From 6291be4b88d01169cf05be48f928579cf9552880 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 1 Nov 2025 05:51:50 +0000 Subject: [PATCH 1/4] Initial plan From 362b873b995d6995d3906e65018f639c66acc17a Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 1 Nov 2025 05:57:06 +0000 Subject: [PATCH 2/4] Document encoding restrictions for HTTP header encoding selectors Co-authored-by: MihaZupan <25307628+MihaZupan@users.noreply.github.com> --- xml/System.Net.Http/SocketsHttpHandler.xml | 30 ++++++++++++++++++++-- 1 file changed, 28 insertions(+), 2 deletions(-) diff --git a/xml/System.Net.Http/SocketsHttpHandler.xml b/xml/System.Net.Http/SocketsHttpHandler.xml index e9d65d5748f..dbec7a1dc75 100644 --- a/xml/System.Net.Http/SocketsHttpHandler.xml +++ b/xml/System.Net.Http/SocketsHttpHandler.xml @@ -1124,7 +1124,20 @@ For example, if the value is 64, then 65,536 bytes are allowed for the maximum r Gets or sets a callback that selects the to encode request header values. The header encoding selector callback that selects the to encode the value for the specified request header name, or to indicate the default behavior. - To be added. + + , , or . Other encoding schemes might be susceptible to request smuggling attacks. + +> [!CAUTION] +> Fixed multi-byte encoding schemes in particular (for example, or ) must never be used, as their binary representation is likely to be misinterpreted and break the protocol. For instance, part of `✊` might be interpreted as a new line (`\n`) that terminates the header value. + +When you specify an encoding, it's your responsibility to ensure that the values are representable via the encoding, and that the server agrees on the encoding used. Otherwise, values will become corrupted. For example, since any set of bytes is considered a valid Latin1 sequence, a server replying with UTF-8 encoded header values might see its responses silently corrupted. + + ]]> + An operation has already been started on the current instance. The current instance has been disposed. @@ -1199,7 +1212,20 @@ The timeout specified is greater than mil Gets or sets a callback that selects the to decode response header values. The header encoding selector callback that selects the to decode the value for the specified response header name, or to indicate the default behavior. - To be added. + + , , or . Other encoding schemes might be susceptible to request smuggling attacks. + +> [!CAUTION] +> Fixed multi-byte encoding schemes in particular (for example, or ) must never be used, as their binary representation is likely to be misinterpreted and break the protocol. For instance, part of `✊` might be interpreted as a new line (`\n`) that terminates the header value. + +When you specify an encoding, it's your responsibility to ensure that the values are representable via the encoding, and that the server agrees on the encoding used. Otherwise, values will become corrupted. For example, since any set of bytes is considered a valid Latin1 sequence, a server replying with UTF-8 encoded header values might see its responses silently corrupted. + + ]]> + An operation has already been started on the current instance. The current instance has been disposed. From a3b5f36f303e899ed2a230d78b2af169575570fc Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 1 Nov 2025 05:59:22 +0000 Subject: [PATCH 3/4] Remove trailing whitespace from documentation Co-authored-by: MihaZupan <25307628+MihaZupan@users.noreply.github.com> --- xml/System.Net.Http/SocketsHttpHandler.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xml/System.Net.Http/SocketsHttpHandler.xml b/xml/System.Net.Http/SocketsHttpHandler.xml index dbec7a1dc75..01d92928eb3 100644 --- a/xml/System.Net.Http/SocketsHttpHandler.xml +++ b/xml/System.Net.Http/SocketsHttpHandler.xml @@ -1129,7 +1129,7 @@ For example, if the value is 64, then 65,536 bytes are allowed for the maximum r ## Remarks -When specifying an encoding, you're generally expected to use one of the following encoding schemes: , , or . Other encoding schemes might be susceptible to request smuggling attacks. +When specifying an encoding, you're generally expected to use one of the following encoding schemes: , , or . Other encoding schemes might be susceptible to request smuggling attacks. > [!CAUTION] > Fixed multi-byte encoding schemes in particular (for example, or ) must never be used, as their binary representation is likely to be misinterpreted and break the protocol. For instance, part of `✊` might be interpreted as a new line (`\n`) that terminates the header value. @@ -1217,7 +1217,7 @@ The timeout specified is greater than mil ## Remarks -When specifying an encoding, you're generally expected to use one of the following encoding schemes: , , or . Other encoding schemes might be susceptible to request smuggling attacks. +When specifying an encoding, you're generally expected to use one of the following encoding schemes: , , or . Other encoding schemes might be susceptible to request smuggling attacks. > [!CAUTION] > Fixed multi-byte encoding schemes in particular (for example, or ) must never be used, as their binary representation is likely to be misinterpreted and break the protocol. For instance, part of `✊` might be interpreted as a new line (`\n`) that terminates the header value. From f535530b3ef3cf950a732221e0c9db75f1d14c07 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Sat, 1 Nov 2025 06:03:11 +0000 Subject: [PATCH 4/4] Fix indentation to match existing pattern Co-authored-by: MihaZupan <25307628+MihaZupan@users.noreply.github.com> --- xml/System.Net.Http/SocketsHttpHandler.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/xml/System.Net.Http/SocketsHttpHandler.xml b/xml/System.Net.Http/SocketsHttpHandler.xml index 01d92928eb3..0fa9d0e07c4 100644 --- a/xml/System.Net.Http/SocketsHttpHandler.xml +++ b/xml/System.Net.Http/SocketsHttpHandler.xml @@ -1136,7 +1136,7 @@ When specifying an encoding, you're generally expected to use one of the followi When you specify an encoding, it's your responsibility to ensure that the values are representable via the encoding, and that the server agrees on the encoding used. Otherwise, values will become corrupted. For example, since any set of bytes is considered a valid Latin1 sequence, a server replying with UTF-8 encoded header values might see its responses silently corrupted. - ]]> + ]]> An operation has already been started on the current instance. The current instance has been disposed. @@ -1224,7 +1224,7 @@ When specifying an encoding, you're generally expected to use one of the followi When you specify an encoding, it's your responsibility to ensure that the values are representable via the encoding, and that the server agrees on the encoding used. Otherwise, values will become corrupted. For example, since any set of bytes is considered a valid Latin1 sequence, a server replying with UTF-8 encoded header values might see its responses silently corrupted. - ]]> + ]]> An operation has already been started on the current instance. The current instance has been disposed.