
+   * Trailing CRLF on the last item is tolerated.
+   *
+   * Reference: RFC 9112 §6.1 (Transfer-Encoding syntax and the
+   * "chunked-must-be-last" rule) and RFC 7230 §3.3.1 (same rule).
+   *
+   * @param value the raw value of the Transfer-Encoding header
+   * @return 0 on success (the list ends in "chunked"), or a distinct
+   *         negative code on error:
+   *           -1 the value is empty (no tokens after splitting/trimming),
+   *           -2 there is no "chunked" token in the list at all,
+   *           -3 "chunked" appears but is not the final token.
+   */
+  static int parseTransferEncoding(const std::string & value);
+};
+
+
+#endif //XROOTD_XRDHTTPHEADERUTILS_HH

{xrootd-6.0.2 → xrootd-6.0.3}/src/XrdHttp/XrdHttpReq.cc

@@ -177,7 +177,33 @@ int XrdHttpReq::parseLine(char *line, int len) {
       // Therefore no need for the range handler to report an error.
       readRangeHandler.ParseContentRange(val);
     } else if (!strcasecmp(key, "content-length")) {
-      length = atoll(val);
+      // Parse and validate the Content-Length value (one-or-more digits,
+      // no sign, no embedded garbage, no overflow). Anything malformed
+      // gives the server an ambiguous body length and is an HTTP request
+      // smuggling primitive — reject with HTTP 400.
+      // Reference: RFC 9112 §6.2, RFC 7230 §3.3.3 rule 4.
+      ssize_t parsed = XrdHttpHeaderUtils::parseContentLength(val);
+      if (parsed < 0) {
+        request = rtMalformed;
+        return -6;
+      }
+      if (m_transfer_encoding_chunked) {
+        // A request that already declared Transfer-Encoding: chunked and
+        // now also sends Content-Length is the classic smuggling vector
+        // (the frontend and backend may disagree on which header wins).
+        // Reference: RFC 9112 §6.1.
+        request = rtMalformed;
+        return -8;
+      }
+      if (length_seen && parsed != length) {
+        // Two Content-Length headers with different values. The body
+        // length is ambiguous; reject.
+        // Reference: RFC 7230 §3.3.3 rule 4.
+        request = rtMalformed;
+        return -7;
+      }
+      length = parsed;
+      length_seen = true;
 
     } else if (!strcasecmp(key, "destination")) {
       destination.assign(val, line+len-val);
@@ -198,8 +224,26 @@ int XrdHttpReq::parseLine(char *line, int len) {
       sendcontinue = true;
     } else if (!strcasecmp(key, "te") && strstr(val, "trailers")) {
       m_trailer_headers = true;
-    } else if (!strcasecmp(key, "transfer-encoding") && strstr(val, "chunked")) {
-      m_transfer_encoding_chunked = true; 
+    } else if (!strcasecmp(key, "transfer-encoding")) {
+      // Tokenize the Transfer-Encoding list and verify that "chunked"
+      // is present AND is the final encoding. Anything else (substring
+      // matches like "chunkedX", a non-final "chunked", or only unknown
+      // codings) is rejected so a frontend proxy cannot disagree with us
+      // about how the body is framed.
+      // Reference: RFC 9112 §6.1, RFC 7230 §3.3.1.
+      if (XrdHttpHeaderUtils::parseTransferEncoding(val) != 0) {
+        request = rtMalformed;
+        return -4;
+      }
+      if (length_seen) {
+        // Content-Length was already accepted and now Transfer-Encoding:
+        // chunked arrives. Reject (see the matching check in the
+        // Content-Length branch above).
+        // Reference: RFC 9112 §6.1.
+        request = rtMalformed;
+        return -8;
+      }
+      m_transfer_encoding_chunked = true;
     } else if (!strcasecmp(key, "x-transfer-status") && strstr(val, "true")) {
       m_transfer_encoding_chunked = true;
       m_status_trailer = true;
@@ -562,6 +606,21 @@ bool XrdHttpReq::Redir(XrdXrootd::Bridge::Context &info, //!< the result context
   char buf[512];
   char hash[512];
   hash[0] = '\0';
+
+  bool invalid_host = false;
+
+  if (!hname) {
+    invalid_host = true;
+  } else {
+    for (const char *c = hname; *c; ++c)
+      if (*c == '\r' || *c == '\n')
+        invalid_host = true;
+  }
+
+  if (invalid_host) {
+    prot->SendSimpleResp(502, nullptr, nullptr, "Invalid redirect host", 0, false);
+    return keepalive;
+  }
   
   if (prot->isdesthttps)
     redirdest = "Location: https://";
@@ -1020,7 +1079,7 @@ int XrdHttpReq::ProcessHTTPReq() {
                   if (s.endswith('/'))
                     s.erasefromend(1);
 
