Skip to content

Fix Lighttpd implementation to echo body on POST /#57

Merged
MDA2AV merged 1 commit intomainfrom
fix/lighttpd-post
Feb 14, 2026
Merged

Fix Lighttpd implementation to echo body on POST /#57
MDA2AV merged 1 commit intomainfrom
fix/lighttpd-post

Conversation

@MDA2AV
Copy link
Owner

@MDA2AV MDA2AV commented Feb 14, 2026

Replaced cat with head -c "$CONTENT_LENGTH" so POST / correctly echoes the request body instead of hanging (CGI scripts must read exactly CONTENT_LENGTH bytes, not until EOF).

@MDA2AV MDA2AV linked an issue Feb 14, 2026 that may be closed by this pull request
@github-actions
Copy link

Http11Probe — Compliance Comparison

Server Score
Lighttpd 34/135 █████░░░░░░░░░░░░░░░ 25%

Compliance

Server BASELINE BARE-LF-REQUEST-LINE BARE-LF-HEADER OBS-FOLD SP-BEFORE-COLON MULTI-SP-REQUEST-LINE MISSING-HOST INVALID-VERSION EMPTY-HEADER-NAME CR-ONLY-LINE-ENDING MISSING-TARGET FRAGMENT-IN-TARGET HTTP09-REQUEST INVALID-HEADER-NAME HEADER-NO-COLON DUPLICATE-HOST CL-NON-NUMERIC CL-PLUS-SIGN WHITESPACE-BEFORE-HEADERS DUPLICATE-HOST-SAME HOST-WITH-USERINFO HOST-WITH-PATH ASTERISK-WITH-GET OPTIONS-STAR UNKNOWN-TE-501 LEADING-CRLF ABSOLUTE-FORM METHOD-CASE POST-CL-BODY POST-CL-ZERO POST-NO-CL-NO-TE POST-CL-UNDERSEND CHUNKED-BODY CHUNKED-MULTI CHUNKED-EMPTY CHUNKED-NO-FINAL UPGRADE-POST UPGRADE-MISSING-CONN UPGRADE-UNKNOWN METHOD-CONNECT EXPECT-UNKNOWN GET-WITH-CL-BODY CHUNKED-EXTENSION UPGRADE-INVALID-VER METHOD-TRACE HOST-EMPTY-VALUE REQUEST-LINE-TAB VERSION-MISSING-MINOR VERSION-LEADING-ZEROS VERSION-WHITESPACE CONNECTION-CLOSE HTTP10-DEFAULT-CLOSE HTTP10-NO-HOST HTTP12-VERSION TRACE-WITH-BODY CHUNKED-TRAILER-VALID CHUNKED-HEX-UPPERCASE HEAD-NO-BODY UNKNOWN-METHOD 405-ALLOW DATE-HEADER NO-1XX-HTTP10 NO-CL-IN-204 OPTIONS-ALLOW CONTENT-TYPE
Expected 2xx 400 or close (pass), 2xx (warn) 400 or close (pass), 2xx (warn) 400 400 400 or 2xx 400 400/505 or close 400 or close 400 400 or close 400 or 2xx 400/close/timeout 400 or close 400 or close 400 400 or close 400 or close 400 or close 400 400 or close 400 or close 400 or close 2xx 400/501 or close 400 or 2xx 2xx preferred; 400 warns 400/405/501 or 2xx 2xx 2xx or close 2xx or close 400/close/timeout 2xx 2xx 2xx or close 400/close/timeout !101 !101 !101 400/405/501 or close 417 or 2xx 400 or 2xx 2xx preferred; 400 warns non-101 (426 preferred) 405/501 or 2xx 400 or close 400 or 2xx 400 or close 400 or close 400 or close 2xx + close 2xx + close 200 or 400 200 or 505 400/405 or 200 2xx 2xx 2xx with no body 501/405/400 or close 405 + Allow header 2xx with Date header non-1xx response 204 without CL 2xx with Allow header 2xx with Content-Type
Lighttpd 200 ⚠️200 ⚠️200 200 200 ⚠️200 200 200 200 200 200 ⚠️200 TimedOut 200 200 200 200 200 200 200 200 200 200 200 200 ⚠️200 200 ⚠️200 200 200 200 TimedOut 200 200 200 TimedOut 200 200 200 200 ⚠️200 ⚠️200 200 ⚠️200 ⚠️200 200 ⚠️200 200 200 200 200 200 ⚠️200 ⚠️200 ⚠️200 200 200 200 ⚠️200 ⚠️200 200 200 ⚠️200 ⚠️200 200

