v0.28.0

src/proxy/websocket/handshake.rs

@@ -283,8 +283,15 @@ pub fn validate_response(
             "invalid upstream upgrade"
         );
         ensure!(
-            !headers.contains_key("transfer-encoding") && !headers.contains_key("content-length"),
-            "101 response must not include body framing"
+            !headers.contains_key("transfer-encoding"),
+            "101 response must not use Transfer-Encoding"
+        );
+        ensure!(
+            headers.get_all("content-length").iter().count() <= 1
+                && headers
+                    .get("content-length")
+                    .is_none_or(|value| value.to_str().is_ok_and(|value| value.trim() == "0")),
+            "101 response Content-Length must be 0 when present"
         );
         for value in headers.get_all("connection").iter() {
             for field in value.to_str()?.split(',') {

src/proxy/websocket/tests.rs

@@ -200,6 +200,29 @@ mod tests {
         assert!(validate_response(&headers, &expected, true).is_err());
     }
 
+    #[test]
+    fn strict_upstream_101_body_framing_matrix() {
+        let expected = validate(&request()).unwrap();
+        let base = || {
+            let mut headers = HeaderMap::new();
+            headers.insert("connection", "Upgrade".parse().unwrap());
+            headers.insert("upgrade", "websocket".parse().unwrap());
+            headers.insert("sec-websocket-accept", expected.accept.parse().unwrap());
+            headers
+        };
+
+        assert!(validate_response(&base(), &expected, false).is_ok());
+        let mut content_length_zero = base();
+        content_length_zero.insert("content-length", "0".parse().unwrap());
+        assert!(validate_response(&content_length_zero, &expected, false).is_ok());
+        let mut content_length_body = base();
+        content_length_body.insert("content-length", "1".parse().unwrap());
+        assert!(validate_response(&content_length_body, &expected, false).is_err());
+        let mut transfer_encoding = base();
+        transfer_encoding.insert("transfer-encoding", "chunked".parse().unwrap());
+        assert!(validate_response(&transfer_encoding, &expected, false).is_err());
+    }
+
     #[test]
     fn normal_tcp_close_is_not_a_websocket_proxy_error() {
         for kind in [