-                  s.append(resource);
+                  s.append(encode_str(std::string(resource.c_str())).c_str());
                   appendOpaque(s, 0, 0, 0);
 
                   prot->SendSimpleResp(302, NULL, (char *) s.c_str(), 0, 0, false);
@@ -1122,7 +1181,7 @@ int XrdHttpReq::ProcessHTTPReq() {
               if (s.endswith('/'))
                 s.erasefromend(1);
 
-              s.append(resource);
+              s.append(encode_str(std::string(resource.c_str())).c_str());
               appendOpaque(s, 0, 0, 0);
 
               prot->SendSimpleResp(302, NULL, (char *) s.c_str(), 0, 0, false);
@@ -1353,7 +1412,7 @@ int XrdHttpReq::ProcessHTTPReq() {
             if (found_newline) {
               char *endptr = NULL;
               std::string line_contents(prot->myBuffStart, idx);
-              long long chunk_contents = strtol(line_contents.c_str(), &endptr, 16);
+              long long chunk_contents = strtoll(line_contents.c_str(), &endptr, 16);
                 // Chunk sizes can be followed by trailer information or CRLF
               if (*endptr != ';' && *endptr != '\r') {
                 prot->SendSimpleResp(400, NULL, NULL, (char *)"Invalid chunked encoding", 0, false);
@@ -2457,7 +2516,6 @@ int XrdHttpReq::PostProcessHTTPReq(bool final_) {
 
               if (e.flags & kXR_xset) {
                 stringresp += "<lp1:executable>T</lp1:executable>\n";
-                stringresp += "<lp1:iscollection>1</lp1:iscollection>\n";
               } else {
                 stringresp += "<lp1:executable>F</lp1:executable>\n";
               }
@@ -2756,6 +2814,7 @@ void XrdHttpReq::reset() {
   headerok = false;
   keepalive = true;
   length = 0;
+  length_seen = false;
   filesize = 0;
   depth = 0;
   sendcontinue = false;

{xrootd-6.0.2 → xrootd-6.0.3}/src/XrdHttp/XrdHttpReq.hh

@@ -49,6 +49,7 @@
 #include <map>
 #include <string>
 #include <vector>
+#include <sys/types.h>
 
 struct DirListInfo {
   std::string path;
@@ -118,7 +119,7 @@ private:
   std::string m_user_agent;
 
   // Whether transfer encoding was requested.
-  bool m_transfer_encoding_chunked;
+  bool m_transfer_encoding_chunked{false};
   long long m_current_chunk_offset;
   long long m_current_chunk_size;
 
@@ -292,7 +293,8 @@ public:
   bool                      closeAfterError;
 
   bool keepalive;
-  long long length;  // Total size from client for PUT; total length of response TO client for GET.
+  ssize_t length;  // Total size from client for PUT; total length of response TO client for GET.
+  bool length_seen{false};  // Set once a Content-Length header has been accepted (RFC 7230 §3.3.3 rule 4).
   int depth;
   bool sendcontinue;
 

{xrootd-6.0.2 → xrootd-6.0.3}/src/XrdHttpTpc/XrdHttpTpcTPC.cc

@@ -924,6 +924,7 @@ int TPCHandler::ProcessPushReq(const std::string & resource, XrdHttpExtReq &req)
         return req.SendSimpleResp(rec.status, NULL, NULL, generateClientErr(ss, rec).c_str(), 0);
     }
     curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1);
+    curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
     curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, (long) CURL_HTTP_VERSION_1_1);
 #if CURL_AT_LEAST_VERSION(7, 85, 0)
     curl_easy_setopt(curl, CURLOPT_PROTOCOLS_STR,       "https,http");
@@ -1050,6 +1051,7 @@ int TPCHandler::ProcessPullReq(const std::string &resource, XrdHttpExtReq &req)
         curl_easy_setopt(curl, CURLOPT_INTERFACE, ip);
     }
     curl_easy_setopt(curl, CURLOPT_NOSIGNAL, 1);
+    curl_easy_setopt(curl, CURLOPT_SSLVERSION, CURL_SSLVERSION_TLSv1_2);
     curl_easy_setopt(curl, CURLOPT_HTTP_VERSION, (long) CURL_HTTP_VERSION_1_1);
 #if CURL_AT_LEAST_VERSION(7, 85, 0)
     curl_easy_setopt(curl, CURLOPT_PROTOCOLS_STR,       "https,http");

{xrootd-6.0.2 → xrootd-6.0.3}/src/XrdMacaroons/XrdMacaroonsConfigure.cc

@@ -194,15 +194,15 @@ bool Handler::xsecretkey(XrdOucStream &config_obj, XrdSysError *log, std::string
 
   BIO *b64 = BIO_new(BIO_f_base64());
   if (!b64) {
-    BIO_free_all(bio);
+    BIO_free(bio);
     log->Emsg("Config", "Failed to allocate base64 filter");
     return false;
   }
 
