{"record":{"id":"53941aa976395a82","repo":"actix/actix-web","slug":"invalid-character-in-chunk-extension","errorCode":null,"errorMessage":"Invalid character in chunk extension","messagePattern":"Invalid character in chunk extension","errorType":"exception","errorClass":"io::Error","httpStatus":null,"severity":"error","filePath":"actix-http/src/h1/chunked.rs","lineNumber":105,"sourceCode":"    }\n\n    fn read_size_lws(rdr: &mut BytesMut) -> Poll<Result<ChunkedState, io::Error>> {\n        match byte!(rdr) {\n            // LWS can follow the chunk size, but no more digits can come\n            b'\\t' | b' ' => Poll::Ready(Ok(ChunkedState::SizeLws)),\n            b';' => Poll::Ready(Ok(ChunkedState::Extension)),\n            b'\\r' => Poll::Ready(Ok(ChunkedState::SizeLf)),\n            _ => Poll::Ready(Err(io::Error::new(\n                io::ErrorKind::InvalidInput,\n                \"Invalid chunk size linear white space\",\n            ))),\n        }\n    }\n    fn read_extension(rdr: &mut BytesMut) -> Poll<Result<ChunkedState, io::Error>> {\n        match byte!(rdr) {\n            b'\\r' => Poll::Ready(Ok(ChunkedState::SizeLf)),\n            // strictly 0x20 (space) should be disallowed but we don't parse quoted strings here\n            0x00..=0x08 | 0x0a..=0x1f | 0x7f => Poll::Ready(Err(io::Error::new(\n                io::ErrorKind::InvalidInput,\n                \"Invalid character in chunk extension\",\n            ))),\n            _ => Poll::Ready(Ok(ChunkedState::Extension)), // no supported extensions\n        }\n    }\n    fn read_size_lf(rdr: &mut BytesMut, size: u64) -> Poll<Result<ChunkedState, io::Error>> {\n        match byte!(rdr) {\n            b'\\n' if size > 0 => Poll::Ready(Ok(ChunkedState::Body)),\n            b'\\n' if size == 0 => Poll::Ready(Ok(ChunkedState::EndCr)),\n            _ => Poll::Ready(Err(io::Error::new(\n                io::ErrorKind::InvalidInput,\n                \"Invalid chunk size LF\",\n            ))),\n        }\n    }\n\n    fn read_body(","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/actix/actix-web/blob/4d435abc281842f3cbee165b6cde739e001d3a25/actix-http/src/h1/chunked.rs#L87-L123","documentation":"Raised in read_extension (chunked.rs:105) when a chunk extension contains a control character in the ranges 0x00-0x08, 0x0a-0x1f, or 0x7f. The extension parser only allows CR to terminate and tolerates printable bytes plus tab; bare LF or other controls are rejected (test hrs_chunk_extension_invalid at chunked.rs:385 sends \"2;x\\nx\" to trigger it).","triggerScenarios":"A chunk extension like \"2;x\\nx\\r\\n\" contains a raw newline/control byte inside the extension value. The match at chunked.rs:105 returns the InvalidInput error.","commonSituations":"Request-smuggling attempts injecting LF into extensions to confuse parsers; a client that doesn't escape/quote extension values; malformed quoted-string handling.","solutions":["Keep chunk extensions free of raw control characters; quote values if they contain specials.","Avoid relying on chunk extensions at all - most clients/servers ignore them.","Treat repeated occurrences as hostile traffic and rate-limit/block the source."],"exampleFix":"// before\n\"2;x\\nx\\r\\nxx\\r\\n\"\n// after (no control chars in extension)\n\"2;x=ok\\r\\nxx\\r\\n\"","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match payload.next().await {\n    Some(Err(PayloadError::Io(e))) if e.kind() == io::ErrorKind::InvalidInput =>\n        return HttpResponse::BadRequest().finish(), // control char in chunk ext\n    _ => { /* ... */ }\n}","preventionTips":["Avoid chunk extensions entirely.","Never put raw control bytes (LF/CR/NUL) in extensions.","Block repeated offenders - this pattern is used in smuggling."],"tags":["http","chunked-encoding","actix-http","security"],"backgroundTag":null,"analyzedSha":"4d435abc281842f3cbee165b6cde739e001d3a25","analyzedAt":"2026-08-09T01:01:40.926Z","contentChangedAt":"2026-08-09T01:01:40.926Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}