Smuggling

Server CL-TE-BOTH DUPLICATE-CL CL-LEADING-ZEROS TE-XCHUNKED TE-TRAILING-SPACE TE-SP-BEFORE-COLON CL-NEGATIVE CLTE-PIPELINE TECL-PIPELINE CL-TRAILING-SPACE TE-DOUBLE-CHUNKED CL-EXTRA-LEADING-SP TE-CASE-MISMATCH CL-COMMA-DIFFERENT TE-NOT-FINAL-CHUNKED TE-HTTP10 CHUNK-BARE-SEMICOLON BARE-CR-HEADER-VALUE CL-OCTAL CHUNK-UNDERSCORE TE-EMPTY-VALUE TE-LEADING-COMMA TE-DUPLICATE-HEADERS CHUNK-HEX-PREFIX CL-HEX-PREFIX CL-INTERNAL-SPACE CHUNK-LEADING-SP CHUNK-MISSING-TRAILING-CRLF CHUNK-EXT-LF CHUNK-SPILL CHUNK-LF-TERM CHUNK-EXT-CTRL CHUNK-EXT-CR TE-VTAB TE-FORMFEED TE-NULL CHUNK-LF-TRAILER TE-IDENTITY CHUNK-NEGATIVE TRANSFER_ENCODING CL-COMMA-SAME CL-COMMA-TRIPLE CHUNKED-WITH-PARAMS EXPECT-100-CL TRAILER-CL TRAILER-TE TRAILER-HOST TRAILER-AUTH HEAD-CL-BODY OPTIONS-CL-BODY CL-UNDERSCORE CL-NEGATIVE-ZERO CL-DOUBLE-ZERO CL-LEADING-ZEROS-OCTAL TE-OBS-FOLD TE-TRAILING-COMMA TE-TAB-BEFORE-VALUE ABSOLUTE-URI-HOST-MISMATCH MULTIPLE-HOST-COMMA CHUNK-BARE-CR-TERM TRAILER-CONTENT-TYPE
Expected 400 or 2xx 400 or close 400 or 2xx 400/501 or close 400/501 or 2xx+close 400 or close 400 or close 400 or close 400 or close 400 or 2xx 400 or 2xx 400 or 2xx 400 or 2xx 400 or close 400 or close 400 or close 400 or close 400 or close 400 or close 400 or close 400 or close 400 or 2xx 400 or close 400 or close 400 or close 400 or close 400 or close 400 or close 400 or 2xx 400 or close 400 or 2xx 400 or close 400 or close 400 or close 400 or close 400 or close 400 or 2xx 400/501 or close 400 or close 400 or 2xx 400 or 2xx 400 or 2xx 400 or 2xx 400 or 2xx 400 or 2xx 400 or 2xx 400 or 2xx 400 or 2xx 400 or 2xx 400 or 2xx 400 or close 400 or close 400 or 2xx 400 or 2xx 400 or 2xx+close 400 or 2xx 400 or 2xx 400 or 2xx 400 or close 400 or close 400 or 2xx
Lighttpd ⚠️200 200 ⚠️200 200 ⚠️200 200 200 200 200 ⚠️200 ⚠️200 ⚠️200 ⚠️200 200 200 200 200 200 200 200 200 ⚠️200 200 200 200 200 200 200 ⚠️200 200 ⚠️200 TimedOut 200 200 200 200 TimedOut 200 200 ⚠️200 ⚠️200 ⚠️200 ⚠️200 ⚠️200 ⚠️200 ⚠️200 ⚠️200 ⚠️200 ⚠️200 ⚠️200 200 200 ⚠️200 ⚠️200 ⚠️200 ⚠️200 ⚠️200 ⚠️200 200 200 ⚠️200

Malformed Input

Server BINARY-GARBAGE LONG-URL LONG-HEADER-VALUE MANY-HEADERS NUL-IN-URL CONTROL-CHARS-HEADER INCOMPLETE-REQUEST EMPTY-REQUEST LONG-HEADER-NAME LONG-METHOD NON-ASCII-HEADER-NAME NON-ASCII-URL CL-OVERFLOW WHITESPACE-ONLY-LINE NUL-IN-HEADER-VALUE CHUNK-SIZE-OVERFLOW H2-PREFACE CL-EMPTY CL-TAB-BEFORE-VALUE URL-BACKSLASH URL-OVERLONG-UTF8 URL-PERCENT-NULL URL-PERCENT-CRLF CHUNK-EXT-64K RANGE-OVERLAPPING POST-CL-HUGE-NO-BODY
Expected 400/close/timeout 400/414/431 or close 400/431 or close 400/431 or close 400 or close 400 or close 400/close/timeout 400/close/timeout 400/431 or close 400 or close 400 or close 400 or close 400 or close 400/close/timeout 400 or close 400 or close 400/505/close/timeout 400 or close 400 or 2xx 400 or 2xx/404 400 or close 400 or 2xx/404 400 or 2xx/404 400 or 2xx 200/206/400/416 400/close/timeout
Lighttpd TimedOut 200 200 200 200 200 TimedOut TimedOut 200 200 200 200 200 200 200 200 TimedOut 200 ⚠️200 ⚠️200 200 ⚠️200 ⚠️200 ⚠️200 ⚠️206 TimedOut

Header Normalization

Server UNDERSCORE-CL SP-BEFORE-COLON-CL TAB-IN-NAME CASE-TE UNDERSCORE-TE
Expected Reject/drop (pass), normalize (fail), preserve (warn) Reject/drop (pass), normalize (fail), preserve (warn) Reject/drop (pass), normalize (fail), preserve (warn) Reject/drop (pass), normalize casing (fail), preserve (warn) Reject/drop (pass), normalize (fail), preserve (warn)
Lighttpd 200 200 200 200 200

Commit: 36b0e85

@MDA2AV MDA2AV merged commit 8a3502e into main Feb 14, 2026
1 check passed
@MDA2AV MDA2AV deleted the fix/lighttpd-post branch February 16, 2026 11:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Fix - Lighttpd - Not echoing body content on POST / requests

1 participant