fix: stop rejecting request bodies that contain CR or LF

[shreemaan-abhishek]

Fixes #38.

Any request whose body contained a CR or LF was refused with invalid request before a byte reached the wire, so pretty-printed JSON, multipart and plain text bodies all failed. lua-resty-http sends all of these.

The check protected nothing: the body is length-framed (Content-Length is always derived from req->body.len, and a caller-supplied value must match it exactly), so a CR or LF inside the body cannot escape into the request line or headers. The method, path, host and header fields keep their own token / vchar / field-value validation, which is where the injection defense actually lives.

Changes

• Drop the CRLF scan over req->body in ngx_http_ffi_client_build_request and remove the now-unused ngx_http_ffi_client_has_crlf helper.
• Add t/015 TEST 10: a body containing both a bare LF and a CRLF is sent verbatim, with the exact wire bytes asserted via tcp_query.

Verification

Full Test::Nginx suite passes on the llhttp backend (318 tests), including the new block.

Summary by CodeRabbit

• Bug Fixes

  • Request bodies containing carriage return or line feed characters are now accepted and transmitted correctly.
  • Content length and response handling remain accurate for these requests.

• Tests

  • Added coverage to verify that POST bodies preserve CR and LF characters verbatim.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 61c65e0d-b8df-42ea-b042-589429cba805

📥 Commits

Reviewing files that changed from the base of the PR and between 8a517c4 and dc47c4f.

📒 Files selected for processing (2)

• src/ngx_http_ffi_client_request.c
• t/015-request-validation.t

💤 Files with no reviewable changes (1)

• src/ngx_http_ffi_client_request.c

---

📝 Walkthrough

Walkthrough

The request client removes CR/LF rejection for request bodies. The validation test count is updated, and a TCP test verifies verbatim transmission with the expected content length and response.

Changes

Request body validation

Layer / File(s)	Summary
CR/LF body transmission regression src/ngx_http_ffi_client_request.c, t/015-request-validation.t	The unused CRLF helper is removed. Request bodies containing CR or LF are accepted and tested over TCP for unchanged transmission and the expected response.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• api7/ngx_http_ffi_client#22: Modifies request handling in src/ngx_http_ffi_client_request.c with streaming functionality.
• api7/ngx_http_ffi_client#28: Relates to request-body CR/LF validation and transmission.
• api7/ngx_http_ffi_client#31: Modifies the same request-validation code and tests.

Suggested reviewers: membphis

🚥 Pre-merge checks | ✅ 6

✅ Passed checks (6 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: allowing request bodies that contain CR or LF.
Linked Issues check	✅ Passed	The changes remove body CR/LF rejection and add coverage while preserving validation for request-line and header fields, satisfying issue #38.
Out of Scope Changes check	✅ Passed	The changes are limited to removing body validation and adding targeted tests required by issue #38.
E2e Test Quality Review	✅ Passed	Test 10 exercises request_uri through a raw TCP listener and asserts exact CR/LF body bytes, Content-Length, response, and errors; existing tests cover invalid fields and framing.
Security Check	✅ Passed	No security finding: the change only permits CR/LF in the length-framed body; method, path, host, and headers remain validated, and Content-Length is derived from body length.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/body-crlf-check

---

_{Comment @coderabbitai help to get the list of available commands.}