allowIllegalStartLineCharacters() ignored: InvalidHttpRequest{message='Illegal character in HTTP start line', lineNumber=1}

[octo-kumo]

RawHttp rawHttp = new RawHttp(RawHttpOptions.newBuilder()
                .allowIllegalStartLineCharacters()
                .allowContentLengthMismatch()
                .allowComments()
                .allowIllegalConnectAuthority()
                .build());

I am trying to send some naughty requests via rawhttp, and its complaining about illegal start line characters even though I explicitly allowed it.

It appears that allowIllegalStartLineCharacters is ignored by HttpMetadataParser

rawhttp/rawhttp-core/src/main/java/rawhttp/core/HttpMetadataParser.java

Lines 279 to 323 in 724e427

	private String parseStartLine(InputStream inputStream,
	BiFunction<String, Integer, RuntimeException> createError,
	boolean skipLeadingNewLine) throws IOException {
	StringBuilder metadataBuilder = new StringBuilder();
	final boolean allowNewLineWithoutReturn = options.allowNewLineWithoutReturn();
	int b;
	while ((b = inputStream.read()) >= 0) {
	if (b == '\r') {
	// expect new-line
	int next = inputStream.read();
	if (next < 0 || next == '\n') {
	if (skipLeadingNewLine) {
	skipLeadingNewLine = false;
	continue;
	}
	break;
	} else {
	inputStream.close();
	throw createError.apply("Illegal character after return", 1);
	}
	} else if (b == '\n') {
	if (skipLeadingNewLine) {
	skipLeadingNewLine = false;
	continue;
	}
	if (!allowNewLineWithoutReturn) {
	inputStream.close();
	throw createError.apply("Illegal new-line character without preceding return", 1);
	}
	// unexpected, but let's accept new-line without returns
	break;
	} else {
	char c = (char) b;
	if (c == ' ' || FieldValues.isAllowedInVCHARs(c)) {
	metadataBuilder.append(c);
	} else {
	throw createError.apply("Illegal character in HTTP start line", 1);
	}
	}
	skipLeadingNewLine = false;
	}
	return metadataBuilder.toString();
	}

[renatoathaydes]

You're right, I will fix this asap.

[renatoathaydes]

@octo-kumo it currently allows illegal characters in the URI part of the start-line.

Can you give me examples of things you think should be allowed? We can't just allow anything, there needs to be clear rules for what's allowed despite being illegal according to the spec.

[octo-kumo]

"/ＮＮ/ＮＮ/ＮＮ/etc/passwd",
"/static\\..\\..\\..\\..\\..\\..\\..\\..\\..\\..\\etc\\passwd",

Hi, these two paths triggered the exception.
They are both sent as GET requests to a normal host.