   BIO *bio_out = BIO_new(BIO_s_mem());
   if (!bio_out) {
-    BIO_free_all(b64);
-    BIO_free_all(bio);
+    BIO_free(b64);
+    BIO_free(bio);
     log->Emsg("Config", "Failed to allocate BIO output");
     return false;
   }
@@ -224,7 +224,6 @@ bool Handler::xsecretkey(XrdOucStream &config_obj, XrdSysError *log, std::string
   if (inlen < 0) {
     BIO_free_all(bio_out);
     BIO_free_all(b64);
-    BIO_free_all(bio);
     log->Emsg("Config", errno, "read secret key.");
     return false;
   }
@@ -232,7 +231,6 @@ bool Handler::xsecretkey(XrdOucStream &config_obj, XrdSysError *log, std::string
   if (!BIO_flush(bio_out)) {
     BIO_free_all(bio_out);
     BIO_free_all(b64);
-    BIO_free_all(bio);
     log->Emsg("Config", errno, "flush secret key.");
     return false;
   }
@@ -244,7 +242,6 @@ bool Handler::xsecretkey(XrdOucStream &config_obj, XrdSysError *log, std::string
 
   BIO_free_all(bio_out);
   BIO_free_all(b64);
-  BIO_free_all(bio);
 
   if (secret.size() < 32) {
     log->Emsg("Config", "Secret key is too short; must be 32 bytes long.  Try running 'openssl rand -base64 -out", val, "64' to generate a new key");

{xrootd-6.0.2 → xrootd-6.0.3}/tests/XRootD/http.sh

@@ -448,4 +448,100 @@ function test_http() {
   # For HTTP GStream monitoring use: socat -u udp-recv:8888 -
   # sleep 5
 
+  ##
+  ## End-to-end HTTP request-smuggling regression — one connection per
+  ## scenario.
+  ##
+  smugglingDir="${TMPDIR}/smuggling"
+  assert xrdfs "${DAV_HOST}" mkdir -p "${smugglingDir}"
+
+  # Derive raw host:port from HTTP_HOST so the test reaches the same instance
+  # the rest of the suite uses (not always localhost — e.g. a remote dev box).
+  smugglingTarget="${HTTP_HOST#*://}"
+  smugglingTarget="${smugglingTarget%%/*}"
+  smugglingHost="${smugglingTarget%:*}"
+  smugglingPort="${smugglingTarget##*:}"
+
+  # Sends $1 verbatim over a fresh TCP connection and prints the first
+  # response line (CRLF stripped). If no status line arrives we emit a
+  # distinct diagnostic for each failure mode so assertion logs are
+  # readable: bash `read -t` returns >128 on the read timer firing (server
+  # left us hanging) versus a small non-zero exit when the peer closed the
+  # socket before sending anything.
+  _smuggling_send() {
+    local payload="$1"
+    local status=""
+    local rc=0
+    exec 3<>"/dev/tcp/${smugglingHost}/${smugglingPort}"
+    printf '%s' "$payload" >&3
+    IFS= read -r -t 10 status <&3 || rc=$?
+    exec 3<&-
+    status="${status//$'\r'/}"
+    if [[ -n "${status}" ]]; then
+      printf '%s' "${status}"
+    elif (( rc > 128 )); then
+      printf '<request stalled — read timed out waiting for a status line>'
+    else
+      printf '<server closed the connection without sending a status line>'
+    fi
+  }
+
+  # Asserts the smuggled file at $1 was NOT created on the server.
+  _smuggling_assert_not_created() {
+    local path="$1"
+    local code
+    code=$(curl -s -o /dev/null --write-out '%{http_code}' \
+      "${HTTP_HOST}/${smugglingDir}/${path}")
+    assert_eq 404 "${code}" \
+      "smuggled ${path} file must not exist on the server"
+  }
+
+  # 1. Content-Length followed by Transfer-Encoding: chunked. RFC 9112 §6.1
+  #    forbids the combination; parseLine returns -8.
+  status=$(_smuggling_send "$(printf 'PUT /%s/cl_te HTTP/1.1\r\nHost: x\r\nContent-Length: 0\r\nTransfer-Encoding: chunked\r\n\r\nPUT /%s/POLL_CL_TE HTTP/1.1\r\nHost: x\r\nContent-Length: 4\r\n\r\nWWWW' "${smugglingDir}" "${smugglingDir}")")
+  echo "[CL then TE:chunked] response: ${status}"
+  assert_eq "HTTP/1.1 400 Bad Request" "${status}" \
+    "CL followed by TE: chunked must be rejected with 400"
+  _smuggling_assert_not_created POLL_CL_TE
+
+  # 2. Same conflict, opposite order: TE: chunked then Content-Length.
+  status=$(_smuggling_send "$(printf 'PUT /%s/te_cl HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunked\r\nContent-Length: 0\r\n\r\nPUT /%s/POLL_TE_CL HTTP/1.1\r\nHost: x\r\nContent-Length: 4\r\n\r\nWWWW' "${smugglingDir}" "${smugglingDir}")")
+  echo "[TE:chunked then CL] response: ${status}"
+  assert_eq "HTTP/1.1 400 Bad Request" "${status}" \
+    "TE: chunked followed by CL must be rejected with 400"
+  _smuggling_assert_not_created POLL_TE_CL
+
+  # 3. Two Content-Length headers with different values. RFC 7230 §3.3.3
+  #    rule 4 says reject (body length ambiguous); parseLine returns -7.
+  status=$(_smuggling_send "$(printf 'PUT /%s/dual_cl HTTP/1.1\r\nHost: x\r\nContent-Length: 4\r\nContent-Length: 100\r\n\r\nWWWWPUT /%s/POLL_DUAL_CL HTTP/1.1\r\nHost: x\r\nContent-Length: 4\r\n\r\nWWWW' "${smugglingDir}" "${smugglingDir}")")
+  echo "[dual CL] response: ${status}"
+  assert_eq "HTTP/1.1 400 Bad Request" "${status}" \
+    "two CL headers with different values must be rejected with 400"
+  _smuggling_assert_not_created POLL_DUAL_CL
+
+  # 4. Malformed Content-Length (negative). RFC 9112 §6.2 requires 1*DIGIT;
+  #    parseLine returns -6.
+  status=$(_smuggling_send "$(printf 'PUT /%s/cl_neg HTTP/1.1\r\nHost: x\r\nContent-Length: -1\r\n\r\nPUT /%s/POLL_CL_NEG HTTP/1.1\r\nHost: x\r\nContent-Length: 4\r\n\r\nWWWW' "${smugglingDir}" "${smugglingDir}")")
+  echo "[negative CL] response: ${status}"
+  assert_eq "HTTP/1.1 400 Bad Request" "${status}" \
+    "negative Content-Length must be rejected with 400"
+  _smuggling_assert_not_created POLL_CL_NEG
+
+  # 5. Substring bypass: TE: chunkedX. The old code did strstr(val, "chunked")
+  #    and matched here, letting chunkedX masquerade as chunked. The whole-
+  #    token comparison in parseTransferEncoding returns NoChunked; parseLine
+  #    returns -5.
+  status=$(_smuggling_send "$(printf 'PUT /%s/te_subs HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: chunkedX\r\n\r\nPUT /%s/POLL_TE_SUBS HTTP/1.1\r\nHost: x\r\nContent-Length: 4\r\n\r\nWWWW' "${smugglingDir}" "${smugglingDir}")")
+  echo "[TE: chunkedX] response: ${status}"
+  assert_eq "HTTP/1.1 400 Bad Request" "${status}" \
+    "TE: chunkedX (substring bypass) must be rejected with 400"
+  _smuggling_assert_not_created POLL_TE_SUBS
+
+  # 6. The original CVE: TE: CHUNKED (uppercase) silently dropped by the
+  #    case-sensitive strstr. With the fix the value is correctly seen as
+  #    chunked framing; the smuggled bytes are then consumed by the chunked-
+  #    body parser, which stalls on the bogus chunk-size line. No
+  #    deterministic response line, so we only assert POLL_TE_UPPER 404.
+  _smuggling_send "$(printf 'PUT /%s/te_upper HTTP/1.1\r\nHost: x\r\nTransfer-Encoding: CHUNKED\r\n\r\nPUT /%s/POLL_TE_UPPER HTTP/1.1\r\nHost: x\r\nContent-Length: 4\r\n\r\nWWWW' "${smugglingDir}" "${smugglingDir}")" > /dev/null
+  _smuggling_assert_not_created POLL_TE_UPPER
 }

{xrootd-6.0.2 → xrootd-6.0.3}/tests/XRootD/posix.sh

@@ -15,11 +15,11 @@ function test_posix() {
 	# Make sure all symbols are actually resolved correctly
 	MISSING_SYMBOLS=$(env XRDPOSIX_REPORT=1 xrdposix-cat /dev/null 2>&1)
 
-        if grep -q 'Unable to resolve' <<< "${MISSING_SYMBOLS}"; then
-                echo "XrdPosix cannot resolve some symbols:"
-                echo "${MISSING_SYMBOLS}"
-                exit 1
-        fi
+	if grep -q 'Unable to resolve' <<< "${MISSING_SYMBOLS}"; then
+		echo "XrdPosix cannot resolve some symbols:"
+		echo "${MISSING_SYMBOLS}"
+		exit 1
+	fi
 
 	# Check that cat with the local files still works